epan/dissectors/packet-l2tp.c

   1 /* packet-l2tp.c
   2  * Routines for Layer Two Tunnelling Protocol (L2TP) packet disassembly
   3  * John Thomes <john@ensemblecom.com>
   4  *
   5  * Minor changes by: (2000-01-10)
   6  * Laurent Cazalet <laurent.cazalet@mailclub.net>
   7  * Thomas Parvais <thomas.parvais@advalvas.be>
   8  *
   9  * $Id$
  10  *
  11  * Wireshark - Network traffic analyzer
  12  * By Gerald Combs <gerald@wireshark.org>
  13  * Copyright 1998 Gerald Combs
  14  *
  15  * This program is free software; you can redistribute it and/or
  16  * modify it under the terms of the GNU General Public License
  17  * as published by the Free Software Foundation; either version 2
  18  * of the License, or (at your option) any later version.
  19  *
  20  * This program is distributed in the hope that it will be useful,
  21  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  22  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  23  * GNU General Public License for more details.
  24  *
  25  * You should have received a copy of the GNU General Public License
  26  * along with this program; if not, write to the Free Software
  27  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  28  */
  29
  30 /*
  31  * RFC 2661 for L2TPv2
  32  * http://tools.ietf.org/html/rfc2661
  33  *
  34  * RFC 3931 for L2TPv3
  35  * http://tools.ietf.org/html/rfc3931
  36  *
  37  * Layer Two Tunneling Protocol "L2TP" number assignments:
  38  *      http://www.iana.org/assignments/l2tp-parameters
  39  *
  40  * Pseudowire types:
  41  *
  42  * RFC 4591 for Frame Relay
  43  * http://tools.ietf.org/html/rfc4591
  44  *
  45  * RFC 4454 for ATM
  46  * http://tools.ietf.org/html/rfc4454
  47  *
  48  * RFC 4719 for Ethernet
  49  * http://tools.ietf.org/html/rfc4719
  50  *
  51  * RFC 4349 for HDLC
  52  * http://tools.ietf.org/html/rfc4349
  53  *
  54  * XXX - what about LAPD?
  55  */
  56
  57 static int proto_l2tp = -1;
  58 static int hf_l2tp_type = -1;
  59 static int hf_l2tp_length_bit = -1;
  60 static int hf_l2tp_seq_bit = -1;
  61 static int hf_l2tp_offset_bit = -1;
  62 static int hf_l2tp_priority = -1;
  63 static int hf_l2tp_version = -1;
  64 static int hf_l2tp_length = -1;
  65 static int hf_l2tp_tunnel = -1;
  66 static int hf_l2tp_session = -1;
  67 static int hf_l2tp_Ns = -1;
  68 static int hf_l2tp_Nr = -1;
  69 static int hf_l2tp_offset = -1;
  70 static int hf_l2tp_avp_mandatory = -1;
  71 static int hf_l2tp_avp_hidden = -1;
  72 static int hf_l2tp_avp_length = -1;
  73 static int hf_l2tp_avp_vendor_id = -1;
  74 static int hf_l2tp_avp_type = -1;
  75 static int hf_l2tp_tie_breaker = -1;
  76 static int hf_l2tp_sid = -1;
  77 static int hf_l2tp_res = -1;
  78 static int hf_l2tp_ccid = -1;
  79 static int hf_l2tp_cookie = -1;
  80 static int hf_l2tp_l2_spec_def = -1;
  81 static int hf_l2tp_l2_spec_atm = -1;
  82 static int hf_l2tp_l2_spec_docsis_dmpt = -1;
  83 static int hf_l2tp_l2_spec_v = -1;
  84 static int hf_l2tp_l2_spec_s = -1;
  85 static int hf_l2tp_l2_spec_flow_id = -1;
  86 static int hf_l2tp_l2_spec_sequence = -1;
  87 static int hf_l2tp_l2_spec_t = -1;
  88 static int hf_l2tp_l2_spec_g = -1;
  89 static int hf_l2tp_l2_spec_c = -1;
  90 static int hf_l2tp_l2_spec_u = -1;
  91 static int hf_l2tp_cisco_avp_type = -1;
  92
  93 #ifdef HAVE_CONFIG_H
  94 #include "config.h"
  95 #endif
  96
  97 #include <stdlib.h>
  98 #include <ctype.h>
  99 #include <glib.h>
 100 #include <epan/packet.h>
 101 #include <epan/addr_resolv.h>
 102 #include <epan/ipproto.h>
 103 #include <epan/sminmpec.h>
 104 #include <epan/prefs.h>
 105
 106 #define UDP_PORT_L2TP   1701
 107
 108 #define CONTROL_BIT(msg_info) (msg_info & 0x8000)   /* Type bit control = 1 data = 0 */
 109 #define LENGTH_BIT(msg_info) (msg_info & 0x4000)    /* Length bit = 1  */
 110 #define RESERVE_BITS(msg_info) (msg_info &0x37F8)   /* Reserved bit - usused */
 111 #define SEQUENCE_BIT(msg_info) (msg_info & 0x0800)  /* SEQUENCE bit = 1 Ns and Nr fields */
 112 #define OFFSET_BIT(msg_info) (msg_info & 0x0200)    /* Offset */
 113 #define PRIORITY_BIT(msg_info) (msg_info & 0x0100)  /* Priority */
 114 #define L2TP_VERSION(msg_info) (msg_info & 0x000f)  /* Version of l2tp */
 115 #define MANDATORY_BIT(msg_info) (msg_info & 0x8000) /* Mandatory = 1 */
 116 #define HIDDEN_BIT(msg_info) (msg_info & 0x4000)    /* Hidden = 1 */
 117 #define AVP_LENGTH(msg_info) (msg_info & 0x03ff)    /* AVP Length */
 118 #define FRAMING_SYNC(msg_info)  (msg_info & 0x0001) /* SYNC Framing Type */
 119 #define FRAMING_ASYNC(msg_info) (msg_info & 0x0002) /* ASYNC Framing Type */
 120 #define BEARER_DIGITAL(msg_info) (msg_info & 0x0001) /* Digital Bearer Type */
 121 #define BEARER_ANALOG(msg_info) (msg_info & 0x0002) /* Analog Bearer Type */
 122 #define CIRCUIT_STATUS_BIT(msg_info) (msg_info & 0x0001)        /* Circuit Status */
 123 #define CIRCUIT_TYPE_BIT(msg_info) (msg_info & 0x0001)          /* Circuit Condition */
 124
 125 /* DOCSIS DMPT Sub-Layer Header definitions */
 126 #define FLOW_ID_MASK  0x0E
 127
 128 static gint ett_l2tp = -1;
 129 static gint ett_l2tp_ctrl = -1;
 130 static gint ett_l2tp_avp = -1;
 131 static gint ett_l2tp_avp_sub = -1;
 132 static gint ett_l2tp_lcp = -1;
 133 static gint ett_l2tp_l2_spec = -1;
 134
 135 static enum_val_t l2tpv3_cookies[] = {
 136     {"cookie0", "None",                 0},
 137     {"cookie4", "4 Byte Cookie",        4},
 138     {"cookie8", "8 Byte Cookie",        8},
 139     {NULL, NULL, 0}
 140 };
 141
 142 #define L2TPv3_PROTOCOL_ETH     0
 143 #define L2TPv3_PROTOCOL_CHDLC   1
 144 #define L2TPv3_PROTOCOL_FR      2
 145 #define L2TPv3_PROTOCOL_PPP     3
 146 #define L2TPv3_PROTOCOL_IP      4
 147 #define L2TPv3_PROTOCOL_MPLS    5
 148 #define L2TPv3_PROTOCOL_AAL5    6
 149 #define L2TPv3_PROTOCOL_LAPD    7
 150 #define L2TPv3_PROTOCOL_DOCSIS_DMPT 8
 151
 152 static enum_val_t l2tpv3_protocols[] = {
 153     {"eth",     "Ethernet",     L2TPv3_PROTOCOL_ETH},
 154     {"chdlc",   "Cisco HDLC",   L2TPv3_PROTOCOL_CHDLC},
 155     {"fr",      "Frame Relay",  L2TPv3_PROTOCOL_FR},
 156     {"ppp",     "PPP",          L2TPv3_PROTOCOL_PPP},
 157     {"ip",      "IP",           L2TPv3_PROTOCOL_IP},
 158     {"mpls",    "MPLS",         L2TPv3_PROTOCOL_MPLS},
 159     {"aal5",    "AAL5",         L2TPv3_PROTOCOL_AAL5},
 160     {"lapd",    "LAPD",         L2TPv3_PROTOCOL_LAPD},
 161     {"docsis-dmpt", "DOCSIS-DMPT", L2TPv3_PROTOCOL_DOCSIS_DMPT},
 162     {NULL, NULL, 0}
 163 };
 164
 165 #define L2TPv3_L2_SPECIFIC_NONE         0
 166 #define L2TPv3_L2_SPECIFIC_DEFAULT      1
 167 #define L2TPv3_L2_SPECIFIC_ATM          2
 168 #define L2TPv3_L2_SPECIFIC_LAPD         3
 169 #define L2TPv3_L2_SPECIFIC_DOCSIS_DMPT  4
 170
 171 static enum_val_t l2tpv3_l2_specifics[] = {
 172     {"none",    "None",                 L2TPv3_L2_SPECIFIC_NONE},
 173     {"default", "Default L2-Specific",  L2TPv3_L2_SPECIFIC_DEFAULT},
 174     {"atm",     "ATM-Specific",         L2TPv3_L2_SPECIFIC_ATM},
 175     {"lapd",    "LAPD-Specific",        L2TPv3_L2_SPECIFIC_LAPD},
 176     {"dmpt",    "DOCSIS DMPT-Specific", L2TPv3_L2_SPECIFIC_DOCSIS_DMPT},
 177     {NULL, NULL, 0}
 178 };
 179
 180 static gint l2tpv3_cookie = 4;
 181 static gint l2tpv3_protocol = L2TPv3_PROTOCOL_CHDLC;
 182 static gint l2tpv3_l2_specific = L2TPv3_L2_SPECIFIC_DEFAULT;
 183
 184 #define AVP_SCCRQ      1
 185 #define AVP_SCCRP      2
 186 #define AVP_SCCCN      3
 187 #define AVP_StopCCN    4
 188 #define AVP_Reserved   5
 189 #define AVP_HELLO      6
 190 #define AVP_OCRQ       7
 191 #define AVP_OCRP       8
 192 #define AVP_ORCRP      9
 193 #define AVP_ICRQ      10
 194 #define AVP_ICRP      11
 195 #define AVP_ICCN      12
 196 #define AVP_Reserved1 13
 197 #define AVP_CDN       14
 198
 199 #define NUM_CONTROL_CALL_TYPES  27
 200 static const char *calltypestr[NUM_CONTROL_CALL_TYPES+1] = {
 201   "Unknown Call Type",
 202   "Start_Control_Request",
 203   "Start_Control_Reply",
 204   "Start_Control_Connected",
 205   "Stop_Control_Notification",
 206   "Reserved",                                                   /* 5*/
 207   "Hello",
 208   "Outgoing_Call_Request",
 209   "Outgoing_Call_Reply",
 210   "Outgoing_Call_Connected",
 211   "Incoming_Call_Request",                              /* 10 */
 212   "Incoming_Call_Reply",
 213   "Incoming_Call_Connected",
 214   "Reserved",                                                   /* 13 */
 215   "Call_Disconnect_Notification",
 216   "WAN_Error_Notify",                                   /* 15 */
 217   "Set_Link_Info",
 218   "Modem_Status",
 219   "Service_Relay_Request_Msg",
 220   "Service_Relay_Reply_Message",
 221   "Explicit_Acknowledgement",                   /* 20 */
 222   "Failover_Session_Query_Message",             /* 21 [RFC4951] */
 223   "Failover_Session_Response_Message",  /* 22 [RFC4951] */
 224   /* Multicast Management */
 225   "Multicast-Session-Request",                  /* 23 [RFC4045]*/
 226   "Multicast-Session-Response ",                /* 24 [RFC4045]*/
 227   "Multicast-Session-Establishment",    /* 25 [RFC4045]*/
 228   "Multicast-Session-Information",              /* 26 [RFC4045]*/
 229   "Multicast-Session-End-Notify",               /* 27 [RFC4045]*/
 230
 231 };
 232
 233 static const char *calltype_short_str[NUM_CONTROL_CALL_TYPES+1] = {
 234   "Unknown ",
 235   "SCCRQ   ",
 236   "SCCRP   ",
 237   "SCCCN   ",
 238   "StopCCN ",
 239   "Reserved", /* 5 */
 240   "Hello   ",
 241   "OCRQ    ",
 242   "OCRP    ",
 243   "OCCN    ",
 244   "ICRQ    ", /* 10 */
 245   "ICRP    ",
 246   "ICCN    ",
 247   "Reserved",
 248   "CDN     ",
 249   "WEN     ", /* 15 */
 250   "SLI     ",
 251   "MDMST   ",
 252   "SRRQ    ",
 253   "SRRP    ",
 254   "ACK     ", /* 20 */
 255   "FSQ     ",
 256   "FSR     ",
 257   "MSRQ    ",
 258   "MSRP    ",
 259   "MSE     ", /* 25 */
 260   "MSI     ",
 261   "MSEN    ",
 262
 263 };
 264
 265
 266 static const char *control_msg  = "Control Message";
 267 static const char *data_msg     = "Data    Message";
 268 static const value_string l2tp_type_vals[] = {
 269         { 0, "Data Message" },
 270         { 1, "Control Message" },
 271         { 0, NULL },
 272 };
 273
 274 static const value_string cause_code_direction_vals[] = {
 275         { 0, "global error" },
 276         { 1, "at peer" },
 277         { 2, "at local" },
 278         { 0, NULL },
 279 };
 280
 281 static const true_false_string l2tp_length_bit_truth =
 282         { "Length field is present", "Length field is not present" };
 283
 284 static const true_false_string l2tp_seq_bit_truth =
 285         { "Ns and Nr fields are present", "Ns and Nr fields are not present" };
 286
 287 static const true_false_string l2tp_offset_bit_truth =
 288         { "Offset Size field is present", "Offset size field is not present" };
 289
 290 static const true_false_string l2tp_priority_truth =
 291         { "This data message has priority", "No priority" };
 292
 293 static const value_string authen_type_vals[] = {
 294   { 0, "Reserved" },
 295   { 1, "Textual username/password exchange" },
 296   { 2, "PPP CHAP" },
 297   { 3, "PPP PAP" },
 298   { 4, "No Authentication" },
 299   { 5, "Microsoft CHAP Version 1" },
 300   { 6, "Reserved" },
 301   { 7, "EAP" },
 302   { 0, NULL }
 303 };
 304
 305 static const value_string data_sequencing_vals[] = {
 306   { 0, "No incoming data packets require sequencing" },
 307   { 1, "Only non-IP data packets require sequencing" },
 308   { 2, "All incoming data packets require sequencing" },
 309   { 0, NULL }
 310 };
 311
 312 static const value_string l2_sublayer_vals[] = {
 313   { 0, "No L2-Specific Sublayer" },
 314   { 1, "Default L2-Specific Sublayer present" },
 315   { 2, "ATM-Specific Sublayer present" },
 316   { 3, "MPT-Specific Sublayer" },
 317   { 4, "PSP-Specific Sublayer" },
 318   { 0, NULL }
 319 };
 320
 321 static const value_string result_code_stopccn_vals[] = {
 322   { 0, "Reserved", },
 323   { 1, "General request to clear control connection", },
 324   { 2, "General error, Error Code indicates the problem", },
 325   { 3, "Control connection already exists", },
 326   { 4, "Requester is not authorized to establish a control connection", },
 327   { 5, "The protocol version of the requester is not supported", },
 328   { 6, "Requester is being shut down", },
 329   { 7, "Finite state machine error or timeout", },
 330   { 8, "Control connection due to mismatching CCDS value", }, /* [RFC3308] */
 331   { 0, NULL }
 332 };
 333
 334 static const value_string result_code_cdn_vals[] = {
 335   { 0, "Reserved", },
 336   { 1, "Session disconnected due to loss of carrier or circuit disconnect", },
 337   { 2, "Session disconnected for the reason indicated in Error Code", },
 338   { 3, "Session disconnected for administrative reasons", },
 339   { 4, "Appropriate facilities unavailable (temporary condition)", },
 340   { 5, "Appropriate facilities unavailable (permanent condition)", },
 341   { 6, "Invalid destination", },
 342   { 7, "Call failed due to no carrier detected", },
 343   { 8, "Call failed due to detection of a busy signal", },
 344   { 9, "Call failed due to lack of a dial tone", },
 345   { 10, "Call was not established within time allotted by LAC", },
 346   { 11, "Call was connected but no appropriate framing was detected", },
 347   { 12, "Disconnecting call due to mismatching SDS value", },
 348   { 13, "Session not established due to losing tie breaker", },
 349   { 14, "Session not established due to unsupported PW type", },
 350   { 15, "Session not established, sequencing required without valid L2-Specific Sublayer", },
 351   { 16, "Finite state machine error or timeout", },
 352   { 17, "FR PVC was deleted permanently (no longer provisioned) ", },      /* [RFC4591] */
 353   { 18, "FR PVC has been INACTIVE for an extended period of time", },      /* [RFC4591] */
 354   { 19, "Mismatched FR Header Length", },                                  /* [RFC4591] */
 355   { 20, "HDLC Link was deleted permanently (no longer provisioned)", },    /* [RFC4349] */
 356   { 21, "HDLC Link has been INACTIVE for an extended period of time", },   /* [RFC4349] */
 357   { 22, "Session not established due to other LCCE can not support the OAM Cell Emulation", },    /* [RFC4454] */
 358   { 23, "Mismatching interface MTU", },                                    /* [RFC4667] */
 359   { 24, "Attempt to connect to non-existent forwarder", },                 /* [RFC4667] */
 360   { 25, "Attempt to connect to unauthorized forwarder", },                 /* [RFC4667] */
 361   { 26, "Loop Detected", },                                                /* [draft-ietf-l2tpext-tunnel-switching-06.txt] */
 362
 363
 364   { 0, NULL }
 365 };
 366
 367 static const value_string error_code_vals[] = {
 368   { 0, "No General Error", },
 369   { 1, "No control connection exists yet for this pair of LCCEs", },
 370   { 2, "Length is wrong", },
 371   { 3, "One of the field values was out of range", },
 372   { 4, "Insufficient resources to handle this operation now", },
 373   { 5, "Invalid Session ID", },
