epan/dissectors/packet-l2tp.c

   1 /* packet-l2tp.c
   2  * Routines for Layer Two Tunnelling Protocol (L2TP) packet disassembly
   3  * John Thomes <john@ensemblecom.com>
   4  *
   5  * Minor changes by: (2000-01-10)
   6  * Laurent Cazalet <laurent.cazalet@mailclub.net>
   7  * Thomas Parvais <thomas.parvais@advalvas.be>
   8  *
   9  * $Id$
  10  *
  11  * Wireshark - Network traffic analyzer
  12  * By Gerald Combs <gerald@wireshark.org>
  13  * Copyright 1998 Gerald Combs
  14  *
  15  * This program is free software; you can redistribute it and/or
  16  * modify it under the terms of the GNU General Public License
  17  * as published by the Free Software Foundation; either version 2
  18  * of the License, or (at your option) any later version.
  19  *
  20  * This program is distributed in the hope that it will be useful,
  21  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  22  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  23  * GNU General Public License for more details.
  24  *
  25  * You should have received a copy of the GNU General Public License
  26  * along with this program; if not, write to the Free Software
  27  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  28  */
  29
  30 /*
  31  * RFC 2661 for L2TPv2
  32  * http://tools.ietf.org/html/rfc2661
  33  *
  34  * RFC 3931 for L2TPv3
  35  * http://tools.ietf.org/html/rfc3931
  36  *
  37  * Layer Two Tunneling Protocol "L2TP" number assignments:
  38  *      http://www.iana.org/assignments/l2tp-parameters
  39  *
  40  * Pseudowire types:
  41  *
  42  * RFC 4591 for Frame Relay
  43  * http://tools.ietf.org/html/rfc4591
  44  *
  45  * RFC 4454 for ATM
  46  * http://tools.ietf.org/html/rfc4454
  47  *
  48  * RFC 4719 for Ethernet
  49  * http://tools.ietf.org/html/rfc4719
  50  *
  51  * RFC 4349 for HDLC
  52  * http://tools.ietf.org/html/rfc4349
  53  *
  54  * XXX - what about LAPD?
  55  */
  56
  57 static int proto_l2tp = -1;
  58 static int hf_l2tp_type = -1;
  59 static int hf_l2tp_length_bit = -1;
  60 static int hf_l2tp_seq_bit = -1;
  61 static int hf_l2tp_offset_bit = -1;
  62 static int hf_l2tp_priority = -1;
  63 static int hf_l2tp_version = -1;
  64 static int hf_l2tp_length = -1;
  65 static int hf_l2tp_tunnel = -1;
  66 static int hf_l2tp_session = -1;
  67 static int hf_l2tp_Ns = -1;
  68 static int hf_l2tp_Nr = -1;
  69 static int hf_l2tp_offset = -1;
  70 static int hf_l2tp_avp_mandatory = -1;
  71 static int hf_l2tp_avp_hidden = -1;
  72 static int hf_l2tp_avp_length = -1;
  73 static int hf_l2tp_avp_vendor_id = -1;
  74 static int hf_l2tp_avp_type = -1;
  75 static int hf_l2tp_tie_breaker = -1;
  76 static int hf_l2tp_sid = -1;
  77 static int hf_l2tp_res = -1;
  78 static int hf_l2tp_ccid = -1;
  79 static int hf_l2tp_cookie = -1;
  80 static int hf_l2tp_l2_spec_def = -1;
  81 static int hf_l2tp_l2_spec_atm = -1;
  82 static int hf_l2tp_l2_spec_docsis_dmpt = -1;
  83 static int hf_l2tp_l2_spec_v = -1;
  84 static int hf_l2tp_l2_spec_s = -1;
  85 static int hf_l2tp_l2_spec_flow_id = -1;
  86 static int hf_l2tp_l2_spec_sequence = -1;
  87 static int hf_l2tp_l2_spec_t = -1;
  88 static int hf_l2tp_l2_spec_g = -1;
  89 static int hf_l2tp_l2_spec_c = -1;
  90 static int hf_l2tp_l2_spec_u = -1;
  91 static int hf_l2tp_cisco_avp_type = -1;
  92
  93 #ifdef HAVE_CONFIG_H
  94 #include "config.h"
  95 #endif
  96
  97 #include <stdlib.h>
  98 #include <ctype.h>
  99 #include <glib.h>
 100 #include <epan/packet.h>
 101 #include <epan/addr_resolv.h>
 102 #include <epan/ipproto.h>
 103 #include <epan/sminmpec.h>
 104 #include <epan/prefs.h>
 105
 106 #define UDP_PORT_L2TP   1701
 107
 108 #define CONTROL_BIT(msg_info) (msg_info & 0x8000)   /* Type bit control = 1 data = 0 */
 109 #define LENGTH_BIT(msg_info) (msg_info & 0x4000)    /* Length bit = 1  */
 110 #define RESERVE_BITS(msg_info) (msg_info &0x37F8)   /* Reserved bit - usused */
 111 #define SEQUENCE_BIT(msg_info) (msg_info & 0x0800)  /* SEQUENCE bit = 1 Ns and Nr fields */
 112 #define OFFSET_BIT(msg_info) (msg_info & 0x0200)    /* Offset */
 113 #define PRIORITY_BIT(msg_info) (msg_info & 0x0100)  /* Priority */
 114 #define L2TP_VERSION(msg_info) (msg_info & 0x000f)  /* Version of l2tp */
 115 #define MANDATORY_BIT(msg_info) (msg_info & 0x8000) /* Mandatory = 1 */
 116 #define HIDDEN_BIT(msg_info) (msg_info & 0x4000)    /* Hidden = 1 */
 117 #define AVP_LENGTH(msg_info) (msg_info & 0x03ff)    /* AVP Length */
 118 #define FRAMING_SYNC(msg_info)  (msg_info & 0x0001) /* SYNC Framing Type */
 119 #define FRAMING_ASYNC(msg_info) (msg_info & 0x0002) /* ASYNC Framing Type */
 120 #define BEARER_DIGITAL(msg_info) (msg_info & 0x0001) /* Digital Bearer Type */
 121 #define BEARER_ANALOG(msg_info) (msg_info & 0x0002) /* Analog Bearer Type */
 122 #define CIRCUIT_STATUS_BIT(msg_info) (msg_info & 0x0001)        /* Circuit Status */
 123 #define CIRCUIT_TYPE_BIT(msg_info) (msg_info & 0x0001)          /* Circuit Condition */
 124
 125 /* DOCSIS DMPT Sub-Layer Header definitions */
 126 #define FLOW_ID_MASK  0x0E
 127
 128 static gint ett_l2tp = -1;
 129 static gint ett_l2tp_ctrl = -1;
 130 static gint ett_l2tp_avp = -1;
 131 static gint ett_l2tp_avp_sub = -1;
 132 static gint ett_l2tp_lcp = -1;
 133 static gint ett_l2tp_l2_spec = -1;
 134
 135 static enum_val_t l2tpv3_cookies[] = {
 136     {"cookie0", "None",                 0},
 137     {"cookie4", "4 Byte Cookie",        4},
 138     {"cookie8", "8 Byte Cookie",        8},
 139     {NULL, NULL, 0}
 140 };
 141
 142 #define L2TPv3_PROTOCOL_ETH     0
 143 #define L2TPv3_PROTOCOL_CHDLC   1
 144 #define L2TPv3_PROTOCOL_FR      2
 145 #define L2TPv3_PROTOCOL_PPP     3
 146 #define L2TPv3_PROTOCOL_IP      4
 147 #define L2TPv3_PROTOCOL_MPLS    5
 148 #define L2TPv3_PROTOCOL_AAL5    6
 149 #define L2TPv3_PROTOCOL_LAPD    7
 150 #define L2TPv3_PROTOCOL_DOCSIS_DMPT 8
 151
 152 static enum_val_t l2tpv3_protocols[] = {
 153     {"eth",     "Ethernet",     L2TPv3_PROTOCOL_ETH},
 154     {"chdlc",   "Cisco HDLC",   L2TPv3_PROTOCOL_CHDLC},
 155     {"fr",      "Frame Relay",  L2TPv3_PROTOCOL_FR},
 156     {"ppp",     "PPP",          L2TPv3_PROTOCOL_PPP},
 157     {"ip",      "IP",           L2TPv3_PROTOCOL_IP},
 158     {"mpls",    "MPLS",         L2TPv3_PROTOCOL_MPLS},
 159     {"aal5",    "AAL5",         L2TPv3_PROTOCOL_AAL5},
 160     {"lapd",    "LAPD",         L2TPv3_PROTOCOL_LAPD},
 161     {"docsis-dmpt", "DOCSIS-DMPT", L2TPv3_PROTOCOL_DOCSIS_DMPT},
 162     {NULL, NULL, 0}
 163 };
 164
 165 #define L2TPv3_L2_SPECIFIC_NONE         0
 166 #define L2TPv3_L2_SPECIFIC_DEFAULT      1
 167 #define L2TPv3_L2_SPECIFIC_ATM          2
 168 #define L2TPv3_L2_SPECIFIC_LAPD         3
 169 #define L2TPv3_L2_SPECIFIC_DOCSIS_DMPT  4
 170
 171 static enum_val_t l2tpv3_l2_specifics[] = {
 172     {"none",    "None",                 L2TPv3_L2_SPECIFIC_NONE},
 173     {"default", "Default L2-Specific",  L2TPv3_L2_SPECIFIC_DEFAULT},
 174     {"atm",     "ATM-Specific",         L2TPv3_L2_SPECIFIC_ATM},
 175     {"lapd",    "LAPD-Specific",        L2TPv3_L2_SPECIFIC_LAPD},
 176     {"dmpt",    "DOCSIS DMPT-Specific", L2TPv3_L2_SPECIFIC_DOCSIS_DMPT},
 177     {NULL, NULL, 0}
 178 };
 179
 180 static gint l2tpv3_cookie = 4;
 181 static gint l2tpv3_protocol = L2TPv3_PROTOCOL_CHDLC;
 182 static gint l2tpv3_l2_specific = L2TPv3_L2_SPECIFIC_DEFAULT;
 183
 184 #define AVP_SCCRQ      1
 185 #define AVP_SCCRP      2
 186 #define AVP_SCCCN      3
 187 #define AVP_StopCCN    4
 188 #define AVP_Reserved   5
 189 #define AVP_HELLO      6
 190 #define AVP_OCRQ       7
 191 #define AVP_OCRP       8
 192 #define AVP_ORCRP      9
 193 #define AVP_ICRQ      10
 194 #define AVP_ICRP      11
 195 #define AVP_ICCN      12
 196 #define AVP_Reserved1 13
 197 #define AVP_CDN       14
 198
 199 #define NUM_CONTROL_CALL_TYPES  27
 200 static const char *calltypestr[NUM_CONTROL_CALL_TYPES+1] = {
 201   "Unknown Call Type",
 202   "Start_Control_Request",
 203   "Start_Control_Reply",
 204   "Start_Control_Connected",
 205   "Stop_Control_Notification",
 206   "Reserved",                                                   /* 5*/
 207   "Hello",
 208   "Outgoing_Call_Request",
 209   "Outgoing_Call_Reply",
 210   "Outgoing_Call_Connected",
 211   "Incoming_Call_Request",                              /* 10 */
 212   "Incoming_Call_Reply",
 213   "Incoming_Call_Connected",
 214   "Reserved",                                                   /* 13 */
 215   "Call_Disconnect_Notification",
 216   "WAN_Error_Notify",                                   /* 15 */
 217   "Set_Link_Info",
 218   "Modem_Status",
 219   "Service_Relay_Request_Msg",
 220   "Service_Relay_Reply_Message",
 221   "Explicit_Acknowledgement",                   /* 20 */
 222   "Failover_Session_Query_Message",             /* 21 [RFC4951] */
 223   "Failover_Session_Response_Message",  /* 22 [RFC4951] */
 224   /* Multicast Management */
 225   "Multicast-Session-Request",                  /* 23 [RFC4045]*/
 226   "Multicast-Session-Response ",                /* 24 [RFC4045]*/
 227   "Multicast-Session-Establishment",    /* 25 [RFC4045]*/
 228   "Multicast-Session-Information",              /* 26 [RFC4045]*/
 229   "Multicast-Session-End-Notify",               /* 27 [RFC4045]*/
 230
 231 };
 232
 233 static const char *calltype_short_str[NUM_CONTROL_CALL_TYPES+1] = {
 234   "Unknown ",
 235   "SCCRQ   ",
 236   "SCCRP   ",
 237   "SCCCN   ",
 238   "StopCCN ",
 239   "Reserved", /* 5 */
 240   "Hello   ",
 241   "OCRQ    ",
 242   "OCRP    ",
 243   "OCCN    ",
 244   "ICRQ    ", /* 10 */
 245   "ICRP    ",
 246   "ICCN    ",
 247   "Reserved",
 248   "CDN     ",
 249   "WEN     ", /* 15 */
 250   "SLI     ",
 251   "MDMST   ",
 252   "SRRQ    ",
 253   "SRRP    ",
 254   "ACK     ", /* 20 */
 255   "FSQ     ",
 256   "FSR     ",
 257   "MSRQ    ",
 258   "MSRP    ",
 259   "MSE     ", /* 25 */
 260   "MSI     ",
 261   "MSEN    ",
 262
 263 };
 264
 265
 266 static const char *control_msg  = "Control Message";
 267 static const char *data_msg     = "Data    Message";
 268 static const value_string l2tp_type_vals[] = {
 269         { 0, "Data Message" },
 270         { 1, "Control Message" },
 271         { 0, NULL },
 272 };
 273
 274 static const value_string cause_code_direction_vals[] = {
 275         { 0, "global error" },
 276         { 1, "at peer" },
 277         { 2, "at local" },
 278         { 0, NULL },
 279 };
 280
 281 static const true_false_string l2tp_length_bit_truth =
 282         { "Length field is present", "Length field is not present" };
 283
 284 static const true_false_string l2tp_seq_bit_truth =
 285         { "Ns and Nr fields are present", "Ns and Nr fields are not present" };
 286
 287 static const true_false_string l2tp_offset_bit_truth =
 288         { "Offset Size field is present", "Offset size field is not present" };
 289
 290 static const true_false_string l2tp_priority_truth =
 291         { "This data message has priority", "No priority" };
 292
 293 static const value_string authen_type_vals[] = {
 294   { 0, "Reserved" },
 295   { 1, "Textual username/password exchange" },
 296   { 2, "PPP CHAP" },
 297   { 3, "PPP PAP" },
 298   { 4, "No Authentication" },
 299   { 5, "Microsoft CHAP Version 1" },
 300   { 6, "Reserved" },
 301   { 7, "EAP" },
 302   { 0, NULL }
 303 };
 304
 305 static const value_string data_sequencing_vals[] = {
 306   { 0, "No incoming data packets require sequencing" },
 307   { 1, "Only non-IP data packets require sequencing" },
 308   { 2, "All incoming data packets require sequencing" },
 309   { 0, NULL }
 310 };
 311
 312 static const value_string l2_sublayer_vals[] = {
 313   { 0, "No L2-Specific Sublayer" },
 314   { 1, "Default L2-Specific Sublayer present" },
 315   { 2, "ATM-Specific Sublayer present" },
 316   { 3, "MPT-Specific Sublayer" },
 317   { 4, "PSP-Specific Sublayer" },
 318   { 0, NULL }
 319 };
 320
 321 static const value_string result_code_stopccn_vals[] = {
 322   { 0, "Reserved", },
 323   { 1, "General request to clear control connection", },
 324   { 2, "General error, Error Code indicates the problem", },
 325   { 3, "Control connection already exists", },
 326   { 4, "Requester is not authorized to establish a control connection", },
 327   { 5, "The protocol version of the requester is not supported", },
 328   { 6, "Requester is being shut down", },
 329   { 7, "Finite state machine error or timeout", },
 330   { 8, "Control connection due to mismatching CCDS value", }, /* [RFC3308] */
 331   { 0, NULL }
 332 };
 333
 334 static const value_string result_code_cdn_vals[] = {
 335   { 0, "Reserved", },
 336   { 1, "Session disconnected due to loss of carrier or circuit disconnect", },
 337   { 2, "Session disconnected for the reason indicated in Error Code", },
 338   { 3, "Session disconnected for administrative reasons", },
 339   { 4, "Appropriate facilities unavailable (temporary condition)", },
 340   { 5, "Appropriate facilities unavailable (permanent condition)", },
 341   { 6, "Invalid destination", },
 342   { 7, "Call failed due to no carrier detected", },
 343   { 8, "Call failed due to detection of a busy signal", },
 344   { 9, "Call failed due to lack of a dial tone", },
 345   { 10, "Call was not established within time allotted by LAC", },
 346   { 11, "Call was connected but no appropriate framing was detected", },
 347   { 12, "Disconnecting call due to mismatching SDS value", },
 348   { 13, "Session not established due to losing tie breaker", },
 349   { 14, "Session not established due to unsupported PW type", },
 350   { 15, "Session not established, sequencing required without valid L2-Specific Sublayer", },
 351   { 16, "Finite state machine error or timeout", },
 352   { 17, "FR PVC was deleted permanently (no longer provisioned) ", },      /* [RFC4591] */
 353   { 18, "FR PVC has been INACTIVE for an extended period of time", },      /* [RFC4591] */
 354   { 19, "Mismatched FR Header Length", },                                  /* [RFC4591] */
 355   { 20, "HDLC Link was deleted permanently (no longer provisioned)", },    /* [RFC4349] */
 356   { 21, "HDLC Link has been INACTIVE for an extended period of time", },   /* [RFC4349] */
 357   { 22, "Session not established due to other LCCE can not support the OAM Cell Emulation", },    /* [RFC4454] */
 358   { 23, "Mismatching interface MTU", },                                    /* [RFC4667] */
 359   { 24, "Attempt to connect to non-existent forwarder", },                 /* [RFC4667] */
 360   { 25, "Attempt to connect to unauthorized forwarder", },                 /* [RFC4667] */
 361   { 26, "Loop Detected", },                                                /* [draft-ietf-l2tpext-tunnel-switching-06.txt] */
 362
 363
 364   { 0, NULL }
 365 };
 366
 367 static const value_string error_code_vals[] = {
 368   { 0, "No General Error", },
 369   { 1, "No control connection exists yet for this pair of LCCEs", },
 370   { 2, "Length is wrong", },
 371   { 3, "One of the field values was out of range", },
 372   { 4, "Insufficient resources to handle this operation now", },
 373   { 5, "Invalid Session ID", },
 374   { 6, "A generic vendor-specific error occurred", },
 375   { 7, "Try another", },
 376   { 8, "Receipt of an unknown AVP with the M bit set", },
 377   { 9, "Try another directed", },
 378   { 10, "Next hop unreachable", },
 379   { 11, "Next hop busy", },
 380   { 12, "TSA busy", },
 381   { 0, NULL }
 382 };
 383
 384 #define  CONTROL_MESSAGE  0
 385 #define  RESULT_ERROR_CODE 1
 386 #define  PROTOCOL_VERSION  2
 387 #define  FRAMING_CAPABILITIES 3
 388 #define  BEARER_CAPABILITIES 4
 389 #define  TIE_BREAKER 5
 390 #define  FIRMWARE_REVISION 6
 391 #define  HOST_NAME 7
 392 #define  VENDOR_NAME 8
 393 #define  ASSIGNED_TUNNEL_ID 9
 394 #define  RECEIVE_WINDOW_SIZE 10
 395 #define  CHALLENGE 11
 396 #define  CAUSE_CODE 12
 397 #define  CHALLENGE_RESPONSE 13
 398 #define  ASSIGNED_SESSION 14
 399 #define  CALL_SERIAL_NUMBER 15
 400 #define  MINIMUM_BPS 16
 401 #define  MAXIMUM_BPS 17
 402 #define  BEARER_TYPE 18
 403 #define  FRAMING_TYPE 19
 404 #define  CALLED_NUMBER 21
 405 #define  CALLING_NUMBER 22
 406 #define  SUB_ADDRESS 23
 407 #define  TX_CONNECT_SPEED 24
 408 #define  PHYSICAL_CHANNEL 25
 409 #define  INITIAL_RECEIVED_LCP_CONFREQ 26
 410 #define  LAST_SENT_LCP_CONFREQ 27
 411 #define  LAST_RECEIVED_LCP_CONFREQ 28
 412 #define  PROXY_AUTHEN_TYPE 29
 413 #define  PROXY_AUTHEN_NAME 30
 414 #define  PROXY_AUTHEN_CHALLENGE 31
 415 #define  PROXY_AUTHEN_ID 32
 416 #define  PROXY_AUTHEN_RESPONSE 33
 417 #define  CALL_STATUS_AVPS 34
 418 #define  ACCM 35
 419 #define  RANDOM_VECTOR 36
 420 #define  PRIVATE_GROUP_ID 37
 421 #define  RX_CONNECT_SPEED 38
 422 #define  SEQUENCING_REQUIRED 39