 374   { 6, "A generic vendor-specific error occurred", },
 375   { 7, "Try another", },
 376   { 8, "Receipt of an unknown AVP with the M bit set", },
 377   { 9, "Try another directed", },
 378   { 10, "Next hop unreachable", },
 379   { 11, "Next hop busy", },
 380   { 12, "TSA busy", },
 381   { 0, NULL }
 382 };
 383
 384 #define  CONTROL_MESSAGE  0
 385 #define  RESULT_ERROR_CODE 1
 386 #define  PROTOCOL_VERSION  2
 387 #define  FRAMING_CAPABILITIES 3
 388 #define  BEARER_CAPABILITIES 4
 389 #define  TIE_BREAKER 5
 390 #define  FIRMWARE_REVISION 6
 391 #define  HOST_NAME 7
 392 #define  VENDOR_NAME 8
 393 #define  ASSIGNED_TUNNEL_ID 9
 394 #define  RECEIVE_WINDOW_SIZE 10
 395 #define  CHALLENGE 11
 396 #define  CAUSE_CODE 12
 397 #define  CHALLENGE_RESPONSE 13
 398 #define  ASSIGNED_SESSION 14
 399 #define  CALL_SERIAL_NUMBER 15
 400 #define  MINIMUM_BPS 16
 401 #define  MAXIMUM_BPS 17
 402 #define  BEARER_TYPE 18
 403 #define  FRAMING_TYPE 19
 404 #define  CALLED_NUMBER 21
 405 #define  CALLING_NUMBER 22
 406 #define  SUB_ADDRESS 23
 407 #define  TX_CONNECT_SPEED 24
 408 #define  PHYSICAL_CHANNEL 25
 409 #define  INITIAL_RECEIVED_LCP_CONFREQ 26
 410 #define  LAST_SENT_LCP_CONFREQ 27
 411 #define  LAST_RECEIVED_LCP_CONFREQ 28
 412 #define  PROXY_AUTHEN_TYPE 29
 413 #define  PROXY_AUTHEN_NAME 30
 414 #define  PROXY_AUTHEN_CHALLENGE 31
 415 #define  PROXY_AUTHEN_ID 32
 416 #define  PROXY_AUTHEN_RESPONSE 33
 417 #define  CALL_STATUS_AVPS 34
 418 #define  ACCM 35
 419 #define  RANDOM_VECTOR 36
 420 #define  PRIVATE_GROUP_ID 37
 421 #define  RX_CONNECT_SPEED 38
 422 #define  SEQUENCING_REQUIRED 39
 423 #define  PPP_DISCONNECT_CAUSE_CODE 46   /* RFC 3145 */
 424 #define  EXTENDED_VENDOR_ID                     58
 425 #define  MESSAGE_DIGEST                         59
 426 #define  ROUTER_ID                                      60
 427 #define  ASSIGNED_CONTROL_CONN_ID       61
 428 #define  PW_CAPABILITY_LIST                     62
 429 #define  LOCAL_SESSION_ID                       63
 430 #define  REMOTE_SESSION_ID                      64
 431 #define  ASSIGNED_COOKIE                        65
 432 #define  REMOTE_END_ID                          66
 433 #define  PW_TYPE                                        68
 434 #define  L2_SPECIFIC_SUBLAYER           69
 435 #define  DATA_SEQUENCING                        70
 436 #define  CIRCUIT_STATUS                         71
 437 #define  PREFERRED_LANGUAGE                     72
 438 #define  CTL_MSG_AUTH_NONCE                     73
 439 #define  TX_CONNECT_SPEED_V3            74
 440 #define  RX_CONNECT_SPEED_V3            75
 441
 442 #define NUM_AVP_TYPES  96
 443 static const value_string avp_type_vals[] = {
 444   { CONTROL_MESSAGE,           "Control Message" },
 445   { RESULT_ERROR_CODE,         "Result-Error Code" },
 446   { PROTOCOL_VERSION,          "Protocol Version" },
 447   { FRAMING_CAPABILITIES,      "Framing Capabilities" },
 448   { BEARER_CAPABILITIES,       "Bearer Capabilities" },
 449   { TIE_BREAKER,               "Tie Breaker" },
 450   { FIRMWARE_REVISION,         "Firmware Revision" },
 451   { HOST_NAME,                 "Host Name" },
 452   { VENDOR_NAME,               "Vendor Name" },
 453   { ASSIGNED_TUNNEL_ID,        "Assigned Tunnel ID" },
 454   { RECEIVE_WINDOW_SIZE,       "Receive Window Size" },
 455   { CHALLENGE,                 "Challenge" },
 456   { CAUSE_CODE,                "Cause Code" },
 457   { CHALLENGE_RESPONSE,        "Challenge Response" },
 458   { ASSIGNED_SESSION,          "Assigned Session" },
 459   { CALL_SERIAL_NUMBER,        "Call Serial Number" },
 460   { MINIMUM_BPS,               "Minimum BPS" },
 461   { MAXIMUM_BPS,               "Maximum BPS" },
 462   { BEARER_TYPE,               "Bearer Type" },
 463   { FRAMING_TYPE,              "Framing Type" },
 464   { CALLED_NUMBER,             "Called Number" },
 465   { CALLING_NUMBER,            "Calling Number" },
 466   { SUB_ADDRESS,               "Sub-Address" },
 467   { TX_CONNECT_SPEED,          "Connect Speed" },
 468   { PHYSICAL_CHANNEL,          "Physical Channel" },
 469   { INITIAL_RECEIVED_LCP_CONFREQ, "Initial Received LCP CONFREQ" },
 470   { LAST_SENT_LCP_CONFREQ,     "Last Sent LCP CONFREQ" },
 471   { LAST_RECEIVED_LCP_CONFREQ, "Last Received LCP CONFREQ" },
 472   { PROXY_AUTHEN_TYPE,         "Proxy Authen Type" },
 473   { PROXY_AUTHEN_NAME,         "Proxy Authen Name" },
 474   { PROXY_AUTHEN_CHALLENGE,    "Proxy Authen Challenge" },
 475   { PROXY_AUTHEN_ID,           "Proxy Authen ID" },
 476   { PROXY_AUTHEN_RESPONSE,     "Proxy Authen Response" },
 477   { CALL_STATUS_AVPS,          "Call status AVPs" },
 478   { ACCM,                      "ACCM" },
 479   { RANDOM_VECTOR,             "Random Vector" },
 480   { PRIVATE_GROUP_ID,          "Private group ID" },
 481   { RX_CONNECT_SPEED,          "RxConnect Speed" },
 482   { SEQUENCING_REQUIRED,       "Sequencing Required" },
 483   { PPP_DISCONNECT_CAUSE_CODE, "PPP Disconnect Cause Code" },
 484   { EXTENDED_VENDOR_ID,        "Extended Vendor ID" },
 485   { MESSAGE_DIGEST,            "Message Digest" },
 486   { ROUTER_ID,                 "Router ID" },
 487   { ASSIGNED_CONTROL_CONN_ID,  "Assigned Control Connection ID" },
 488   { PW_CAPABILITY_LIST,        "Pseudowire Capability List" },
 489   { LOCAL_SESSION_ID,          "Local Session ID" },
 490   { REMOTE_SESSION_ID,         "Remote Session ID" },
 491   { ASSIGNED_COOKIE,           "Assigned Cookie" },
 492   { REMOTE_END_ID,             "Remote End ID" },
 493   { PW_TYPE,                   "Pseudowire Type" },
 494   { L2_SPECIFIC_SUBLAYER,      "Layer2 Specific Sublayer" },
 495   { DATA_SEQUENCING,           "Data Sequencing" },
 496   { CIRCUIT_STATUS,            "Circuit Status" },
 497   { PREFERRED_LANGUAGE,        "Preferred Language" },
 498   { CTL_MSG_AUTH_NONCE,        "Control Message Authentication Nonce" },
 499   { TX_CONNECT_SPEED_V3,       "Tx Connect Speed Version 3" },
 500   { RX_CONNECT_SPEED_V3,       "Rx Connect Speed Version 3" },
 501   { 76,                                                 "Failover Capability" },                                                        /*[RFC4951] */
 502   { 77,                                                 "Tunnel Recovery" },                                                            /*[RFC4951] */
 503   { 78,                                                 "Suggested Control Sequence" },                                         /*[RFC4951] */
 504   { 79,                                                 "Failover Session State" },                                                     /*[RFC4951] */
 505   { 80,                                                 "Multicast Capability" },                                                       /*[RFC4045] */
 506   { 81,                                                 "New Outgoing Sessions" },                                                      /*[RFC4045] */
 507   { 82,                                                 "New Outgoing Sessions Acknowledgement" },                      /*[RFC4045] */
 508   { 83,                                                 "Withdraw Outgoing Sessions" },                                         /*[RFC4045] */
 509   { 84,                                                 "Multicast Packets Priority" },                                         /*[RFC4045] */
 510   { 85,                                                 "Frame-Relay Header Length" },                                          /*[RFC4591] */
 511   { 86,                                                 "ATM Maximum Concatenated Cells AVP" },                         /*[RFC4454] */
 512   { 87,                                                 "OAM Emulation Required AVP" },                                         /*[RFC4454] */
 513   { 88,                                                 "ATM Alarm Status AVP" },                                                       /*[RFC4454] */
 514     /*        Also, see ATM Alarm Status AVP Values below */
 515   { 89,                                                 "Attachment Group Identifier" },                                        /*[RFC4667] */
 516   { 90,                                                 "Local End Identifier" },                                                       /*[RFC4667] */
 517   { 91,                                                 "Interface Maximum Transmission Unit" },                        /*[RFC4667] */
 518   { 92,                                                 "FCS Retention" },                                                                      /*[RFC4720] */
 519   { 93,                                                 "Tunnel Switching Aggregator ID AVP" },                         /*[draft-ietf-l2tpext-tunnel-switching-06.txt] */
 520   { 94,                                                 "Maximum Receive Unit (MRU) AVP" },                                     /*[RFC4623] */
 521   { 95,                                                 "Maximum Reassembled Receive Unit (MRRU) AVP" },        /*[RFC4623] */
 522
 523
 524   { 0,                         NULL }
 525 };
 526
 527 #define CISCO_ASSIGNED_CONNECTION_ID    1
 528 #define CISCO_PW_CAPABILITY_LIST                2
 529 #define CISCO_LOCAL_SESSION_ID                  3
 530 #define CISCO_REMOTE_SESSION_ID                 4
 531 #define CISCO_ASSIGNED_COOKIE                   5
 532 #define CISCO_REMOTE_END_ID                             6
 533 #define CISCO_PW_TYPE                                   7
 534 #define CISCO_CIRCUIT_STATUS                    8
 535 #define CISCO_SESSION_TIE_BREAKER               9
 536 #define CISCO_DRAFT_AVP_VERSION                 10
 537 #define CISCO_MESSAGE_DIGEST                    12
 538 #define CISCO_AUTH_NONCE                                13
 539 #define CISCO_INTERFACE_MTU                             14
 540
 541 static const value_string cisco_avp_type_vals[] = {
 542   { CISCO_ASSIGNED_CONNECTION_ID,       "Assigned Connection ID" },
 543   { CISCO_PW_CAPABILITY_LIST,           "Pseudowire Capabilities List" },
 544   { CISCO_LOCAL_SESSION_ID,                     "Local Session ID" },
 545   { CISCO_REMOTE_SESSION_ID,            "Remote Session ID" },
 546   { CISCO_ASSIGNED_COOKIE,                      "Assigned Cookie" },
 547   { CISCO_REMOTE_END_ID,                        "Remote End ID" },
 548   { CISCO_PW_TYPE,                                      "Pseudowire Type" },
 549   { CISCO_CIRCUIT_STATUS,                       "Circuit Status" },
 550   { CISCO_SESSION_TIE_BREAKER,          "Session Tie Breaker" },
 551   { CISCO_DRAFT_AVP_VERSION,            "Draft AVP Version" },
 552   { CISCO_MESSAGE_DIGEST,               "Message Digest" },
 553   { CISCO_AUTH_NONCE,                   "Control Message Authentication Nonce" },
 554   { CISCO_INTERFACE_MTU,                        "Interface MTU" },
 555   { 0,                                  NULL }
 556 };
 557
 558 static const value_string pw_types_vals[] = {
 559         { 0x0001,  "Frame Relay DLCI" },
 560         { 0x0002,  "ATM AAL5 SDU VCC transport" },
 561         { 0x0003,  "ATM Cell transparent Port Mode" },
 562         { 0x0004,  "Ethernet VLAN" },
 563         { 0x0005,  "Ethernet" },
 564         { 0x0006,  "HDLC" },
 565         { 0x0007,  "PPP" },
 566         { 0x0009,  "ATM Cell transport VCC Mode" },
 567         { 0x000A,  "ATM Cell transport VPC Mode" },
 568         { 0x000B,  "IP Transport" },
 569         { 0x000C,  "MPEG-TS Payload Type (MPTPW)" },
 570         { 0x000D,  "Packet Streaming Protocol (PSPPW)" },
 571         { 0,  NULL },
 572 };
 573
 574 static dissector_handle_t ppp_hdlc_handle;
 575 static dissector_handle_t ppp_lcp_options_handle;
 576
 577 static dissector_handle_t eth_withoutfcs_handle;
 578 static dissector_handle_t chdlc_handle;
 579 static dissector_handle_t fr_handle;
 580 static dissector_handle_t ip_handle;
 581 static dissector_handle_t mpls_handle;
 582 static dissector_handle_t atm_oam_handle;
 583 static dissector_handle_t llc_handle;
 584 static dissector_handle_t lapd_handle;
 585 static dissector_handle_t mp2t_handle;
 586 static dissector_handle_t data_handle;
 587
 588 /*
 589  * Processes AVPs for Control Messages all versions and transports
 590  */
 591 static void process_control_avps(tvbuff_t *tvb,
 592                                  packet_info *pinfo,
 593                                  proto_tree *l2tp_tree,
 594                                  int idx,
 595                                  int length)
 596 {
 597         proto_tree *l2tp_lcp_avp_tree, *l2tp_avp_tree, *l2tp_avp_tree_sub;
 598         proto_item *tf, *te;
 599
 600         int             msg_type;
 601         gboolean        isStopCcn = FALSE;
 602         int             avp_type;
 603         guint32         avp_vendor_id;
 604         guint16         avp_len;
 605         guint16         ver_len_hidden;
 606         int             rhcode = 10;
 607         tvbuff_t        *next_tvb;
 608         guint16         result_code;
 609         guint16         error_code;
 610         guint32         bits;
 611         guint16         firmware_rev;
 612
 613                 while (idx < length) {    /* Process AVP's */
 614                         ver_len_hidden  = tvb_get_ntohs(tvb, idx);
 615                         avp_len         = AVP_LENGTH(ver_len_hidden);
 616                         avp_vendor_id   = tvb_get_ntohs(tvb, idx + 2);
 617                         avp_type        = tvb_get_ntohs(tvb, idx + 4);
 618
 619                         if (avp_len < 1) {
 620                                 proto_tree_add_text(l2tp_tree, tvb, idx, 0,
 621                                                     "AVP length must be >= 1");
 622                                 return;
 623                         }
 624
 625                         if (avp_vendor_id == VENDOR_IETF) {
 626                                 tf =  proto_tree_add_text(l2tp_tree, tvb, idx,
 627                                                           avp_len, "%s AVP",
 628                                                           val_to_str(avp_type, avp_type_vals, "Unknown (%u)"));
 629                         } else if (avp_vendor_id == VENDOR_CISCO) {      /* Vendor-Specific AVP */
 630                                 tf =  proto_tree_add_text(l2tp_tree, tvb, idx,
 631                                                           avp_len, "Vendor %s: %s AVP",
 632                                                           val_to_str_ext(avp_vendor_id, &sminmpec_values_ext, "Unknown (%u)"),
 633                                                           val_to_str(avp_type, cisco_avp_type_vals, "Unknown (%u)"));
 634                         } else {        /* Vendor-Specific AVP */
 635                                 tf =  proto_tree_add_text(l2tp_tree, tvb, idx,
 636                                                           avp_len, "Vendor %s AVP Type %u",
 637                                                           val_to_str_ext(avp_vendor_id, &sminmpec_values_ext, "Unknown (%u)"),