 423 #define  PPP_DISCONNECT_CAUSE_CODE 46   /* RFC 3145 */
 424 #define  EXTENDED_VENDOR_ID                     58
 425 #define  MESSAGE_DIGEST                         59
 426 #define  ROUTER_ID                                      60
 427 #define  ASSIGNED_CONTROL_CONN_ID       61
 428 #define  PW_CAPABILITY_LIST                     62
 429 #define  LOCAL_SESSION_ID                       63
 430 #define  REMOTE_SESSION_ID                      64
 431 #define  ASSIGNED_COOKIE                        65
 432 #define  REMOTE_END_ID                          66
 433 #define  PW_TYPE                                        68
 434 #define  L2_SPECIFIC_SUBLAYER           69
 435 #define  DATA_SEQUENCING                        70
 436 #define  CIRCUIT_STATUS                         71
 437 #define  PREFERRED_LANGUAGE                     72
 438 #define  CTL_MSG_AUTH_NONCE                     73
 439 #define  TX_CONNECT_SPEED_V3            74
 440 #define  RX_CONNECT_SPEED_V3            75
 441
 442 #define NUM_AVP_TYPES  96
 443 static const value_string avp_type_vals[] = {
 444   { CONTROL_MESSAGE,           "Control Message" },
 445   { RESULT_ERROR_CODE,         "Result-Error Code" },
 446   { PROTOCOL_VERSION,          "Protocol Version" },
 447   { FRAMING_CAPABILITIES,      "Framing Capabilities" },
 448   { BEARER_CAPABILITIES,       "Bearer Capabilities" },
 449   { TIE_BREAKER,               "Tie Breaker" },
 450   { FIRMWARE_REVISION,         "Firmware Revision" },
 451   { HOST_NAME,                 "Host Name" },
 452   { VENDOR_NAME,               "Vendor Name" },
 453   { ASSIGNED_TUNNEL_ID,        "Assigned Tunnel ID" },
 454   { RECEIVE_WINDOW_SIZE,       "Receive Window Size" },
 455   { CHALLENGE,                 "Challenge" },
 456   { CAUSE_CODE,                "Cause Code" },
 457   { CHALLENGE_RESPONSE,        "Challenge Response" },
 458   { ASSIGNED_SESSION,          "Assigned Session" },
 459   { CALL_SERIAL_NUMBER,        "Call Serial Number" },
 460   { MINIMUM_BPS,               "Minimum BPS" },
 461   { MAXIMUM_BPS,               "Maximum BPS" },
 462   { BEARER_TYPE,               "Bearer Type" },
 463   { FRAMING_TYPE,              "Framing Type" },
 464   { CALLED_NUMBER,             "Called Number" },
 465   { CALLING_NUMBER,            "Calling Number" },
 466   { SUB_ADDRESS,               "Sub-Address" },
 467   { TX_CONNECT_SPEED,          "Connect Speed" },
 468   { PHYSICAL_CHANNEL,          "Physical Channel" },
 469   { INITIAL_RECEIVED_LCP_CONFREQ, "Initial Received LCP CONFREQ" },
 470   { LAST_SENT_LCP_CONFREQ,     "Last Sent LCP CONFREQ" },
 471   { LAST_RECEIVED_LCP_CONFREQ, "Last Received LCP CONFREQ" },
 472   { PROXY_AUTHEN_TYPE,         "Proxy Authen Type" },
 473   { PROXY_AUTHEN_NAME,         "Proxy Authen Name" },
 474   { PROXY_AUTHEN_CHALLENGE,    "Proxy Authen Challenge" },
 475   { PROXY_AUTHEN_ID,           "Proxy Authen ID" },
 476   { PROXY_AUTHEN_RESPONSE,     "Proxy Authen Response" },
 477   { CALL_STATUS_AVPS,          "Call status AVPs" },
 478   { ACCM,                      "ACCM" },
 479   { RANDOM_VECTOR,             "Random Vector" },
 480   { PRIVATE_GROUP_ID,          "Private group ID" },
 481   { RX_CONNECT_SPEED,          "RxConnect Speed" },
 482   { SEQUENCING_REQUIRED,       "Sequencing Required" },
 483   { PPP_DISCONNECT_CAUSE_CODE, "PPP Disconnect Cause Code" },
 484   { EXTENDED_VENDOR_ID,        "Extended Vendor ID" },
 485   { MESSAGE_DIGEST,            "Message Digest" },
 486   { ROUTER_ID,                 "Router ID" },
 487   { ASSIGNED_CONTROL_CONN_ID,  "Assigned Control Connection ID" },
 488   { PW_CAPABILITY_LIST,        "Pseudowire Capability List" },
 489   { LOCAL_SESSION_ID,          "Local Session ID" },
 490   { REMOTE_SESSION_ID,         "Remote Session ID" },
 491   { ASSIGNED_COOKIE,           "Assigned Cookie" },
 492   { REMOTE_END_ID,             "Remote End ID" },
 493   { PW_TYPE,                   "Pseudowire Type" },
 494   { L2_SPECIFIC_SUBLAYER,      "Layer2 Specific Sublayer" },
 495   { DATA_SEQUENCING,           "Data Sequencing" },
 496   { CIRCUIT_STATUS,            "Circuit Status" },
 497   { PREFERRED_LANGUAGE,        "Preferred Language" },
 498   { CTL_MSG_AUTH_NONCE,        "Control Message Authentication Nonce" },
 499   { TX_CONNECT_SPEED_V3,       "Tx Connect Speed Version 3" },
 500   { RX_CONNECT_SPEED_V3,       "Rx Connect Speed Version 3" },
 501   { 76,                                                 "Failover Capability" },                                                        /*[RFC4951] */
 502   { 77,                                                 "Tunnel Recovery" },                                                            /*[RFC4951] */
 503   { 78,                                                 "Suggested Control Sequence" },                                         /*[RFC4951] */
 504   { 79,                                                 "Failover Session State" },                                                     /*[RFC4951] */
 505   { 80,                                                 "Multicast Capability" },                                                       /*[RFC4045] */
 506   { 81,                                                 "New Outgoing Sessions" },                                                      /*[RFC4045] */
 507   { 82,                                                 "New Outgoing Sessions Acknowledgement" },                      /*[RFC4045] */
 508   { 83,                                                 "Withdraw Outgoing Sessions" },                                         /*[RFC4045] */
 509   { 84,                                                 "Multicast Packets Priority" },                                         /*[RFC4045] */
 510   { 85,                                                 "Frame-Relay Header Length" },                                          /*[RFC4591] */
 511   { 86,                                                 "ATM Maximum Concatenated Cells AVP" },                         /*[RFC4454] */
 512   { 87,                                                 "OAM Emulation Required AVP" },                                         /*[RFC4454] */
 513   { 88,                                                 "ATM Alarm Status AVP" },                                                       /*[RFC4454] */
 514     /*        Also, see ATM Alarm Status AVP Values below */
 515   { 89,                                                 "Attachment Group Identifier" },                                        /*[RFC4667] */
 516   { 90,                                                 "Local End Identifier" },                                                       /*[RFC4667] */
 517   { 91,                                                 "Interface Maximum Transmission Unit" },                        /*[RFC4667] */
 518   { 92,                                                 "FCS Retention" },                                                                      /*[RFC4720] */
 519   { 93,                                                 "Tunnel Switching Aggregator ID AVP" },                         /*[draft-ietf-l2tpext-tunnel-switching-06.txt] */
 520   { 94,                                                 "Maximum Receive Unit (MRU) AVP" },                                     /*[RFC4623] */
 521   { 95,                                                 "Maximum Reassembled Receive Unit (MRRU) AVP" },        /*[RFC4623] */
 522
 523
 524   { 0,                         NULL }
 525 };
 526
 527 #define CISCO_ASSIGNED_CONNECTION_ID    1
 528 #define CISCO_PW_CAPABILITY_LIST                2
 529 #define CISCO_LOCAL_SESSION_ID                  3
 530 #define CISCO_REMOTE_SESSION_ID                 4
 531 #define CISCO_ASSIGNED_COOKIE                   5
 532 #define CISCO_REMOTE_END_ID                             6
 533 #define CISCO_PW_TYPE                                   7
 534 #define CISCO_CIRCUIT_STATUS                    8
 535 #define CISCO_SESSION_TIE_BREAKER               9
 536 #define CISCO_DRAFT_AVP_VERSION                 10
 537 #define CISCO_MESSAGE_DIGEST                    12
 538 #define CISCO_AUTH_NONCE                                13
 539 #define CISCO_INTERFACE_MTU                             14
 540
 541 static const value_string cisco_avp_type_vals[] = {