 638                                                           avp_type);
 639                         }
 640
 641
 642                         l2tp_avp_tree = proto_item_add_subtree(tf,  ett_l2tp_avp);
 643
 644                         proto_tree_add_boolean_format(l2tp_avp_tree,hf_l2tp_avp_mandatory, tvb, idx, 1,
 645                                                       rhcode, "Mandatory: %s",
 646                                                       (MANDATORY_BIT(ver_len_hidden)) ? "True" : "False" );
 647                         proto_tree_add_boolean_format(l2tp_avp_tree,hf_l2tp_avp_hidden, tvb, idx, 1,
 648                                                       rhcode, "Hidden: %s",
 649                                                       (HIDDEN_BIT(ver_len_hidden)) ? "True" : "False" );
 650                         proto_tree_add_uint_format(l2tp_avp_tree,hf_l2tp_avp_length, tvb, idx, 2,
 651                                                    rhcode, "Length: %u", avp_len);
 652                         if (HIDDEN_BIT(ver_len_hidden)) { /* don't try do display hidden */
 653                                 idx += avp_len;
 654                                 continue;
 655                         }
 656
 657                         if (avp_len < 6) {
 658                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 0,
 659                                                     "AVP length must be >= 6");
 660                                 return;
 661                         }
 662                         idx += 2;
 663                         avp_len -= 2;
 664
 665                         /* Special Case for handling Extended Vendor Id */
 666                         if (avp_type == EXTENDED_VENDOR_ID) {
 667                                 idx += 2;
 668                                 avp_len -= 2;
 669                                 proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_vendor_id,
 670                                                                         tvb, idx, 4, FALSE);
 671
 672                                 avp_vendor_id  = tvb_get_ntohl(tvb, idx);
 673
 674                                 idx += 4;
 675                                 avp_len -= 4;
 676                                 continue;
 677                         }
 678                         else {
 679                                 proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_vendor_id,
 680                                                     tvb, idx, 2, FALSE);
 681                                 idx += 2;
 682                                 avp_len -= 2;
 683                         }
 684
 685                         if (avp_vendor_id == VENDOR_CISCO) {
 686                                 proto_tree_add_uint(l2tp_avp_tree, hf_l2tp_cisco_avp_type,
 687                                                     tvb, idx, 2, avp_type);
 688                                 idx += 2;
 689                                 avp_len -= 2;
 690
 691                                 /* For the time being, we don't decode any Vendor-
 692                                    specific AVP. */
 693                                 switch (avp_type) {
 694                                 case CISCO_ASSIGNED_CONNECTION_ID:
 695                                         proto_tree_add_text(l2tp_avp_tree, tvb, idx, 4,
 696                                                             "Assigned Control Connection ID: %u",
 697                                                             tvb_get_ntohl(tvb, idx));
 698                                         break;
 699
 700                                 case CISCO_PW_CAPABILITY_LIST:
 701                                         te = proto_tree_add_text(l2tp_avp_tree, tvb, idx, avp_len,
 702                                                 "Pseudowire Capabilities List");
 703                                         l2tp_avp_tree_sub = proto_item_add_subtree(te, ett_l2tp_avp_sub);
 704                                         while (avp_len >= 2) {
 705                                                 int pw_type = tvb_get_ntohs(tvb, idx);
 706
 707                                                 proto_tree_add_text(l2tp_avp_tree_sub, tvb, idx,
 708                                                                     2, "PW Type: (%u) %s",
 709                                                                     pw_type,
 710                                                                     val_to_str(pw_type, pw_types_vals,
 711                                                                                "Unknown (0x%04x)"));
 712                                                 idx += 2;
 713                                                 avp_len -= 2;
 714                                         }
 715                                         break;
 716
 717                                 case CISCO_LOCAL_SESSION_ID:
 718                                         proto_tree_add_text(l2tp_avp_tree, tvb, idx, 4,
 719                                                             "Local Session ID: %u",
 720                                                             tvb_get_ntohl(tvb, idx));
 721                                         break;
 722                                 case CISCO_REMOTE_SESSION_ID:
 723                                         proto_tree_add_text(l2tp_avp_tree, tvb, idx, 4,
 724                                                             "Remote Session ID: %u",
 725                                                             tvb_get_ntohl(tvb, idx));
 726                                         break;
 727                                 case CISCO_ASSIGNED_COOKIE:
 728                                         proto_tree_add_text(l2tp_avp_tree, tvb, idx, avp_len,
 729                                                             "Assigned Cookie: %s",
 730                                                             tvb_bytes_to_str(tvb, idx, avp_len));
 731                                         break;
 732                                 case CISCO_REMOTE_END_ID:
 733                                         proto_tree_add_text(l2tp_avp_tree, tvb, idx, avp_len,
 734                                                             "Remote End ID: %s",
 735                                                             tvb_format_text(tvb, idx, avp_len));
 736                                         break;
 737                                 case CISCO_PW_TYPE:
 738                                         proto_tree_add_text(l2tp_avp_tree, tvb, idx, 2,
 739                                                             "Pseudowire Type: %u - %s",
 740                                                             tvb_get_ntohs(tvb, idx),
 741                                                             val_to_str(tvb_get_ntohs(tvb, idx),
 742                                                                        pw_types_vals, "Unknown (0x%04x)"));
 743                                         break;
 744                                 case CISCO_CIRCUIT_STATUS:
 745                                         bits = tvb_get_ntohs(tvb, idx);
 746                                         proto_tree_add_text(l2tp_avp_tree, tvb, idx, 2,
 747                                                             "Circuit Status: %s",
 748                                                             (CIRCUIT_STATUS_BIT(bits)) ? "Up" : "Down");
 749                                         proto_tree_add_text(l2tp_avp_tree, tvb, idx, 2,
 750                                                             "Circuit Type: %s",
 751                                                             (CIRCUIT_TYPE_BIT(bits)) ? "New" : "Existing");
 752                                         break;
 753                                 case CISCO_SESSION_TIE_BREAKER:
 754                                         proto_tree_add_item(l2tp_avp_tree, hf_l2tp_tie_breaker,
 755                                                             tvb, idx, 8, FALSE);
 756                                         break;
 757                                 case CISCO_DRAFT_AVP_VERSION:
 758                                         proto_tree_add_text(l2tp_avp_tree, tvb, idx, 2,
 759                                                             "Draft AVP Version: %u",
 760                                                             tvb_get_ntohs(tvb, idx));
 761                                         break;
 762                                 case CISCO_MESSAGE_DIGEST:
 763                                         proto_tree_add_text(l2tp_avp_tree, tvb, idx, avp_len,
 764                                                             "Message Digest: %s",
 765                                                             tvb_bytes_to_str(tvb, idx, avp_len));
 766                                         break;
 767                                 case CISCO_AUTH_NONCE:
 768                                         proto_tree_add_text(l2tp_avp_tree, tvb, idx, avp_len,
 769                                                             "Nonce: %s",
 770                                                             tvb_bytes_to_str(tvb, idx, avp_len));
 771                                         break;
 772                                 case CISCO_INTERFACE_MTU:
 773                                         proto_tree_add_text(l2tp_avp_tree, tvb, idx, avp_len,
 774                                                             "Interface MTU: %u",
 775                                                             tvb_get_ntohs(tvb, idx));
 776                                         break;
 777
 778                                 default:
 779                                         proto_tree_add_text(l2tp_avp_tree, tvb, idx,
 780                                                             avp_len, "Vendor-Specific AVP");
 781                                         break;
 782                                 }
 783                                 idx += avp_len;
 784                                 continue;
 785                         } else if (avp_vendor_id != VENDOR_IETF) {
 786                                 if (avp_len >= 2) {
 787                                         proto_tree_add_text(l2tp_avp_tree, tvb, idx, 2,
 788                                                 "Type: %u", avp_type);
 789                                         idx += 2;
 790                                         avp_len -= 2;
 791                                         if (avp_len > 0) {
 792                                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx,
 793                                                         avp_len, "Vendor-Specific AVP");
 794                                         }
 795                                 }
 796                                 idx += avp_len;
 797                                 continue;
 798                         }
 799
 800                         proto_tree_add_uint(l2tp_avp_tree, hf_l2tp_avp_type,
 801                                             tvb, idx, 2, avp_type);
 802                         idx += 2;
 803                         avp_len -= 2;
 804
 805                         switch (avp_type) {
 806
 807                         case CONTROL_MESSAGE:
 808                                 msg_type = tvb_get_ntohs(tvb, idx);
 809                                 proto_tree_add_text(l2tp_avp_tree,tvb, idx, 2,
 810                                                     "Control Message Type: (%u) %s", msg_type,
 811                                                     ((NUM_CONTROL_CALL_TYPES + 1 ) > msg_type) ?
 812                                                     calltypestr[msg_type] : "Unknown");
 813
 814                                 if (msg_type == AVP_StopCCN) {
 815                                         isStopCcn = TRUE;
 816                                 }
 817                                 break;
 818
 819                         case RESULT_ERROR_CODE:
 820                                 if (avp_len < 2)
 821                                         break;
 822                                 result_code = tvb_get_ntohs(tvb, idx);
 823                                 if (isStopCcn) {
 824                                         proto_tree_add_text(l2tp_avp_tree, tvb, idx, 2,
 825                                                             "Result code: %u - %s", result_code,
 826                                                             val_to_str(result_code, result_code_stopccn_vals, "Unknown (%u)"));
 827                                 }
 828                                 else {
 829                                         proto_tree_add_text(l2tp_avp_tree, tvb, idx, 2,
 830                                                             "Result code: %u - %s", result_code,
 831                                                             val_to_str(result_code, result_code_cdn_vals, "Unknown (%u)"));
 832                                 }
 833                                 idx += 2;
 834                                 avp_len -= 2;
 835
 836                                 if (avp_len < 2)
 837                                         break;
 838                                 error_code = tvb_get_ntohs(tvb, idx);
 839                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 2,
 840                                                     "Error code: %u - %s", error_code,
 841                                                     val_to_str(error_code, error_code_vals, "Unknown (%u)"));
 842                                 idx += 2;
 843                                 avp_len -= 2;
 844
 845                                 if (avp_len == 0)
 846                                         break;
 847                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, avp_len,
 848                                                     "Error Message: %s",
 849                                                     tvb_format_text(tvb, idx, avp_len));
 850                                 break;
 851
 852                         case PROTOCOL_VERSION:
 853                                 if (avp_len < 1)
 854                                         break;
 855                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 1,
 856                                                     "Version: %u", tvb_get_guint8(tvb, idx));
 857                                 idx += 1;
 858                                 avp_len -= 1;
 859
 860                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 1,
 861                                                     "Revision: %u", tvb_get_guint8(tvb, idx));
 862                                 break;
 863
 864                         case FRAMING_CAPABILITIES:
 865                                 bits = tvb_get_ntohl(tvb, idx);
 866                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 4,
 867                                                     "Async Framing Supported: %s",
 868                                                     (FRAMING_ASYNC(bits)) ? "True" : "False");
 869                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 4,
 870                                                     "Sync Framing Supported: %s",
 871                                                     (FRAMING_SYNC(bits)) ? "True" : "False");
 872                                 break;
 873
 874                         case BEARER_CAPABILITIES:
 875                                 bits = tvb_get_ntohl(tvb, idx);
 876                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 4,
 877                                                     "Analog Access Supported: %s",
 878                                                     (BEARER_ANALOG(bits)) ? "True" : "False");
 879                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 4,
 880                                                     "Digital Access Supported: %s",
 881                                                     (BEARER_DIGITAL(bits)) ? "True" : "False");
 882                                 break;
 883
 884                         case TIE_BREAKER:
 885                                 proto_tree_add_item(l2tp_avp_tree, hf_l2tp_tie_breaker, tvb, idx, 8, FALSE);
 886                                 break;
 887
 888                         case FIRMWARE_REVISION:
 889                                 firmware_rev = tvb_get_ntohs(tvb, idx);
 890                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 2,
 891                                                     "Firmware Revision: %d 0x%x", firmware_rev,firmware_rev );
 892                                 break;
 893
 894                         case HOST_NAME:
 895                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, avp_len,
 896                                                     "Host Name: %s",
 897                                                     tvb_format_text(tvb, idx, avp_len));
 898                                 break;
 899
 900                         case VENDOR_NAME:
 901                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, avp_len,
 902                                                     "Vendor Name: %s",
 903                                                     tvb_format_text(tvb, idx, avp_len));
 904                                 break;
 905
 906                         case ASSIGNED_TUNNEL_ID:
 907                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 2,
 908                                                     "Tunnel ID: %u", tvb_get_ntohs(tvb, idx));
 909                                 break;
 910
 911                         case RECEIVE_WINDOW_SIZE:
 912                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 2,
 913                                                     "Receive Window Size: %u",
 914                                                     tvb_get_ntohs(tvb, idx));
 915                                 break;
 916
 917                         case CHALLENGE:
 918                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, avp_len,
 919                                                     "CHAP Challenge: %s",
 920                                                     tvb_bytes_to_str(tvb, idx, avp_len));
 921                                 break;
 922
 923                         case CAUSE_CODE:
 924                                 /*
 925                                  * XXX - export stuff from the Q.931 dissector
 926                                  * to dissect the cause code and cause message,
 927                                  * and use it.
 928                                  */
 929                                 if (avp_len < 2)
 930                                         break;
 931                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 2,
 932                                                     "Cause Code: %u",
 933                                                     tvb_get_ntohs(tvb, idx));
 934                                 idx += 2;
 935                                 avp_len -= 2;
 936
 937                                 if (avp_len < 1)
 938                                         break;
 939                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 1,
 940                                                     "Cause Msg: %u",
 941                                                     tvb_get_guint8(tvb, idx));
 942                                 idx += 1;
 943                                 avp_len -= 1;
 944
 945                                 if (avp_len == 0)
 946                                         break;
 947                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, avp_len,
 948                                                     "Advisory Msg: %s",
 949                                                     tvb_format_text(tvb, idx, avp_len));
 950                                 break;
 951
 952                         case CHALLENGE_RESPONSE:
 953                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 16,
 954                                                     "CHAP Challenge Response: %s",
 955                                                     tvb_bytes_to_str(tvb, idx, 16));
 956                                 break;
 957
 958                         case ASSIGNED_SESSION:
 959                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 2,
 960                                                     "Assigned Session: %u",
 961                                                     tvb_get_ntohs(tvb, idx));
 962                                 break;
 963
 964                         case CALL_SERIAL_NUMBER:
 965                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 4,
 966                                                     "Call Serial Number: %u",
 967                                                     tvb_get_ntohl(tvb, idx));
 968                                 break;
 969
 970                         case MINIMUM_BPS:
 971                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 4,
 972                                                     "Minimum BPS: %u",
 973                                                     tvb_get_ntohl(tvb, idx));
 974                                 break;
 975
 976                         case MAXIMUM_BPS:
 977                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 4,
 978                                                     "Maximum BPS: %u",
 979                                                     tvb_get_ntohl(tvb, idx));
 980                                 break;
 981
 982                         case BEARER_TYPE:
 983                                 bits = tvb_get_ntohl(tvb, idx);
 984                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 4,
 985                                                     "Analog Bearer Type: %s",
 986                                                     (BEARER_ANALOG(bits)) ? "True" : "False");
 987                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 4,
 988                                                     "Digital Bearer Type: %s",
 989                                                     (BEARER_DIGITAL(bits)) ? "True" : "False");
 990                                 break;
 991
 992                         case FRAMING_TYPE:
 993                                 bits = tvb_get_ntohl(tvb, idx);
 994                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 4,
 995                                                     "Async Framing Type: %s",
 996                                                     (FRAMING_ASYNC(bits)) ? "True" : "False");
 997                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 4,
 998                                                     "Sync Framing Type: %s",
 999                                                      (FRAMING_SYNC(bits)) ? "True" : "False");
1000                                 break;
1001
1002                         case CALLED_NUMBER:
1003                                 if (avp_len == 0)
1004                                         break;
1005                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, avp_len,
1006                                                     "Called Number: %s",
1007                                                     tvb_format_text(tvb, idx, avp_len));
1008                                 break;
1009
1010                         case CALLING_NUMBER:
1011                                 if (avp_len == 0)
1012                                         break;
1013                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, avp_len,
1014                                                     "Calling Number: %s",
1015                                                     tvb_format_text(tvb, idx, avp_len));
1016                                 break;
1017
1018                         case SUB_ADDRESS:
1019                                 if (avp_len == 0)
1020                                         break;
1021                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, avp_len,
1022                                                     "Sub-Address: %s",
1023                                                     tvb_format_text(tvb, idx, avp_len));
1024                                 break;
1025
1026                         case TX_CONNECT_SPEED:
1027                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 4,
1028                                                     "Connect Speed: %u",
1029                                                     tvb_get_ntohl(tvb, idx));
1030                                 break;
1031
1032                         case PHYSICAL_CHANNEL:
1033                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 4,
1034                                                     "Physical Channel: %u",
1035                                                     tvb_get_ntohl(tvb, idx));
1036                                 break;
1037
1038                         case INITIAL_RECEIVED_LCP_CONFREQ:
1039                                 te = proto_tree_add_text(l2tp_avp_tree, tvb, idx, avp_len,
1040                                                          "Initial Received LCP CONFREQ: %s",
1041                                                          tvb_bytes_to_str(tvb, idx, avp_len));
1042                                 l2tp_lcp_avp_tree = proto_item_add_subtree(te, ett_l2tp_lcp);
1043                                 next_tvb = tvb_new_subset(tvb, idx, avp_len, avp_len);
1044                                 call_dissector(ppp_lcp_options_handle, next_tvb, pinfo, l2tp_lcp_avp_tree );
1045                                 break;
1046
1047                         case LAST_SENT_LCP_CONFREQ:
1048                                 te = proto_tree_add_text(l2tp_avp_tree, tvb, idx, avp_len,
1049                                                          "Last Sent LCP CONFREQ: %s",
1050                                                          tvb_bytes_to_str(tvb, idx, avp_len));
1051                                 l2tp_lcp_avp_tree = proto_item_add_subtree(te, ett_l2tp_lcp);
1052                                 next_tvb = tvb_new_subset(tvb, idx, avp_len, avp_len);
1053                                 call_dissector(ppp_lcp_options_handle, next_tvb, pinfo, l2tp_lcp_avp_tree );
1054                                 break;
1055
1056                         case LAST_RECEIVED_LCP_CONFREQ:
1057                                 te = proto_tree_add_text(l2tp_avp_tree, tvb, idx, avp_len,
1058                                                          "Last Received LCP CONFREQ: %s",
1059                                                          tvb_bytes_to_str(tvb, idx, avp_len));
1060                                 l2tp_lcp_avp_tree = proto_item_add_subtree(te, ett_l2tp_lcp);
1061                                 next_tvb = tvb_new_subset(tvb, idx, avp_len, avp_len);
1062                                 call_dissector(ppp_lcp_options_handle, next_tvb, pinfo, l2tp_lcp_avp_tree );
1063                                 break;
1064
1065                         case PROXY_AUTHEN_TYPE:
1066                                 msg_type = tvb_get_ntohs(tvb, idx);
1067                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 2,
1068                                                     "Proxy Authen Type: %s",
1069                                                     val_to_str(msg_type, authen_type_vals, "Unknown (%u)"));
1070                                 break;
1071
1072                         case PROXY_AUTHEN_NAME:
1073                                 if (avp_len == 0)
1074                                         break;
1075                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, avp_len,
1076                                                     "Proxy Authen Name: %s",
1077                                                     tvb_format_text(tvb, idx, avp_len));
1078                                 break;
1079
1080                         case PROXY_AUTHEN_CHALLENGE:
1081                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, avp_len,
1082                                                     "Proxy Authen Challenge: %s",
1083                                                     tvb_bytes_to_str(tvb, idx, avp_len));
1084                                 break;
1085
1086                         case PROXY_AUTHEN_ID:
1087                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx + 1, 1,
1088                                                     "Proxy Authen ID: %u",
1089                                                     tvb_get_guint8(tvb, idx + 1));
1090                                 break;
1091
1092                         case PROXY_AUTHEN_RESPONSE:
1093                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, avp_len,
1094                                                     "Proxy Authen Response: %s",
1095                                                     tvb_bytes_to_str(tvb, idx, avp_len));
1096                                 break;
1097
1098                         case CALL_STATUS_AVPS:
1099                                 if (avp_len < 2)
1100                                         break;
1101                                 idx += 2;
1102                                 avp_len -= 2;
1103
1104                                 if (avp_len < 4)
1105                                         break;
1106                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 4,
1107                                                     "CRC Errors: %u", tvb_get_ntohl(tvb, idx));
1108                                 idx += 4;
1109                                 avp_len -= 4;
1110
1111                                 if (avp_len < 4)
1112                                         break;
1113                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 4,