 542   { CISCO_ASSIGNED_CONNECTION_ID,       "Assigned Connection ID" },
 543   { CISCO_PW_CAPABILITY_LIST,           "Pseudowire Capabilities List" },
 544   { CISCO_LOCAL_SESSION_ID,                     "Local Session ID" },
 545   { CISCO_REMOTE_SESSION_ID,            "Remote Session ID" },
 546   { CISCO_ASSIGNED_COOKIE,                      "Assigned Cookie" },
 547   { CISCO_REMOTE_END_ID,                        "Remote End ID" },
 548   { CISCO_PW_TYPE,                                      "Pseudowire Type" },
 549   { CISCO_CIRCUIT_STATUS,                       "Circuit Status" },
 550   { CISCO_SESSION_TIE_BREAKER,          "Session Tie Breaker" },
 551   { CISCO_DRAFT_AVP_VERSION,            "Draft AVP Version" },
 552   { CISCO_MESSAGE_DIGEST,               "Message Digest" },
 553   { CISCO_AUTH_NONCE,                   "Control Message Authentication Nonce" },
 554   { CISCO_INTERFACE_MTU,                        "Interface MTU" },
 555   { 0,                                  NULL }
 556 };
 557
 558 static const value_string pw_types_vals[] = {
 559         { 0x0001,  "Frame Relay DLCI" },
 560         { 0x0002,  "ATM AAL5 SDU VCC transport" },
 561         { 0x0003,  "ATM Cell transparent Port Mode" },
 562         { 0x0004,  "Ethernet VLAN" },
 563         { 0x0005,  "Ethernet" },
 564         { 0x0006,  "HDLC" },
 565         { 0x0007,  "PPP" },
 566         { 0x0009,  "ATM Cell transport VCC Mode" },
 567         { 0x000A,  "ATM Cell transport VPC Mode" },
 568         { 0x000B,  "IP Transport" },
 569         { 0x000C,  "MPEG-TS Payload Type (MPTPW)" },
 570         { 0x000D,  "Packet Streaming Protocol (PSPPW)" },
 571         { 0,  NULL },
 572 };
 573
 574 static dissector_handle_t ppp_hdlc_handle;
 575 static dissector_handle_t ppp_lcp_options_handle;
 576
 577 static dissector_handle_t eth_withoutfcs_handle;
 578 static dissector_handle_t chdlc_handle;
 579 static dissector_handle_t fr_handle;
 580 static dissector_handle_t ip_handle;
 581 static dissector_handle_t mpls_handle;
 582 static dissector_handle_t atm_oam_handle;
 583 static dissector_handle_t llc_handle;
 584 static dissector_handle_t lapd_handle;
 585 static dissector_handle_t mp2t_handle;
 586 static dissector_handle_t data_handle;
 587
 588 /*
 589  * Processes AVPs for Control Messages all versions and transports
 590  */
 591 static void process_control_avps(tvbuff_t *tvb,
 592                                  packet_info *pinfo,
 593                                  proto_tree *l2tp_tree,
 594                                  int idx,
 595                                  int length)
 596 {
 597         proto_tree *l2tp_lcp_avp_tree, *l2tp_avp_tree, *l2tp_avp_tree_sub;
 598         proto_item *tf, *te;
 599
 600         int             msg_type;
 601         gboolean        isStopCcn = FALSE;
 602         int             avp_type;
 603         guint32         avp_vendor_id;
 604         guint16         avp_len;
 605         guint16         ver_len_hidden;
 606         int             rhcode = 10;
 607         tvbuff_t        *next_tvb;
 608         guint16         result_code;
 609         guint16         error_code;
 610         guint32         bits;
 611         guint16         firmware_rev;
 612
 613                 while (idx < length) {    /* Process AVP's */
 614                         ver_len_hidden  = tvb_get_ntohs(tvb, idx);
 615                         avp_len         = AVP_LENGTH(ver_len_hidden);
 616                         avp_vendor_id   = tvb_get_ntohs(tvb, idx + 2);
 617                         avp_type        = tvb_get_ntohs(tvb, idx + 4);
 618
 619                         if (avp_len < 1) {
 620                                 proto_tree_add_text(l2tp_tree, tvb, idx, 0,
 621                                                     "AVP length must be >= 1");
 622                                 return;
 623                         }
 624
 625                         if (avp_vendor_id == VENDOR_IETF) {
 626                                 tf =  proto_tree_add_text(l2tp_tree, tvb, idx,
 627                                                           avp_len, "%s AVP",
 628                                                           val_to_str(avp_type, avp_type_vals, "Unknown (%u)"));
 629                         } else if (avp_vendor_id == VENDOR_CISCO) {      /* Vendor-Specific AVP */
 630                                 tf =  proto_tree_add_text(l2tp_tree, tvb, idx,
 631                                                           avp_len, "Vendor %s: %s AVP",
 632                                                           val_to_str_ext(avp_vendor_id, &sminmpec_values_ext, "Unknown (%u)"),
 633                                                           val_to_str(avp_type, cisco_avp_type_vals, "Unknown (%u)"));
 634                         } else {        /* Vendor-Specific AVP */
 635                                 tf =  proto_tree_add_text(l2tp_tree, tvb, idx,
 636                                                           avp_len, "Vendor %s AVP Type %u",
 637                                                           val_to_str_ext(avp_vendor_id, &sminmpec_values_ext, "Unknown (%u)"),
 638                                                           avp_type);
 639                         }
 640
 641
 642                         l2tp_avp_tree = proto_item_add_subtree(tf,  ett_l2tp_avp);
 643
 644                         proto_tree_add_boolean_format(l2tp_avp_tree,hf_l2tp_avp_mandatory, tvb, idx, 1,
 645                                                       rhcode, "Mandatory: %s",
 646                                                       (MANDATORY_BIT(ver_len_hidden)) ? "True" : "False" );
 647                         proto_tree_add_boolean_format(l2tp_avp_tree,hf_l2tp_avp_hidden, tvb, idx, 1,
 648                                                       rhcode, "Hidden: %s",
 649                                                       (HIDDEN_BIT(ver_len_hidden)) ? "True" : "False" );
 650                         proto_tree_add_uint_format(l2tp_avp_tree,hf_l2tp_avp_length, tvb, idx, 2,
 651                                                    rhcode, "Length: %u", avp_len);
 652                         if (HIDDEN_BIT(ver_len_hidden)) { /* don't try do display hidden */
 653                                 idx += avp_len;
 654                                 continue;
 655                         }
 656
 657                         if (avp_len < 6) {
 658                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 0,
 659                                                     "AVP length must be >= 6");
 660                                 return;
 661                         }
 662                         idx += 2;
 663                         avp_len -= 2;
 664
 665                         /* Special Case for handling Extended Vendor Id */
 666                         if (avp_type == EXTENDED_VENDOR_ID) {
 667                                 idx += 2;
 668                                 proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_vendor_id,
 669                                                                         tvb, idx, 4, FALSE);
 670
 671
 672                                 idx += 4;
 673                                 continue;
 674                         }
 675                         else {
 676                                 proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_vendor_id,
 677                                                     tvb, idx, 2, FALSE);
 678                                 idx += 2;
 679                                 avp_len -= 2;
 680                         }
 681
 682                         if (avp_vendor_id == VENDOR_CISCO) {
 683                                 proto_tree_add_uint(l2tp_avp_tree, hf_l2tp_cisco_avp_type,
 684                                                     tvb, idx, 2, avp_type);
 685                                 idx += 2;
 686                                 avp_len -= 2;
 687
 688                                 /* For the time being, we don't decode any Vendor-
 689                                    specific AVP. */
 690                                 switch (avp_type) {
 691                                 case CISCO_ASSIGNED_CONNECTION_ID:
 692                                         proto_tree_add_text(l2tp_avp_tree, tvb, idx, 4,
 693                                                             "Assigned Control Connection ID: %u",
 694                                                             tvb_get_ntohl(tvb, idx));
 695                                         break;
 696
 697                                 case CISCO_PW_CAPABILITY_LIST:
 698                                         te = proto_tree_add_text(l2tp_avp_tree, tvb, idx, avp_len,
 699                                                 "Pseudowire Capabilities List");
 700                                         l2tp_avp_tree_sub = proto_item_add_subtree(te, ett_l2tp_avp_sub);
 701                                         while (avp_len >= 2) {
 702                                                 int pw_type = tvb_get_ntohs(tvb, idx);
 703
 704                                                 proto_tree_add_text(l2tp_avp_tree_sub, tvb, idx,
 705                                                                     2, "PW Type: (%u) %s",
 706                                                                     pw_type,
 707                                                                     val_to_str(pw_type, pw_types_vals,
 708                                                                                "Unknown (0x%04x)"));
 709                                                 idx += 2;
 710                                                 avp_len -= 2;
 711                                         }
 712                                         break;
 713
 714                                 case CISCO_LOCAL_SESSION_ID:
 715                                         proto_tree_add_text(l2tp_avp_tree, tvb, idx, 4,
 716                                                             "Local Session ID: %u",
 717                                                             tvb_get_ntohl(tvb, idx));
 718                                         break;
 719                                 case CISCO_REMOTE_SESSION_ID:
 720                                         proto_tree_add_text(l2tp_avp_tree, tvb, idx, 4,
 721                                                             "Remote Session ID: %u",
 722                                                             tvb_get_ntohl(tvb, idx));
 723                                         break;
 724                                 case CISCO_ASSIGNED_COOKIE:
 725                                         proto_tree_add_text(l2tp_avp_tree, tvb, idx, avp_len,
 726                                                             "Assigned Cookie: %s",
 727                                                             tvb_bytes_to_str(tvb, idx, avp_len));
 728                                         break;
 729                                 case CISCO_REMOTE_END_ID:
 730                                         proto_tree_add_text(l2tp_avp_tree, tvb, idx, avp_len,
 731                                                             "Remote End ID: %s",
 732                                                             tvb_format_text(tvb, idx, avp_len));
 733                                         break;
 734                                 case CISCO_PW_TYPE:
 735                                         proto_tree_add_text(l2tp_avp_tree, tvb, idx, 2,
 736                                                             "Pseudowire Type: %u - %s",
 737                                                             tvb_get_ntohs(tvb, idx),
 738                                                             val_to_str(tvb_get_ntohs(tvb, idx),
 739                                                                        pw_types_vals, "Unknown (0x%04x)"));
 740                                         break;
 741                                 case CISCO_CIRCUIT_STATUS:
 742                                         bits = tvb_get_ntohs(tvb, idx);
 743                                         proto_tree_add_text(l2tp_avp_tree, tvb, idx, 2,
 744                                                             "Circuit Status: %s",
 745                                                             (CIRCUIT_STATUS_BIT(bits)) ? "Up" : "Down");
 746                                         proto_tree_add_text(l2tp_avp_tree, tvb, idx, 2,
 747                                                             "Circuit Type: %s",
 748                                                             (CIRCUIT_TYPE_BIT(bits)) ? "New" : "Existing");
 749                                         break;
 750                                 case CISCO_SESSION_TIE_BREAKER:
 751                                         proto_tree_add_item(l2tp_avp_tree, hf_l2tp_tie_breaker,
 752                                                             tvb, idx, 8, FALSE);
 753                                         break;
 754                                 case CISCO_DRAFT_AVP_VERSION:
 755                                         proto_tree_add_text(l2tp_avp_tree, tvb, idx, 2,
 756                                                             "Draft AVP Version: %u",
 757                                                             tvb_get_ntohs(tvb, idx));
 758                                         break;
 759                                 case CISCO_MESSAGE_DIGEST:
 760                                         proto_tree_add_text(l2tp_avp_tree, tvb, idx, avp_len,
 761                                                             "Message Digest: %s",
 762                                                             tvb_bytes_to_str(tvb, idx, avp_len));
 763                                         break;
 764                                 case CISCO_AUTH_NONCE:
 765                                         proto_tree_add_text(l2tp_avp_tree, tvb, idx, avp_len,
 766                                                             "Nonce: %s",
 767                                                             tvb_bytes_to_str(tvb, idx, avp_len));
 768                                         break;
 769                                 case CISCO_INTERFACE_MTU:
 770                                         proto_tree_add_text(l2tp_avp_tree, tvb, idx, avp_len,
 771                                                             "Interface MTU: %u",
 772                                                             tvb_get_ntohs(tvb, idx));
 773                                         break;
 774
 775                                 default:
 776                                         proto_tree_add_text(l2tp_avp_tree, tvb, idx,
 777                                                             avp_len, "Vendor-Specific AVP");
 778                                         break;
 779                                 }
 780                                 idx += avp_len;
 781                                 continue;
 782                         } else if (avp_vendor_id != VENDOR_IETF) {
 783                                 if (avp_len >= 2) {
 784                                         proto_tree_add_text(l2tp_avp_tree, tvb, idx, 2,
 785                                                 "Type: %u", avp_type);
 786                                         idx += 2;
 787                                         avp_len -= 2;
 788                                         if (avp_len > 0) {
 789                                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx,
 790                                                         avp_len, "Vendor-Specific AVP");
 791                                         }
 792                                 }
 793                                 idx += avp_len;
 794                                 continue;
 795                         }
 796
 797                         proto_tree_add_uint(l2tp_avp_tree, hf_l2tp_avp_type,
 798                                             tvb, idx, 2, avp_type);
 799                         idx += 2;
 800                         avp_len -= 2;
 801
 802                         switch (avp_type) {
 803
 804                         case CONTROL_MESSAGE:
 805                                 msg_type = tvb_get_ntohs(tvb, idx);
 806                                 proto_tree_add_text(l2tp_avp_tree,tvb, idx, 2,
 807                                                     "Control Message Type: (%u) %s", msg_type,
 808                                                     ((NUM_CONTROL_CALL_TYPES + 1 ) > msg_type) ?