1114                                                     "Framing Errors: %u", tvb_get_ntohl(tvb, idx));
1115                                 idx += 4;
1116                                 avp_len -= 4;
1117
1118                                 if (avp_len < 4)
1119                                         break;
1120                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 4,
1121                                                     "Hardware Overruns: %u", tvb_get_ntohl(tvb, idx));
1122                                 idx += 4;
1123                                 avp_len -= 4;
1124
1125                                 if (avp_len < 4)
1126                                         break;
1127                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 4,
1128                                                     "Buffer Overruns: %u", tvb_get_ntohl(tvb, idx));
1129                                 idx += 4;
1130                                 avp_len -= 4;
1131
1132                                 if (avp_len < 4)
1133                                         break;
1134                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 4,
1135                                                     "Time-out Errors: %u", tvb_get_ntohl(tvb, idx));
1136                                 idx += 4;
1137                                 avp_len -= 4;
1138
1139                                 if (avp_len < 4)
1140                                         break;
1141                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 4,
1142                                                     "Alignment Errors: %u", tvb_get_ntohl(tvb, idx));
1143                                 idx += 4;
1144                                 avp_len -= 4;
1145                                 break;
1146
1147                         case ACCM:
1148                                 if (avp_len < 2)
1149                                         break;
1150                                 idx += 2;
1151                                 avp_len -= 2;
1152
1153                                 if (avp_len < 4)
1154                                         break;
1155                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 4,
1156                                                     "Send ACCM: %u", tvb_get_ntohl(tvb, idx));
1157                                 idx += 4;
1158                                 avp_len -= 4;
1159
1160                                 if (avp_len < 4)
1161                                         break;
1162                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 4,
1163                                                     "Receive ACCM: %u", tvb_get_ntohl(tvb, idx));
1164                                 idx += 4;
1165                                 avp_len -= 4;
1166                                 break;
1167
1168                         case RANDOM_VECTOR:
1169                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, avp_len,
1170                                                     "Random Vector: %s",
1171                                                     tvb_bytes_to_str(tvb, idx, avp_len));
1172                                 break;
1173
1174                         case PRIVATE_GROUP_ID:
1175                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, avp_len,
1176                                                     "Private Group ID: %s",
1177                                                     tvb_bytes_to_str(tvb, idx, avp_len));
1178                                 break;
1179
1180                         case RX_CONNECT_SPEED:
1181                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 4,
1182                                                     "Rx Connect Speed: %u",
1183                                                     tvb_get_ntohl(tvb, idx));
1184                                 break;
1185
1186                         case PPP_DISCONNECT_CAUSE_CODE:
1187                                 if (avp_len < 2)
1188                                         break;
1189                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 2,
1190                                                     "Disconnect Code: %u",
1191                                                     tvb_get_ntohs(tvb, idx));
1192                                 idx += 2;
1193                                 avp_len -= 2;
1194
1195                                 if (avp_len < 2)
1196                                         break;
1197                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 2,
1198                                                     "Control Protocol Number: %u",
1199                                                     tvb_get_ntohs(tvb, idx));
1200                                 idx += 2;
1201                                 avp_len -= 2;
1202
1203                                 if (avp_len < 1)
1204                                         break;
1205                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 1,
1206                                                     "Direction: %s",
1207                                                     val_to_str(tvb_get_guint8(tvb, idx),
1208                                                     cause_code_direction_vals,
1209                                                     "Reserved (%u)"));
1210                                 idx += 1;
1211                                 avp_len -= 1;
1212
1213                                 if (avp_len == 0)
1214                                         break;
1215                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, avp_len,
1216                                                     "Message: %s",
1217                                                     tvb_format_text(tvb, idx, avp_len));
1218                                 break;
1219
1220                         case MESSAGE_DIGEST:
1221                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, avp_len,
1222                                                     "Message Digest: %s",
1223                                                     tvb_bytes_to_str(tvb, idx, avp_len));
1224                                 break;
1225                         case ROUTER_ID:
1226                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 4,
1227                                                     "Router ID: %u",
1228                                                     tvb_get_ntohl(tvb, idx));
1229                                 break;
1230                         case ASSIGNED_CONTROL_CONN_ID:
1231                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 4,
1232                                                     "Assigned Control Connection ID: %u",
1233                                                     tvb_get_ntohl(tvb, idx));
1234                                 break;
1235                         case PW_CAPABILITY_LIST:
1236                                 te = proto_tree_add_text(l2tp_avp_tree, tvb, idx, avp_len,
1237                                         "Pseudowire Capabilities List");
1238                                 l2tp_avp_tree_sub = proto_item_add_subtree(te, ett_l2tp_avp_sub);
1239
1240                                 while (avp_len >= 2) {
1241                                         int pw_type = tvb_get_ntohs(tvb, idx);
1242                                         proto_tree_add_text(l2tp_avp_tree_sub, tvb, idx,
1243                                                             2, "PW Type: (%u) %s",
1244                                                             pw_type,
1245                                                             val_to_str(pw_type, pw_types_vals,
1246                                                                        "Unknown (0x%04x)"));
1247                                         idx += 2;
1248                                         avp_len -= 2;
1249                                 }
1250                                 break;
1251                         case LOCAL_SESSION_ID:
1252                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 4,
1253                                                     "Local Session ID: %u",
1254                                                     tvb_get_ntohl(tvb, idx));
1255                                 break;
1256                         case REMOTE_SESSION_ID:
1257                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 4,
1258                                                     "Remote Session ID: %u",
1259                                                     tvb_get_ntohl(tvb, idx));
1260                                 break;
1261                         case ASSIGNED_COOKIE:
1262                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, avp_len,
1263                                                     "Assigned Cookie: %s",
1264                                                     tvb_bytes_to_str(tvb, idx, avp_len));
1265                                 break;
1266                         case REMOTE_END_ID:
1267                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, avp_len,
1268                                                     "Remote End ID: %s",
1269                                                     tvb_format_text(tvb, idx, avp_len));
1270                                 break;
1271                         case PW_TYPE:
1272                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 2,
1273                                                     "Pseudowire Type: %u - %s",
1274                                                     tvb_get_ntohs(tvb, idx),
1275                                                     val_to_str(tvb_get_ntohs(tvb, idx),
1276                                                                pw_types_vals, "Unknown (0x%04x)"));
1277                                 break;
1278                         case L2_SPECIFIC_SUBLAYER:
1279                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 2,
1280                                                     "Layer2 Specific Sublayer: %s",
1281                                                     val_to_str(tvb_get_ntohs(tvb, idx),
1282                                                                l2_sublayer_vals, "Invalid (%u)"));
1283                                 break;
1284                         case DATA_SEQUENCING:
1285                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 2,
1286                                                     "Data Sequencing: %s",
1287                                                     val_to_str(tvb_get_ntohs(tvb, idx),
1288                                                                data_sequencing_vals, "Invalid (%u)"));
1289                                 break;
1290                         case CIRCUIT_STATUS:
1291                                 bits = tvb_get_ntohs(tvb, idx);
1292                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 2,
1293                                                     "Circuit Status: %s",
1294                                                     (CIRCUIT_STATUS_BIT(bits)) ? "Up" : "Down");
1295                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 2,
1296                                                     "Circuit Type: %s",
1297                                                     (CIRCUIT_TYPE_BIT(bits)) ? "New" : "Existing");
1298                                 break;
1299                         case PREFERRED_LANGUAGE:
1300                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, avp_len,
1301                                                    "Preferred Language: %s",
1302                                                    tvb_format_text(tvb, idx, avp_len));
1303                                 break;
1304                         case CTL_MSG_AUTH_NONCE:
1305                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, avp_len,
1306                                                     "Nonce: %s",
1307                                                     tvb_bytes_to_str(tvb, idx, avp_len));
1308                                 break;
1309                         case TX_CONNECT_SPEED_V3:
1310                         {
1311                                 guint32 l_int, h_int;
1312                                 if (avp_len < 8)
1313                                         break;
1314
1315                                 h_int = tvb_get_ntohl(tvb, idx);
1316                                 l_int = tvb_get_ntohl(tvb, idx+4);
1317                                 if (!h_int && !l_int) {
1318                                         proto_tree_add_text(l2tp_avp_tree, tvb, idx, 8,
1319                                                             "Tx Connect Speed v3: indeterminable or no physical p2p link");
1320                                 }
1321                                 else {
1322                                         proto_tree_add_text(l2tp_avp_tree, tvb, idx, 8,
1323                                                             "Tx Connect Speed v3: %#x%04x",
1324                                                             h_int, l_int);
1325                                 }
1326                                 break;
1327                         }
1328                         case RX_CONNECT_SPEED_V3:
1329                         {
1330                                 guint32 l_int, h_int;
1331                                 if (avp_len < 8)
1332                                         break;
1333
1334                                 h_int = tvb_get_ntohl(tvb, idx);
1335                                 l_int = tvb_get_ntohl(tvb, idx+4);
1336                                 if (!h_int && !l_int) {
1337                                         proto_tree_add_text(l2tp_avp_tree, tvb, idx, 8,
1338                                                             "Rx Connect Speed v3: indeterminable or no physical p2p link");
1339                                 }
1340                                 else {
1341                                         proto_tree_add_text(l2tp_avp_tree, tvb, idx, 8,
1342                                                             "Rx Connect Speed v3: %#x%04x",
1343                                                             h_int, l_int);
1344                                 }
1345                                 break;
1346                         }
1347                         default:
1348                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, avp_len,
1349                                                     "Unknown AVP");
1350                                 break;
1351                         }
1352
1353                         idx += avp_len;
1354                 }
1355
1356 }
1357
1358 /*
1359  * Processes Data Messages for v3 IP and UDP, starting from the  Session ID
1360  * (common to IP and UDP). Dissects the L2TPv3 Session header, the (optional)
1361  * L2-Specific sublayer and calls the appropriate dissector for the payload.