 809                                                     calltypestr[msg_type] : "Unknown");
 810
 811                                 if (msg_type == AVP_StopCCN) {
 812                                         isStopCcn = TRUE;
 813                                 }
 814                                 break;
 815
 816                         case RESULT_ERROR_CODE:
 817                                 if (avp_len < 2)
 818                                         break;
 819                                 result_code = tvb_get_ntohs(tvb, idx);
 820                                 if (isStopCcn) {
 821                                         proto_tree_add_text(l2tp_avp_tree, tvb, idx, 2,
 822                                                             "Result code: %u - %s", result_code,
 823                                                             val_to_str(result_code, result_code_stopccn_vals, "Unknown (%u)"));
 824                                 }
 825                                 else {
 826                                         proto_tree_add_text(l2tp_avp_tree, tvb, idx, 2,
 827                                                             "Result code: %u - %s", result_code,
 828                                                             val_to_str(result_code, result_code_cdn_vals, "Unknown (%u)"));
 829                                 }
 830                                 idx += 2;
 831                                 avp_len -= 2;
 832
 833                                 if (avp_len < 2)
 834                                         break;
 835                                 error_code = tvb_get_ntohs(tvb, idx);
 836                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 2,
 837                                                     "Error code: %u - %s", error_code,
 838                                                     val_to_str(error_code, error_code_vals, "Unknown (%u)"));
 839                                 idx += 2;
 840                                 avp_len -= 2;
 841
 842                                 if (avp_len == 0)
 843                                         break;
 844                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, avp_len,
 845                                                     "Error Message: %s",
 846                                                     tvb_format_text(tvb, idx, avp_len));
 847                                 break;
 848
 849                         case PROTOCOL_VERSION:
 850                                 if (avp_len < 1)
 851                                         break;
 852                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 1,
 853                                                     "Version: %u", tvb_get_guint8(tvb, idx));
 854                                 idx += 1;
 855                                 avp_len -= 1;
 856
 857                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 1,
 858                                                     "Revision: %u", tvb_get_guint8(tvb, idx));
 859                                 break;
 860
 861                         case FRAMING_CAPABILITIES:
 862                                 bits = tvb_get_ntohl(tvb, idx);
 863                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 4,
 864                                                     "Async Framing Supported: %s",
 865                                                     (FRAMING_ASYNC(bits)) ? "True" : "False");
 866                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 4,
 867                                                     "Sync Framing Supported: %s",
 868                                                     (FRAMING_SYNC(bits)) ? "True" : "False");
 869                                 break;
 870
 871                         case BEARER_CAPABILITIES:
 872                                 bits = tvb_get_ntohl(tvb, idx);
 873                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 4,
 874                                                     "Analog Access Supported: %s",
 875                                                     (BEARER_ANALOG(bits)) ? "True" : "False");
 876                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 4,
 877                                                     "Digital Access Supported: %s",
 878                                                     (BEARER_DIGITAL(bits)) ? "True" : "False");
 879                                 break;
 880
 881                         case TIE_BREAKER:
 882                                 proto_tree_add_item(l2tp_avp_tree, hf_l2tp_tie_breaker, tvb, idx, 8, FALSE);
 883                                 break;
 884
 885                         case FIRMWARE_REVISION:
 886                                 firmware_rev = tvb_get_ntohs(tvb, idx);
 887                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 2,
 888                                                     "Firmware Revision: %d 0x%x", firmware_rev,firmware_rev );
 889                                 break;
 890
 891                         case HOST_NAME:
 892                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, avp_len,
 893                                                     "Host Name: %s",
 894                                                     tvb_format_text(tvb, idx, avp_len));
 895                                 break;
 896
 897                         case VENDOR_NAME:
 898                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, avp_len,
 899                                                     "Vendor Name: %s",
 900                                                     tvb_format_text(tvb, idx, avp_len));
 901                                 break;
 902
 903                         case ASSIGNED_TUNNEL_ID:
 904                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 2,
 905                                                     "Tunnel ID: %u", tvb_get_ntohs(tvb, idx));
 906                                 break;
 907
 908                         case RECEIVE_WINDOW_SIZE:
 909                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 2,
 910                                                     "Receive Window Size: %u",
 911                                                     tvb_get_ntohs(tvb, idx));
 912                                 break;
 913
 914                         case CHALLENGE:
 915                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, avp_len,
 916                                                     "CHAP Challenge: %s",
 917                                                     tvb_bytes_to_str(tvb, idx, avp_len));
 918                                 break;
 919
 920                         case CAUSE_CODE:
 921                                 /*
 922                                  * XXX - export stuff from the Q.931 dissector
 923                                  * to dissect the cause code and cause message,
 924                                  * and use it.
 925                                  */
 926                                 if (avp_len < 2)
 927                                         break;
 928                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 2,
 929                                                     "Cause Code: %u",
 930                                                     tvb_get_ntohs(tvb, idx));
 931                                 idx += 2;
 932                                 avp_len -= 2;
 933
 934                                 if (avp_len < 1)
 935                                         break;
 936                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 1,
 937                                                     "Cause Msg: %u",
 938                                                     tvb_get_guint8(tvb, idx));
 939                                 idx += 1;
 940                                 avp_len -= 1;
 941
 942                                 if (avp_len == 0)
 943                                         break;
 944                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, avp_len,
 945                                                     "Advisory Msg: %s",
 946                                                     tvb_format_text(tvb, idx, avp_len));
 947                                 break;
 948
 949                         case CHALLENGE_RESPONSE:
 950                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 16,
 951                                                     "CHAP Challenge Response: %s",
 952                                                     tvb_bytes_to_str(tvb, idx, 16));
 953                                 break;
 954
 955                         case ASSIGNED_SESSION:
 956                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 2,
 957                                                     "Assigned Session: %u",
 958                                                     tvb_get_ntohs(tvb, idx));
 959                                 break;
 960
 961                         case CALL_SERIAL_NUMBER:
 962                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 4,
 963                                                     "Call Serial Number: %u",
 964                                                     tvb_get_ntohl(tvb, idx));
 965                                 break;
 966
 967                         case MINIMUM_BPS:
 968                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 4,
 969                                                     "Minimum BPS: %u",
 970                                                     tvb_get_ntohl(tvb, idx));
 971                                 break;
 972
 973                         case MAXIMUM_BPS:
 974                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 4,
 975                                                     "Maximum BPS: %u",
 976                                                     tvb_get_ntohl(tvb, idx));
 977                                 break;
 978
 979                         case BEARER_TYPE:
 980                                 bits = tvb_get_ntohl(tvb, idx);
 981                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 4,
 982                                                     "Analog Bearer Type: %s",
 983                                                     (BEARER_ANALOG(bits)) ? "True" : "False");
 984                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 4,
 985                                                     "Digital Bearer Type: %s",
 986                                                     (BEARER_DIGITAL(bits)) ? "True" : "False");
 987                                 break;
 988
 989                         case FRAMING_TYPE:
 990                                 bits = tvb_get_ntohl(tvb, idx);
 991                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 4,
 992                                                     "Async Framing Type: %s",
 993                                                     (FRAMING_ASYNC(bits)) ? "True" : "False");
 994                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 4,
 995                                                     "Sync Framing Type: %s",
 996                                                      (FRAMING_SYNC(bits)) ? "True" : "False");
 997                                 break;
 998
 999                         case CALLED_NUMBER:
1000                                 if (avp_len == 0)
1001                                         break;
1002                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, avp_len,
1003                                                     "Called Number: %s",
1004                                                     tvb_format_text(tvb, idx, avp_len));
1005                                 break;
1006
1007                         case CALLING_NUMBER:
1008                                 if (avp_len == 0)
1009                                         break;
1010                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, avp_len,
1011                                                     "Calling Number: %s",
1012                                                     tvb_format_text(tvb, idx, avp_len));
1013                                 break;
1014
1015                         case SUB_ADDRESS:
1016                                 if (avp_len == 0)
1017                                         break;
1018                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, avp_len,
1019                                                     "Sub-Address: %s",
1020                                                     tvb_format_text(tvb, idx, avp_len));
1021                                 break;
1022
1023                         case TX_CONNECT_SPEED:
1024                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 4,
1025                                                     "Connect Speed: %u",
1026                                                     tvb_get_ntohl(tvb, idx));
1027                                 break;
1028
1029                         case PHYSICAL_CHANNEL:
1030                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 4,
1031                                                     "Physical Channel: %u",
1032                                                     tvb_get_ntohl(tvb, idx));
1033                                 break;
1034
1035                         case INITIAL_RECEIVED_LCP_CONFREQ:
1036                                 te = proto_tree_add_text(l2tp_avp_tree, tvb, idx, avp_len,
1037                                                          "Initial Received LCP CONFREQ: %s",
1038                                                          tvb_bytes_to_str(tvb, idx, avp_len));
1039                                 l2tp_lcp_avp_tree = proto_item_add_subtree(te, ett_l2tp_lcp);
1040                                 next_tvb = tvb_new_subset(tvb, idx, avp_len, avp_len);
1041                                 call_dissector(ppp_lcp_options_handle, next_tvb, pinfo, l2tp_lcp_avp_tree );
1042                                 break;
1043
1044                         case LAST_SENT_LCP_CONFREQ:
1045                                 te = proto_tree_add_text(l2tp_avp_tree, tvb, idx, avp_len,
1046                                                          "Last Sent LCP CONFREQ: %s",
1047                                                          tvb_bytes_to_str(tvb, idx, avp_len));
1048                                 l2tp_lcp_avp_tree = proto_item_add_subtree(te, ett_l2tp_lcp);
1049                                 next_tvb = tvb_new_subset(tvb, idx, avp_len, avp_len);
1050                                 call_dissector(ppp_lcp_options_handle, next_tvb, pinfo, l2tp_lcp_avp_tree );
1051                                 break;
1052
1053                         case LAST_RECEIVED_LCP_CONFREQ:
1054                                 te = proto_tree_add_text(l2tp_avp_tree, tvb, idx, avp_len,
1055                                                          "Last Received LCP CONFREQ: %s",
1056                                                          tvb_bytes_to_str(tvb, idx, avp_len));
1057                                 l2tp_lcp_avp_tree = proto_item_add_subtree(te, ett_l2tp_lcp);
1058                                 next_tvb = tvb_new_subset(tvb, idx, avp_len, avp_len);
1059                                 call_dissector(ppp_lcp_options_handle, next_tvb, pinfo, l2tp_lcp_avp_tree );
1060                                 break;
1061
1062                         case PROXY_AUTHEN_TYPE:
1063                                 msg_type = tvb_get_ntohs(tvb, idx);
1064                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 2,
1065                                                     "Proxy Authen Type: %s",
1066                                                     val_to_str(msg_type, authen_type_vals, "Unknown (%u)"));
1067                                 break;
1068
1069                         case PROXY_AUTHEN_NAME:
1070                                 if (avp_len == 0)
1071                                         break;
1072                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, avp_len,
1073                                                     "Proxy Authen Name: %s",
1074                                                     tvb_format_text(tvb, idx, avp_len));
1075                                 break;
1076
1077                         case PROXY_AUTHEN_CHALLENGE:
1078                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, avp_len,
1079                                                     "Proxy Authen Challenge: %s",