1362  */
1363 static void
1364 process_l2tpv3_data(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
1365                     proto_tree *l2tp_tree, proto_item *l2tp_item, int *pIdx)
1366 {
1367         int             idx = *pIdx;
1368         int             sid;
1369         guint8          oam_cell = 0;
1370         proto_tree      *l2_specific = NULL;
1371         proto_item      *ti = NULL;
1372         tvbuff_t        *next_tvb;
1373
1374         /* Get Session ID */
1375         sid = tvb_get_ntohl(tvb, idx);
1376         idx += 4;
1377
1378         if (check_col(pinfo->cinfo, COL_INFO)) {
1379                 col_add_fstr(pinfo->cinfo,COL_INFO,
1380                              "%s            (session id=%u)",
1381                              data_msg, sid);
1382         }
1383
1384         if (tree) {
1385                 proto_tree_add_item(l2tp_tree, hf_l2tp_sid, tvb, idx-4, 4, FALSE);
1386                 proto_item_set_len(l2tp_item, idx);
1387                 if (!(tvb_offset_exists(tvb, idx)))
1388                         return;
1389                 if (l2tpv3_cookie != 0)
1390                         proto_tree_add_item(l2tp_tree, hf_l2tp_cookie, tvb, idx, l2tpv3_cookie, FALSE);
1391         }
1392
1393         switch(l2tpv3_l2_specific){
1394         case L2TPv3_L2_SPECIFIC_DEFAULT:
1395                 if (tree) {
1396                         ti = proto_tree_add_item(tree, hf_l2tp_l2_spec_def,
1397                                         tvb, idx + l2tpv3_cookie, 4, FALSE);
1398                         l2_specific = proto_item_add_subtree(ti, ett_l2tp_l2_spec);
1399
1400                         proto_tree_add_item(l2_specific, hf_l2tp_l2_spec_s, tvb, idx + l2tpv3_cookie,
1401                                                 1, FALSE);
1402                         proto_tree_add_item(l2_specific, hf_l2tp_l2_spec_sequence, tvb,
1403                                                 idx + l2tpv3_cookie + 1, 3, FALSE);
1404                 }
1405                 next_tvb = tvb_new_subset_remaining(tvb, idx + l2tpv3_cookie + 4);
1406                 break;
1407         case L2TPv3_L2_SPECIFIC_DOCSIS_DMPT:
1408                 if (tree) {
1409                         ti = proto_tree_add_item(tree, hf_l2tp_l2_spec_docsis_dmpt,
1410                                                 tvb, idx + l2tpv3_cookie, 4, FALSE);
1411                         l2_specific = proto_item_add_subtree(ti, ett_l2tp_l2_spec);
1412
1413                         proto_tree_add_item(l2_specific, hf_l2tp_l2_spec_v, tvb,
1414                                                 idx + l2tpv3_cookie,1, FALSE);
1415
1416                         proto_tree_add_item(l2_specific, hf_l2tp_l2_spec_s, tvb,
1417                                                 idx + l2tpv3_cookie,1, FALSE);
1418
1419                         proto_tree_add_item(l2_specific, hf_l2tp_l2_spec_flow_id, tvb,
1420                                                 idx + l2tpv3_cookie,1, FALSE);
1421
1422                         proto_tree_add_item(l2_specific, hf_l2tp_l2_spec_sequence, tvb,
1423                                                 idx + l2tpv3_cookie + 2,2, FALSE);
1424                 }
1425                 next_tvb = tvb_new_subset_remaining(tvb, idx + l2tpv3_cookie + 4);
1426                 break;
1427         case L2TPv3_L2_SPECIFIC_ATM:
1428                 if (tree) {
1429                         ti = proto_tree_add_item(tree, hf_l2tp_l2_spec_atm,
1430                                         tvb, idx + l2tpv3_cookie, 4, FALSE);
1431                         l2_specific = proto_item_add_subtree(ti, ett_l2tp_l2_spec);
1432
1433                         proto_tree_add_item(l2_specific, hf_l2tp_l2_spec_s, tvb, idx + l2tpv3_cookie,
1434                                                 1, FALSE);
1435                         proto_tree_add_item(l2_specific, hf_l2tp_l2_spec_t, tvb, idx + l2tpv3_cookie,
1436                                                 1, FALSE);
1437                         /*
1438                          * As per RFC 4454, the T bit specifies whether
1439                          * we're transporting an OAM cell or an AAL5 frame.
1440                          */
1441                         oam_cell = tvb_get_guint8(tvb, idx + l2tpv3_cookie) & 0x08;
1442                         proto_tree_add_item(l2_specific, hf_l2tp_l2_spec_g, tvb, idx + l2tpv3_cookie,
1443                                                 1, FALSE);
1444                         proto_tree_add_item(l2_specific, hf_l2tp_l2_spec_c, tvb, idx + l2tpv3_cookie,
1445                                                 1, FALSE);
1446                         proto_tree_add_item(l2_specific, hf_l2tp_l2_spec_u, tvb, idx + l2tpv3_cookie,
1447                                                 1, FALSE);
1448                         proto_tree_add_item(l2_specific, hf_l2tp_l2_spec_sequence, tvb,
1449                                                 idx + l2tpv3_cookie + 1, 3, FALSE);
1450                 }
1451                 next_tvb = tvb_new_subset_remaining(tvb, idx + l2tpv3_cookie + 4);
1452                 break;
1453         case L2TPv3_L2_SPECIFIC_LAPD:
1454                 if (tree)
1455                         proto_tree_add_text(tree, tvb, idx + l2tpv3_cookie + 4, 3,"LAPD info");
1456                 next_tvb = tvb_new_subset_remaining(tvb, idx + l2tpv3_cookie+4+3);
1457                 break;
1458         case L2TPv3_L2_SPECIFIC_NONE:
1459         default:
1460                 next_tvb = tvb_new_subset_remaining(tvb, idx + l2tpv3_cookie);
1461                 break;
1462         }
1463
1464         switch(l2tpv3_protocol){
1465         case L2TPv3_PROTOCOL_ETH:
1466                 call_dissector(eth_withoutfcs_handle, next_tvb, pinfo, tree);
1467                 break;
1468         case L2TPv3_PROTOCOL_CHDLC:
1469                 call_dissector(chdlc_handle, next_tvb, pinfo, tree);
1470                 break;
1471         case L2TPv3_PROTOCOL_FR:
1472                 call_dissector(fr_handle, next_tvb, pinfo, tree);
1473                 break;
1474         case L2TPv3_PROTOCOL_PPP:
1475                 /*
1476                  * PPP is transported without Address and Control
1477                  * fields, ppp_hdlc_handle can handle that as if if
1478                  * was ACFC (NULL Address and Control)
1479                  */
1480                 call_dissector(ppp_hdlc_handle, next_tvb, pinfo, tree);
1481                 break;
1482         case L2TPv3_PROTOCOL_IP:
1483                 call_dissector(ip_handle, next_tvb, pinfo, tree);
1484                 break;
1485         case L2TPv3_PROTOCOL_MPLS:
1486                 call_dissector(mpls_handle, next_tvb, pinfo, tree);
1487                 break;
1488         case L2TPv3_PROTOCOL_DOCSIS_DMPT:
1489                 call_dissector(mp2t_handle, next_tvb, pinfo, tree);
1490                 break;
1491         case L2TPv3_PROTOCOL_AAL5:
1492                 if (oam_cell) {
1493                         call_dissector(atm_oam_handle, next_tvb, pinfo, tree);
1494                 } else {
1495                         call_dissector(llc_handle, next_tvb, pinfo, tree);
1496                 }
1497                 break;
1498         case L2TPv3_PROTOCOL_LAPD:
1499                 call_dissector(lapd_handle, next_tvb, pinfo, tree);
1500                 break;
1501         default:
1502                 call_dissector(data_handle, next_tvb, pinfo, tree);
1503                 break;
1504         }
1505 }
1506
1507 /*
1508  * Processes v3 data message over UDP, to then call process_l2tpv3_data
1509  * from the common part (Session ID)
1510  */
1511 static void
1512 process_l2tpv3_data_udp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
1513 {
1514         proto_tree *l2tp_tree = NULL, *ctrl_tree;
1515         proto_item *l2tp_item = NULL, *ti;
1516
1517         int idx = 0;
1518         int control;
1519         int sid;
1520
1521         control = tvb_get_ntohs(tvb, idx);
1522         idx += 2;                       /* skip ahead */
1523         idx += 2;                       /* Skip the reserved */
1524         sid = tvb_get_ntohl(tvb, idx);
1525
1526         if (tree) {
1527                 l2tp_item = proto_tree_add_item(tree, proto_l2tp, tvb, 0, -1, FALSE);
1528                 l2tp_tree = proto_item_add_subtree(l2tp_item, ett_l2tp);
1529                 proto_item_append_text(l2tp_item, " version 3");
1530
1531                 ti = proto_tree_add_text(l2tp_tree, tvb, 0, 2,
1532                                          "Packet Type: %s Session Id=%u",
1533                                          data_msg, sid);
1534
1535                 ctrl_tree = proto_item_add_subtree(ti, ett_l2tp_ctrl);
1536                 proto_tree_add_uint(ctrl_tree, hf_l2tp_type, tvb, 0, 2, control);
1537                 proto_tree_add_boolean(ctrl_tree, hf_l2tp_length_bit, tvb, 0, 2, control);
1538                 proto_tree_add_boolean(ctrl_tree, hf_l2tp_seq_bit, tvb, 0, 2, control);
1539                 proto_tree_add_uint(ctrl_tree, hf_l2tp_version, tvb, 0, 2, control);
1540                 /* Data in v3 over UDP has this reserved */
1541                 proto_tree_add_item(l2tp_tree, hf_l2tp_res, tvb, 2, 2, FALSE);
1542         }
1543
1544         /* Call process_l2tpv3_data from Session ID (offset in idx of 4) */
1545         process_l2tpv3_data(tvb, pinfo, tree, l2tp_tree, l2tp_item, &idx);
1546 }
1547
1548 /*
1549  * Processes v3 data message over IP, to then call process_l2tpv3_data
1550  * from the common part (Session ID)
1551  */
1552 static void
1553 process_l2tpv3_data_ip(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
1554 {
1555         proto_tree *l2tp_tree = NULL;
1556         proto_item *l2tp_item = NULL, *ti;
1557
1558         int idx = 0;
1559         int sid;
1560
1561         sid = tvb_get_ntohl(tvb, idx);
1562
1563         if (tree) {
1564                 l2tp_item = proto_tree_add_item(tree, proto_l2tp, tvb, 0, -1, FALSE);
1565                 l2tp_tree = proto_item_add_subtree(l2tp_item, ett_l2tp);
1566                 proto_item_append_text(l2tp_item, " version 3");
1567
1568                 ti = proto_tree_add_text(l2tp_tree, tvb, 0, 4,
1569                                          "Packet Type: %s Session Id=%u",
1570                                          data_msg, sid);
1571         }
1572
1573         /* Call process_l2tpv3_data from Session ID (offset in idx of 0) */
1574         process_l2tpv3_data(tvb, pinfo, tree, l2tp_tree, l2tp_item, &idx);
1575 }
1576
1577 /*
1578  * Processes v3 Control Message over IP, that carries NULL Session ID
1579  * to then call process_control_avps after dissecting the control.
1580  */
1581 static void
1582 process_l2tpv3_control(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int baseIdx)
1583 {
1584         proto_tree *l2tp_tree=NULL, *ctrl_tree;
1585         proto_item *l2tp_item = NULL, *ti;
1586
1587         int idx = baseIdx;
1588         int tmp_idx;
1589         guint16 length = 0;             /* Length field */
1590         guint32 ccid = 0;               /* Control Connection ID */
1591         guint16 avp_type;
1592         guint16 msg_type;
1593         guint16 control = 0;
1594
1595         control = tvb_get_ntohs(tvb, idx);
1596         idx += 2;                       /* skip ahead */
1597         if (LENGTH_BIT(control)) {      /* length field included ? */
1598                 length = tvb_get_ntohs(tvb, idx);
1599                 idx += 2;
1600         }
1601
1602         /* Get Control Channel ID */
1603         ccid = tvb_get_ntohl(tvb, idx);
1604         idx += 4;
1605
1606         if (check_col(pinfo->cinfo, COL_INFO)) {
1607                 tmp_idx = idx;
1608
1609                 if ((LENGTH_BIT(control))&&(length==12))                /* ZLB Message */
1610                         col_add_fstr(pinfo->cinfo, COL_INFO,
1611                                      "%s - ZLB      (tunnel id=%u)",
1612                                      control_msg , ccid);
1613                 else
1614                 {
1615                         if (SEQUENCE_BIT(control)) {
1616                                 tmp_idx += 4;
1617                         }
1618
1619                         tmp_idx+=4;
1620
1621                         avp_type = tvb_get_ntohs(tvb, tmp_idx);
1622                         tmp_idx += 2;
1623
1624                         if (avp_type == CONTROL_MESSAGE) {
1625                                 /* We print message type */
1626                                 msg_type = tvb_get_ntohs(tvb, tmp_idx);
1627                                 tmp_idx += 2;
1628                                 col_add_fstr(pinfo->cinfo, COL_INFO,
1629                                              "%s - %s (tunnel id=%u)",
1630                                              control_msg ,
1631                                              ((NUM_CONTROL_CALL_TYPES + 1 ) > msg_type) ?