1080                                                     tvb_bytes_to_str(tvb, idx, avp_len));
1081                                 break;
1082
1083                         case PROXY_AUTHEN_ID:
1084                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx + 1, 1,
1085                                                     "Proxy Authen ID: %u",
1086                                                     tvb_get_guint8(tvb, idx + 1));
1087                                 break;
1088
1089                         case PROXY_AUTHEN_RESPONSE:
1090                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, avp_len,
1091                                                     "Proxy Authen Response: %s",
1092                                                     tvb_bytes_to_str(tvb, idx, avp_len));
1093                                 break;
1094
1095                         case CALL_STATUS_AVPS:
1096                                 if (avp_len < 2)
1097                                         break;
1098                                 idx += 2;
1099                                 avp_len -= 2;
1100
1101                                 if (avp_len < 4)
1102                                         break;
1103                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 4,
1104                                                     "CRC Errors: %u", tvb_get_ntohl(tvb, idx));
1105                                 idx += 4;
1106                                 avp_len -= 4;
1107
1108                                 if (avp_len < 4)
1109                                         break;
1110                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 4,
1111                                                     "Framing Errors: %u", tvb_get_ntohl(tvb, idx));
1112                                 idx += 4;
1113                                 avp_len -= 4;
1114
1115                                 if (avp_len < 4)
1116                                         break;
1117                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 4,
1118                                                     "Hardware Overruns: %u", tvb_get_ntohl(tvb, idx));
1119                                 idx += 4;
1120                                 avp_len -= 4;
1121
1122                                 if (avp_len < 4)
1123                                         break;
1124                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 4,
1125                                                     "Buffer Overruns: %u", tvb_get_ntohl(tvb, idx));
1126                                 idx += 4;
1127                                 avp_len -= 4;
1128
1129                                 if (avp_len < 4)
1130                                         break;
1131                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 4,
1132                                                     "Time-out Errors: %u", tvb_get_ntohl(tvb, idx));
1133                                 idx += 4;
1134                                 avp_len -= 4;
1135
1136                                 if (avp_len < 4)
1137                                         break;
1138                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 4,
1139                                                     "Alignment Errors: %u", tvb_get_ntohl(tvb, idx));
1140                                 idx += 4;
1141                                 avp_len -= 4;
1142                                 break;
1143
1144                         case ACCM:
1145                                 if (avp_len < 2)
1146                                         break;
1147                                 idx += 2;
1148                                 avp_len -= 2;
1149
1150                                 if (avp_len < 4)
1151                                         break;
1152                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 4,
1153                                                     "Send ACCM: %u", tvb_get_ntohl(tvb, idx));
1154                                 idx += 4;
1155                                 avp_len -= 4;
1156
1157                                 if (avp_len < 4)
1158                                         break;
1159                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 4,
1160                                                     "Receive ACCM: %u", tvb_get_ntohl(tvb, idx));
1161                                 idx += 4;
1162                                 avp_len -= 4;
1163                                 break;
1164
1165                         case RANDOM_VECTOR:
1166                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, avp_len,
1167                                                     "Random Vector: %s",
1168                                                     tvb_bytes_to_str(tvb, idx, avp_len));
1169                                 break;
1170
1171                         case PRIVATE_GROUP_ID:
1172                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, avp_len,
1173                                                     "Private Group ID: %s",
1174                                                     tvb_bytes_to_str(tvb, idx, avp_len));
1175                                 break;
1176
1177                         case RX_CONNECT_SPEED:
1178                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 4,
1179                                                     "Rx Connect Speed: %u",
1180                                                     tvb_get_ntohl(tvb, idx));
1181                                 break;
1182
1183                         case PPP_DISCONNECT_CAUSE_CODE:
1184                                 if (avp_len < 2)
1185                                         break;
1186                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 2,
1187                                                     "Disconnect Code: %u",
1188                                                     tvb_get_ntohs(tvb, idx));
1189                                 idx += 2;
1190                                 avp_len -= 2;
1191
1192                                 if (avp_len < 2)
1193                                         break;
1194                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 2,
1195                                                     "Control Protocol Number: %u",
1196                                                     tvb_get_ntohs(tvb, idx));
1197                                 idx += 2;
1198                                 avp_len -= 2;
1199
1200                                 if (avp_len < 1)
1201                                         break;
1202                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 1,
1203                                                     "Direction: %s",
1204                                                     val_to_str(tvb_get_guint8(tvb, idx),
1205                                                     cause_code_direction_vals,
1206                                                     "Reserved (%u)"));
1207                                 idx += 1;
1208                                 avp_len -= 1;
1209
1210                                 if (avp_len == 0)
1211                                         break;
1212                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, avp_len,
1213                                                     "Message: %s",
1214                                                     tvb_format_text(tvb, idx, avp_len));
1215                                 break;
1216
1217                         case MESSAGE_DIGEST:
1218                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, avp_len,
1219                                                     "Message Digest: %s",
1220                                                     tvb_bytes_to_str(tvb, idx, avp_len));
1221                                 break;
1222                         case ROUTER_ID:
1223                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 4,
1224                                                     "Router ID: %u",
1225                                                     tvb_get_ntohl(tvb, idx));
1226                                 break;
1227                         case ASSIGNED_CONTROL_CONN_ID:
1228                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 4,
1229                                                     "Assigned Control Connection ID: %u",
1230                                                     tvb_get_ntohl(tvb, idx));
1231                                 break;
1232                         case PW_CAPABILITY_LIST:
1233                                 te = proto_tree_add_text(l2tp_avp_tree, tvb, idx, avp_len,
1234                                         "Pseudowire Capabilities List");
1235                                 l2tp_avp_tree_sub = proto_item_add_subtree(te, ett_l2tp_avp_sub);
1236
1237                                 while (avp_len >= 2) {
1238                                         int pw_type = tvb_get_ntohs(tvb, idx);
1239                                         proto_tree_add_text(l2tp_avp_tree_sub, tvb, idx,
1240                                                             2, "PW Type: (%u) %s",
1241                                                             pw_type,
1242                                                             val_to_str(pw_type, pw_types_vals,
1243                                                                        "Unknown (0x%04x)"));
1244                                         idx += 2;
1245                                         avp_len -= 2;
1246                                 }
1247                                 break;
1248                         case LOCAL_SESSION_ID:
1249                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 4,
1250                                                     "Local Session ID: %u",
1251                                                     tvb_get_ntohl(tvb, idx));
1252                                 break;
1253                         case REMOTE_SESSION_ID:
1254                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 4,
1255                                                     "Remote Session ID: %u",
1256                                                     tvb_get_ntohl(tvb, idx));
1257                                 break;
1258                         case ASSIGNED_COOKIE:
1259                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, avp_len,
1260                                                     "Assigned Cookie: %s",
1261                                                     tvb_bytes_to_str(tvb, idx, avp_len));
1262                                 break;
1263                         case REMOTE_END_ID:
1264                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, avp_len,
1265                                                     "Remote End ID: %s",
1266                                                     tvb_format_text(tvb, idx, avp_len));
1267                                 break;
1268                         case PW_TYPE:
1269                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 2,
1270                                                     "Pseudowire Type: %u - %s",
1271                                                     tvb_get_ntohs(tvb, idx),
1272                                                     val_to_str(tvb_get_ntohs(tvb, idx),
1273                                                                pw_types_vals, "Unknown (0x%04x)"));
1274                                 break;
1275                         case L2_SPECIFIC_SUBLAYER:
1276                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 2,
1277                                                     "Layer2 Specific Sublayer: %s",
1278                                                     val_to_str(tvb_get_ntohs(tvb, idx),
1279                                                                l2_sublayer_vals, "Invalid (%u)"));
1280                                 break;
1281                         case DATA_SEQUENCING:
1282                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 2,
1283                                                     "Data Sequencing: %s",
1284                                                     val_to_str(tvb_get_ntohs(tvb, idx),
1285                                                                data_sequencing_vals, "Invalid (%u)"));
1286                                 break;
1287                         case CIRCUIT_STATUS:
1288                                 bits = tvb_get_ntohs(tvb, idx);
1289                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 2,
1290                                                     "Circuit Status: %s",
1291                                                     (CIRCUIT_STATUS_BIT(bits)) ? "Up" : "Down");
1292                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, 2,
1293                                                     "Circuit Type: %s",
1294                                                     (CIRCUIT_TYPE_BIT(bits)) ? "New" : "Existing");
1295                                 break;
1296                         case PREFERRED_LANGUAGE:
1297                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, avp_len,
1298                                                    "Preferred Language: %s",
1299                                                    tvb_format_text(tvb, idx, avp_len));
1300                                 break;
1301                         case CTL_MSG_AUTH_NONCE:
1302                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, avp_len,
1303                                                     "Nonce: %s",
1304                                                     tvb_bytes_to_str(tvb, idx, avp_len));
1305                                 break;
1306                         case TX_CONNECT_SPEED_V3:
1307                         {
1308                                 guint32 l_int, h_int;
1309                                 if (avp_len < 8)
1310                                         break;
1311
1312                                 h_int = tvb_get_ntohl(tvb, idx);
1313                                 l_int = tvb_get_ntohl(tvb, idx+4);
1314                                 if (!h_int && !l_int) {
1315                                         proto_tree_add_text(l2tp_avp_tree, tvb, idx, 8,
1316                                                             "Tx Connect Speed v3: indeterminable or no physical p2p link");
1317                                 }
1318                                 else {
1319                                         proto_tree_add_text(l2tp_avp_tree, tvb, idx, 8,
1320                                                             "Tx Connect Speed v3: %#x%04x",
1321                                                             h_int, l_int);
1322                                 }
1323                                 break;
1324                         }
1325                         case RX_CONNECT_SPEED_V3:
1326                         {
1327                                 guint32 l_int, h_int;
1328                                 if (avp_len < 8)
1329                                         break;
1330
1331                                 h_int = tvb_get_ntohl(tvb, idx);
1332                                 l_int = tvb_get_ntohl(tvb, idx+4);
1333                                 if (!h_int && !l_int) {
1334                                         proto_tree_add_text(l2tp_avp_tree, tvb, idx, 8,
1335                                                             "Rx Connect Speed v3: indeterminable or no physical p2p link");
1336                                 }
1337                                 else {
1338                                         proto_tree_add_text(l2tp_avp_tree, tvb, idx, 8,
1339                                                             "Rx Connect Speed v3: %#x%04x",
1340                                                             h_int, l_int);
1341                                 }
1342                                 break;
1343                         }
1344                         default:
1345                                 proto_tree_add_text(l2tp_avp_tree, tvb, idx, avp_len,
1346                                                     "Unknown AVP");
1347                                 break;
1348                         }
1349
1350                         idx += avp_len;
1351                 }
1352
1353 }
1354
1355 /*
1356  * Processes Data Messages for v3 IP and UDP, starting from the  Session ID
1357  * (common to IP and UDP). Dissects the L2TPv3 Session header, the (optional)
1358  * L2-Specific sublayer and calls the appropriate dissector for the payload.