1632                                              calltype_short_str[msg_type] : "Unknown",
1633                                              ccid);
1634                         }
1635                         else {
1636                                 /*
1637                                  * This is not a control message.
1638                                  * We never pass here except in case of bad l2tp packet!
1639                                  */
1640                                 col_add_fstr(pinfo->cinfo, COL_INFO,
1641                                              "%s (tunnel id=%u)",
1642                                              control_msg,  ccid);
1643                         }
1644                 }
1645         }
1646
1647         if (LENGTH_BIT(control)) {
1648                 /*
1649                  * Set the length of this tvbuff to be no longer than the length
1650                  * in the header.
1651                  *
1652                  * XXX - complain if that length is longer than the length of
1653                  * the tvbuff?  Have "set_actual_length()" return a Boolean
1654                  * and have its callers check the result?
1655                  */
1656                 set_actual_length(tvb, length+baseIdx);
1657         }
1658
1659         if (tree) {
1660                 l2tp_item = proto_tree_add_item(tree, proto_l2tp, tvb, 0, -1, FALSE);
1661                 l2tp_tree = proto_item_add_subtree(l2tp_item, ett_l2tp);
1662                 proto_item_append_text(l2tp_item, " version 3");
1663
1664                 if (baseIdx) {
1665                         proto_tree_add_item(l2tp_tree, hf_l2tp_sid, tvb, 0, 4, FALSE);
1666                 }
1667                 ti = proto_tree_add_text(l2tp_tree, tvb, baseIdx, 2,
1668                                                                  "Packet Type: %s Control Connection Id=%d",
1669                                                                  (CONTROL_BIT(control) ? control_msg : data_msg), ccid);
1670
1671                 ctrl_tree = proto_item_add_subtree(ti, ett_l2tp_ctrl);
1672                 proto_tree_add_uint(ctrl_tree, hf_l2tp_type, tvb, baseIdx, 2, control);
1673                 proto_tree_add_boolean(ctrl_tree, hf_l2tp_length_bit, tvb, baseIdx, 2, control);
1674                 proto_tree_add_boolean(ctrl_tree, hf_l2tp_seq_bit, tvb, baseIdx, 2, control);
1675                 proto_tree_add_uint(ctrl_tree, hf_l2tp_version, tvb, baseIdx, 2, control);
1676         }
1677         idx = baseIdx + 2;
1678         if (LENGTH_BIT(control)) {
1679                 if (tree) {
1680                         proto_tree_add_item(l2tp_tree, hf_l2tp_length, tvb, idx, 2, FALSE);
1681                 }
1682                 idx += 2;
1683         }
1684
1685         if (tree) {
1686                 proto_tree_add_item(l2tp_tree, hf_l2tp_ccid, tvb, idx, 4, FALSE);
1687         }
1688         idx += 4;
1689
1690         if (SEQUENCE_BIT(control)) {
1691                 if (tree) {
1692                         proto_tree_add_item(l2tp_tree, hf_l2tp_Ns, tvb, idx, 2, FALSE);
1693                 }
1694                 idx += 2;
1695                 if (tree) {
1696                         proto_tree_add_item(l2tp_tree, hf_l2tp_Nr, tvb, idx, 2, FALSE);
1697                 }
1698                 idx += 2;
1699         }
1700
1701         if (tree && (LENGTH_BIT(control))&&(length==12)) {
1702                 proto_tree_add_text(l2tp_tree, tvb, 0, 0, "Zero Length Bit message");
1703         }
1704
1705         if (!LENGTH_BIT(control)) {
1706                 return;
1707         }
1708
1709         process_control_avps(tvb, pinfo, l2tp_tree, idx, length+baseIdx);
1710 }
1711
1712 /*
1713  * Dissector for L2TP over UDP. For v2, calls process_control_avps for
1714  * control messages, or the ppp dissector based on the control bit.
1715  * For v3, calls either process_l2tpv3_control or process_l2tpv3_data_udp
1716  * based on the control bit.
1717  */
1718 static int
1719 dissect_l2tp_udp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
1720 {
1721         proto_tree *l2tp_tree=NULL, *ctrl_tree;
1722         proto_item *l2tp_item = NULL, *ti;
1723         int idx = 0;
1724         int tmp_idx;
1725         guint16 length = 0;             /* Length field */
1726         guint16 tid;                    /* Tunnel ID */
1727         guint16 cid;                    /* Call ID */
1728         guint16 offset_size;            /* Offset size */
1729         guint16 avp_type;
1730         guint16 msg_type;
1731         guint16 control;
1732         tvbuff_t        *next_tvb;
1733
1734         /*
1735          * Don't accept packets that aren't for an L2TP version we know,
1736          * as they might not be L2TP packets even though they happen
1737          * to be coming from or going to the L2TP port.
1738          */
1739         if (tvb_length(tvb) < 2)
1740                 return 0;       /* not enough information to check */
1741         control = tvb_get_ntohs(tvb, 0);
1742         switch (L2TP_VERSION(control)) {
1743
1744         case 2:
1745         case 3:
1746                 break;
1747
1748         default:
1749                 return 0;
1750         }
1751
1752         col_set_str(pinfo->cinfo, COL_PROTOCOL, "L2TP");
1753         col_clear(pinfo->cinfo, COL_INFO);
1754
1755         switch (L2TP_VERSION(control)) {
1756
1757         case 2:
1758                 break;
1759
1760         case 3:
1761                 col_set_str(pinfo->cinfo, COL_PROTOCOL, "L2TPv3");
1762                 if (CONTROL_BIT(control)) {
1763                         /* Call to process l2tp v3 control message */
1764                         process_l2tpv3_control(tvb, pinfo, tree, 0);
1765                 }
1766                 else {
1767                         /* Call to process l2tp v3 data message */
1768                         process_l2tpv3_data_udp(tvb, pinfo, tree);
1769                 }
1770                 return tvb_length(tvb);
1771         }
1772
1773         if (LENGTH_BIT(control)) {              /* length field included ? */
1774                 idx += 2;                       /* skip ahead */
1775                 length = tvb_get_ntohs(tvb, idx);
1776         }
1777
1778         /* collect the tunnel id & call id */
1779         idx += 2;
1780         tid = tvb_get_ntohs(tvb, idx);
1781         idx += 2;
1782         cid = tvb_get_ntohs(tvb, idx);
1783
1784         if (check_col(pinfo->cinfo, COL_INFO)) {
1785                 if (CONTROL_BIT(control)) {
1786                         /* CONTROL MESSAGE */
1787                         tmp_idx = idx;
1788
1789                         if ((LENGTH_BIT(control))&&(length==12))        /* ZLB Message */
1790                                 col_add_fstr(pinfo->cinfo, COL_INFO,
1791                                              "%s - ZLB      (tunnel id=%d, session id=%u)",
1792                                              control_msg, tid, cid);
1793                         else
1794                         {
1795                                 if (SEQUENCE_BIT(control)) {
1796                                         tmp_idx += 4;
1797                                 }
1798
1799                                 tmp_idx+=4;
1800
1801                                 avp_type = tvb_get_ntohs(tvb, (tmp_idx+=2));
1802
1803                                 if (avp_type == CONTROL_MESSAGE) {
1804                                         /* We print message type */
1805                                         msg_type = tvb_get_ntohs(tvb, (tmp_idx+=2));
1806                                         col_add_fstr(pinfo->cinfo, COL_INFO,
1807                                                      "%s - %s (tunnel id=%u, session id=%u)",
1808                                                      control_msg,
1809                                                      ((NUM_CONTROL_CALL_TYPES + 1 ) > msg_type) ?
1810                                                      calltype_short_str[msg_type] : "Unknown",
1811                                                      tid, cid);
1812                                 }
1813                                 else
1814                                 {
1815                                         /*
1816                                          * This is not a control message.
1817                                          * We never pass here except in case of bad l2tp packet!
1818                                          */
1819                                         col_add_fstr(pinfo->cinfo, COL_INFO,
1820                                                      "%s (tunnel id=%u, session id=%u)",
1821                                                      control_msg, tid, cid);
1822
1823                                 }
1824                         }
1825                 }
1826                 else {
1827                         /* DATA Message */
1828                         col_add_fstr(pinfo->cinfo, COL_INFO,
1829                                      "%s            (tunnel id=%u, session id=%u)",
1830                                      data_msg, tid, cid);
1831                 }
1832         }
1833
1834         if (LENGTH_BIT(control)) {
1835                 /*
1836                  * Set the length of this tvbuff to be no longer than the length
1837                  * in the header.
1838                  *
1839                  * XXX - complain if that length is longer than the length of
1840                  * the tvbuff?  Have "set_actual_length()" return a Boolean
1841                  * and have its callers check the result?
1842                  */
1843                 set_actual_length(tvb, length);
1844         }
1845
1846         if (tree) {
1847                 l2tp_item = proto_tree_add_item(tree,proto_l2tp, tvb, 0, -1, FALSE);
1848                 l2tp_tree = proto_item_add_subtree(l2tp_item, ett_l2tp);
1849
1850                 ti = proto_tree_add_text(l2tp_tree, tvb, 0, 2,
1851                                          "Packet Type: %s Tunnel Id=%d Session Id=%d",
1852                                          (CONTROL_BIT(control) ? control_msg : data_msg), tid, cid);
1853
1854                 ctrl_tree = proto_item_add_subtree(ti, ett_l2tp_ctrl);
1855                 proto_tree_add_uint(ctrl_tree, hf_l2tp_type, tvb, 0, 2, control);
1856                 proto_tree_add_boolean(ctrl_tree, hf_l2tp_length_bit, tvb, 0, 2, control);
1857                 proto_tree_add_boolean(ctrl_tree, hf_l2tp_seq_bit, tvb, 0, 2, control);
1858                 proto_tree_add_boolean(ctrl_tree, hf_l2tp_offset_bit, tvb, 0, 2, control);
1859                 proto_tree_add_boolean(ctrl_tree, hf_l2tp_priority, tvb, 0, 2, control);
1860                 proto_tree_add_uint(ctrl_tree, hf_l2tp_version, tvb, 0, 2, control);
1861         }
1862         idx = 2;
1863         if (LENGTH_BIT(control)) {
1864                 if (tree) {
1865                         proto_tree_add_item(l2tp_tree, hf_l2tp_length, tvb, idx, 2, FALSE);
1866                 }
1867                 idx += 2;
1868         }
1869
1870         if (tree) {
1871                 proto_tree_add_item(l2tp_tree, hf_l2tp_tunnel, tvb, idx, 2, FALSE);
1872         }
1873         idx += 2;
1874         if (tree) {
1875                 proto_tree_add_item(l2tp_tree, hf_l2tp_session, tvb, idx, 2, FALSE);
1876         }
1877         idx += 2;
1878
1879         if (SEQUENCE_BIT(control)) {
1880                 if (tree) {
1881                         proto_tree_add_item(l2tp_tree, hf_l2tp_Ns, tvb, idx, 2, FALSE);
1882                 }
1883                 idx += 2;
1884                 if (tree) {
1885                         proto_tree_add_item(l2tp_tree, hf_l2tp_Nr, tvb, idx, 2, FALSE);
1886                 }
1887                 idx += 2;
1888         }
1889         if (OFFSET_BIT(control)) {
1890                 offset_size = tvb_get_ntohs(tvb, idx);
1891                 if (tree) {
1892                         proto_tree_add_uint(l2tp_tree, hf_l2tp_offset, tvb, idx, 2,
1893                                                                 offset_size);
1894                 }
1895                 idx += 2;
1896                 if (offset_size != 0) {
1897                         if (tree) {
1898                                 proto_tree_add_text(l2tp_tree, tvb, idx, offset_size, "Offset Padding");
1899                         }
1900                         idx += offset_size;
1901                 }
1902         }
1903
1904         if (tree && (LENGTH_BIT(control))&&(length==12)) {
1905                 proto_tree_add_text(l2tp_tree, tvb, 0, 0, "Zero Length Bit message");
1906         }
1907
1908         if (!CONTROL_BIT(control)) {  /* Data Messages so we are done */
1909                 if (tree)
1910                         proto_item_set_len(l2tp_item, idx);
1911                 /* If we have data, signified by having a length bit, dissect it */
1912                 if (tvb_offset_exists(tvb, idx)) {
1913                         next_tvb = tvb_new_subset_remaining(tvb, idx);
1914                         call_dissector(ppp_hdlc_handle, next_tvb, pinfo, tree);
1915                 }
1916                 return tvb_length(tvb);
1917         }
1918
1919         if (LENGTH_BIT(control))
1920                 process_control_avps(tvb, pinfo, l2tp_tree, idx, length);
1921
1922         return tvb_length(tvb);
1923 }
1924
1925
1926 /*
1927  * Only L2TPv3 runs directly over IP, and dissect_l2tp_ip starts dissecting
1928  * those packets to call either process_l2tpv3_control for Control Messages
1929  * or process_l2tpv3_data_ip for Data Messages over IP, based on the
1930  * Session ID
1931  */
1932 static void
1933 dissect_l2tp_ip(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
1934 {
1935         int idx = 0;
1936         guint32 sid;                    /* Session ID */
1937
1938         /* Only L2TPv3 runs directly over IP */
1939         col_set_str(pinfo->cinfo, COL_PROTOCOL, "L2TPv3");
1940
1941         col_clear(pinfo->cinfo, COL_INFO);
1942
1943         sid = tvb_get_ntohl(tvb, idx);
1944         if (sid == 0) {
1945                 /* This is control message */
1946                 /* Call to process l2tp v3 control message */
1947                 process_l2tpv3_control(tvb, pinfo, tree, 4);
1948         }
1949         else {
1950                 /* Call to process l2tp v3 data message */
1951                 process_l2tpv3_data_ip(tvb, pinfo, tree);
1952         }
1953
1954         return;
1955 }
1956
1957 /* registration with the filtering engine */
1958 void
1959 proto_register_l2tp(void)
1960 {
1961         static hf_register_info hf[] = {
1962                 { &hf_l2tp_type,
1963                 { "Type", "l2tp.type", FT_UINT16, BASE_DEC, VALS(l2tp_type_vals), 0x8000,
1964                         "Type bit", HFILL }},
1965
1966                 { &hf_l2tp_length_bit,
1967                 { "Length Bit", "l2tp.length_bit", FT_BOOLEAN, 16, TFS(&l2tp_length_bit_truth), 0x4000,
1968                         NULL, HFILL }},
1969
1970                 { &hf_l2tp_seq_bit,
1971                 { "Sequence Bit", "l2tp.seq_bit", FT_BOOLEAN, 16, TFS(&l2tp_seq_bit_truth), 0x0800,
1972                         NULL, HFILL }},
1973
1974                 { &hf_l2tp_offset_bit,
1975                 { "Offset bit", "l2tp.offset_bit", FT_BOOLEAN, 16, TFS(&l2tp_offset_bit_truth), 0x0200,
1976                         NULL, HFILL }},
1977
1978                 { &hf_l2tp_priority,
1979                 { "Priority", "l2tp.priority", FT_BOOLEAN, 16, TFS(&l2tp_priority_truth), 0x0100,
1980                         "Priority bit", HFILL }},
1981
1982                 { &hf_l2tp_version,
1983                 { "Version", "l2tp.version", FT_UINT16, BASE_DEC, NULL, 0x000f,
1984                         NULL, HFILL }},
1985
1986                 { &hf_l2tp_length,
1987                 { "Length","l2tp.length", FT_UINT16, BASE_DEC, NULL, 0x0,
1988                         NULL, HFILL }},
1989
1990                 { &hf_l2tp_tunnel,
1991                 { "Tunnel ID","l2tp.tunnel", FT_UINT16, BASE_DEC, NULL, 0x0, /* Probably should be FT_BYTES */
1992                         NULL, HFILL }},
1993
1994                 { &hf_l2tp_session,
1995                 { "Session ID","l2tp.session", FT_UINT16, BASE_DEC, NULL, 0x0, /* Probably should be FT_BYTES */
1996                         NULL, HFILL }},
1997
1998                 { &hf_l2tp_Ns,
1999                 { "Ns","l2tp.Ns", FT_UINT16, BASE_DEC, NULL, 0x0,
2000                         NULL, HFILL }},
2001
2002                 { &hf_l2tp_Nr,
2003                 { "Nr","l2tp.Nr", FT_UINT16, BASE_DEC, NULL, 0x0,
2004                         NULL, HFILL }},
2005
2006                 { &hf_l2tp_offset,
2007                 { "Offset","l2tp.offset", FT_UINT16, BASE_DEC, NULL, 0x0,
2008                         "Number of octest past the L2TP header at which thepayload data starts.", HFILL }},
2009
2010                 { &hf_l2tp_avp_mandatory,
2011                 { "Mandatory", "l2tp.avp.mandatory", FT_BOOLEAN, BASE_NONE, NULL, 0x0,
2012                         "Mandatory AVP", HFILL }},
2013
2014                 { &hf_l2tp_avp_hidden,
2015                 { "Hidden", "l2tp.avp.hidden", FT_BOOLEAN, BASE_NONE, NULL, 0x0,
2016                         "Hidden AVP", HFILL }},
2017
2018                 { &hf_l2tp_avp_length,
2019                 { "Length", "l2tp.avp.length", FT_UINT16, BASE_DEC, NULL, 0,
2020                         "AVP Length", HFILL }},
2021
2022                 { &hf_l2tp_avp_vendor_id,
2023                 { "Vendor ID", "l2tp.avp.vendor_id", FT_UINT16, BASE_DEC|BASE_EXT_STRING, &sminmpec_values_ext, 0,
2024                         "AVP Vendor ID", HFILL }},
2025
2026                 { &hf_l2tp_avp_type,
2027                 { "Type", "l2tp.avp.type", FT_UINT16, BASE_DEC, VALS(avp_type_vals), 0,
2028                         "AVP Type", HFILL }},
2029
2030                 { &hf_l2tp_tie_breaker,
2031                 { "Tie Breaker", "l2tp.tie_breaker", FT_UINT64, BASE_HEX, NULL, 0,
2032                         NULL, HFILL }},
2033
2034                 { &hf_l2tp_sid,
2035                 { "Session ID","l2tp.sid", FT_UINT32, BASE_DEC, NULL, 0x0,
2036                         NULL, HFILL }},
2037
2038                 { &hf_l2tp_ccid,
2039                 { "Control Connection ID","l2tp.ccid", FT_UINT32, BASE_DEC, NULL, 0x0,
2040                         NULL, HFILL }},
2041
2042                 { &hf_l2tp_res,
2043                 { "Reserved","l2tp.res", FT_UINT16, BASE_HEX, NULL, 0x0,
2044                         NULL, HFILL }},
2045
2046                 { &hf_l2tp_cookie,
2047                 { "Cookie","lt2p.cookie", FT_BYTES, BASE_NONE, NULL, 0x0,
2048                         NULL, HFILL }},
2049
2050                 { &hf_l2tp_l2_spec_def,
2051                 { "Default L2-Specific Sublayer","lt2p.l2_spec_def", FT_NONE, BASE_NONE, NULL, 0x0,
2052                         NULL, HFILL }},
2053
2054                 { &hf_l2tp_l2_spec_atm,
2055                 { "ATM-Specific Sublayer","lt2p.l2_spec_atm", FT_NONE, BASE_NONE, NULL, 0x0,
2056                         NULL, HFILL }},
2057
2058                 { &hf_l2tp_l2_spec_docsis_dmpt,
2059                 { "DOCSIS DMPT - Specific Sublayer","lt2p.l2_spec_docsis_dmpt", FT_NONE, BASE_NONE, NULL, 0x0,
2060                         NULL, HFILL }},
2061
2062                 { &hf_l2tp_l2_spec_v,
2063                 { "V-bit","lt2p.l2_spec_v", FT_BOOLEAN, 8, NULL, 0x80,
2064                         "VCCV Bit", HFILL }},
2065
2066                 { &hf_l2tp_l2_spec_s,
2067                 { "S-bit","lt2p.l2_spec_s", FT_BOOLEAN, 8, NULL, 0x40,
2068                         "Sequence Bit", HFILL }},
2069
2070                 { &hf_l2tp_l2_spec_t,
2071                 { "T-bit","lt2p.l2_spec_t", FT_BOOLEAN, 8, NULL, 0x08,
2072                         "Transport Type Bit", HFILL }},
2073
2074                 { &hf_l2tp_l2_spec_g,
2075                 { "G-bit","lt2p.l2_spec_g", FT_BOOLEAN, 8, NULL, 0x04,
2076                         "EFCI Bit", HFILL }},
2077
2078                 { &hf_l2tp_l2_spec_c,
2079                 { "C-bit","lt2p.l2_spec_c", FT_BOOLEAN, 8, NULL, 0x02,
2080                         "CLP Bit", HFILL }},
2081
2082                 { &hf_l2tp_l2_spec_u,
2083                 { "U-bit","lt2p.l2_spec_u", FT_BOOLEAN, 8, NULL, 0x01,
2084                         "C/R Bit", HFILL }},
2085
2086                 { &hf_l2tp_l2_spec_flow_id,
2087                 { "Flow ID","lt2p.l2_spec_flow_id", FT_UINT8, BASE_HEX, NULL, FLOW_ID_MASK,
2088                         NULL, HFILL }},
2089
2090                 { &hf_l2tp_l2_spec_sequence,
2091                 { "Sequence Number","lt2p.l2_spec_sequence", FT_UINT24, BASE_DEC, NULL, 0x0,
2092                         NULL, HFILL }},
2093
2094                 { &hf_l2tp_cisco_avp_type,
2095                 { "Type", "l2tp.avp.ciscotype", FT_UINT16, BASE_DEC, VALS(cisco_avp_type_vals), 0,
2096                         "AVP Type", HFILL }},
2097
2098         };
2099
2100         static gint *ett[] = {
2101                 &ett_l2tp,
2102                 &ett_l2tp_ctrl,
2103                 &ett_l2tp_avp,
2104                 &ett_l2tp_avp_sub,
2105                 &ett_l2tp_l2_spec,
2106                 &ett_l2tp_lcp,
2107         };
2108
2109         module_t *l2tp_module;
2110
2111         proto_l2tp = proto_register_protocol(
2112                 "Layer 2 Tunneling Protocol", "L2TP", "l2tp");
2113         proto_register_field_array(proto_l2tp, hf, array_length(hf));
2114         proto_register_subtree_array(ett, array_length(ett));
2115
2116         l2tp_module = prefs_register_protocol(proto_l2tp, NULL);
2117
2118         prefs_register_enum_preference(l2tp_module,
2119                                         "cookie_size",
2120                                         "L2TPv3 Cookie Size",
2121                                         "L2TPv3 Cookie Size",
2122                                         &l2tpv3_cookie,
2123                                         l2tpv3_cookies,
2124                                         FALSE);
2125
2126         prefs_register_enum_preference(l2tp_module,
2127                                         "l2_specific",
2128                                         "L2TPv3 L2-Specific Sublayer",
2129                                         "L2TPv3 L2-Specific Sublayer",
2130                                         &l2tpv3_l2_specific,
2131                                         l2tpv3_l2_specifics,
2132                                         FALSE);
2133
2134         prefs_register_enum_preference(l2tp_module,
2135                                         "protocol",
2136                                         "Decode L2TPv3 packet contents as this protocol",
2137                                         "Decode L2TPv3 packet contents as this protocol",
2138                                         &l2tpv3_protocol,
2139                                         l2tpv3_protocols,
2140                                         FALSE);
2141
2142 }
2143
2144 void
2145 proto_reg_handoff_l2tp(void)
2146 {
2147         dissector_handle_t l2tp_udp_handle;
2148         dissector_handle_t l2tp_ip_handle;
2149
2150         l2tp_udp_handle = new_create_dissector_handle(dissect_l2tp_udp, proto_l2tp);
2151         dissector_add_uint("udp.port", UDP_PORT_L2TP, l2tp_udp_handle);
2152
2153         l2tp_ip_handle = create_dissector_handle(dissect_l2tp_ip, proto_l2tp);
2154         dissector_add_uint("ip.proto", IP_PROTO_L2TP, l2tp_ip_handle);
2155
2156         /*
2157          * Get a handle for the PPP-in-HDLC-like-framing dissector.
2158          */
2159         ppp_hdlc_handle = find_dissector("ppp_hdlc");
2160         ppp_lcp_options_handle = find_dissector("ppp_lcp_options");
2161
2162         /*
2163          * Get a handle for the dissectors used in v3.
2164          */
2165         eth_withoutfcs_handle = find_dissector("eth_withoutfcs");
2166         chdlc_handle = find_dissector("chdlc");
2167         fr_handle = find_dissector("fr");
2168         ip_handle = find_dissector("ip");
2169         mpls_handle = find_dissector("mpls");
2170         atm_oam_handle = find_dissector("atm_oam_cell");
2171         llc_handle = find_dissector("llc");
2172         lapd_handle = find_dissector("lapd");
2173         mp2t_handle = find_dissector("mp2t");
2174         data_handle = find_dissector("data");
2175 }