1359  */
1360 static void
1361 process_l2tpv3_data(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
1362                     proto_tree *l2tp_tree, proto_item *l2tp_item, int *pIdx)
1363 {
1364         int             idx = *pIdx;
1365         int             sid;
1366         guint8          oam_cell = 0;
1367         proto_tree      *l2_specific = NULL;
1368         proto_item      *ti = NULL;
1369         tvbuff_t        *next_tvb;
1370
1371         /* Get Session ID */
1372         sid = tvb_get_ntohl(tvb, idx);
1373         idx += 4;
1374
1375         if (check_col(pinfo->cinfo, COL_INFO)) {
1376                 col_add_fstr(pinfo->cinfo,COL_INFO,
1377                              "%s            (session id=%u)",
1378                              data_msg, sid);
1379         }
1380
1381         if (tree) {
1382                 proto_tree_add_item(l2tp_tree, hf_l2tp_sid, tvb, idx-4, 4, FALSE);
1383                 proto_item_set_len(l2tp_item, idx);
1384                 if (!(tvb_offset_exists(tvb, idx)))
1385                         return;
1386                 if (l2tpv3_cookie != 0)
1387                         proto_tree_add_item(l2tp_tree, hf_l2tp_cookie, tvb, idx, l2tpv3_cookie, ENC_NA);
1388         }
1389
1390         switch(l2tpv3_l2_specific){
1391         case L2TPv3_L2_SPECIFIC_DEFAULT:
1392                 if (tree) {
1393                         ti = proto_tree_add_item(tree, hf_l2tp_l2_spec_def,
1394                                         tvb, idx + l2tpv3_cookie, 4, ENC_NA);
1395                         l2_specific = proto_item_add_subtree(ti, ett_l2tp_l2_spec);
1396
1397                         proto_tree_add_item(l2_specific, hf_l2tp_l2_spec_s, tvb, idx + l2tpv3_cookie,
1398                                                 1, FALSE);
1399                         proto_tree_add_item(l2_specific, hf_l2tp_l2_spec_sequence, tvb,
1400                                                 idx + l2tpv3_cookie + 1, 3, FALSE);
1401                 }
1402                 next_tvb = tvb_new_subset_remaining(tvb, idx + l2tpv3_cookie + 4);
1403                 break;
1404         case L2TPv3_L2_SPECIFIC_DOCSIS_DMPT:
1405                 if (tree) {
1406                         ti = proto_tree_add_item(tree, hf_l2tp_l2_spec_docsis_dmpt,
1407                                                 tvb, idx + l2tpv3_cookie, 4, ENC_NA);
1408                         l2_specific = proto_item_add_subtree(ti, ett_l2tp_l2_spec);
1409
1410                         proto_tree_add_item(l2_specific, hf_l2tp_l2_spec_v, tvb,
1411                                                 idx + l2tpv3_cookie,1, FALSE);
1412
1413                         proto_tree_add_item(l2_specific, hf_l2tp_l2_spec_s, tvb,
1414                                                 idx + l2tpv3_cookie,1, FALSE);
1415
1416                         proto_tree_add_item(l2_specific, hf_l2tp_l2_spec_flow_id, tvb,
1417                                                 idx + l2tpv3_cookie,1, FALSE);
1418
1419                         proto_tree_add_item(l2_specific, hf_l2tp_l2_spec_sequence, tvb,
1420                                                 idx + l2tpv3_cookie + 2,2, FALSE);
1421                 }
1422                 next_tvb = tvb_new_subset_remaining(tvb, idx + l2tpv3_cookie + 4);
1423                 break;
1424         case L2TPv3_L2_SPECIFIC_ATM:
1425                 if (tree) {
1426                         ti = proto_tree_add_item(tree, hf_l2tp_l2_spec_atm,
1427                                         tvb, idx + l2tpv3_cookie, 4, ENC_NA);
1428                         l2_specific = proto_item_add_subtree(ti, ett_l2tp_l2_spec);
1429
1430                         proto_tree_add_item(l2_specific, hf_l2tp_l2_spec_s, tvb, idx + l2tpv3_cookie,
1431                                                 1, FALSE);
1432                         proto_tree_add_item(l2_specific, hf_l2tp_l2_spec_t, tvb, idx + l2tpv3_cookie,
1433                                                 1, FALSE);
1434                         /*
1435                          * As per RFC 4454, the T bit specifies whether
1436                          * we're transporting an OAM cell or an AAL5 frame.
1437                          */
1438                         oam_cell = tvb_get_guint8(tvb, idx + l2tpv3_cookie) & 0x08;
1439                         proto_tree_add_item(l2_specific, hf_l2tp_l2_spec_g, tvb, idx + l2tpv3_cookie,
1440                                                 1, FALSE);
1441                         proto_tree_add_item(l2_specific, hf_l2tp_l2_spec_c, tvb, idx + l2tpv3_cookie,
1442                                                 1, FALSE);
1443                         proto_tree_add_item(l2_specific, hf_l2tp_l2_spec_u, tvb, idx + l2tpv3_cookie,
1444                                                 1, FALSE);
1445                         proto_tree_add_item(l2_specific, hf_l2tp_l2_spec_sequence, tvb,
1446                                                 idx + l2tpv3_cookie + 1, 3, FALSE);
1447                 }
1448                 next_tvb = tvb_new_subset_remaining(tvb, idx + l2tpv3_cookie + 4);
1449                 break;
1450         case L2TPv3_L2_SPECIFIC_LAPD:
1451                 if (tree)
1452                         proto_tree_add_text(tree, tvb, idx + l2tpv3_cookie + 4, 3,"LAPD info");
1453                 next_tvb = tvb_new_subset_remaining(tvb, idx + l2tpv3_cookie+4+3);
1454                 break;
1455         case L2TPv3_L2_SPECIFIC_NONE:
1456         default:
1457                 next_tvb = tvb_new_subset_remaining(tvb, idx + l2tpv3_cookie);
1458                 break;
1459         }
1460
1461         switch(l2tpv3_protocol){
1462         case L2TPv3_PROTOCOL_ETH:
1463                 call_dissector(eth_withoutfcs_handle, next_tvb, pinfo, tree);
1464                 break;
1465         case L2TPv3_PROTOCOL_CHDLC:
1466                 call_dissector(chdlc_handle, next_tvb, pinfo, tree);
1467                 break;
1468         case L2TPv3_PROTOCOL_FR:
1469                 call_dissector(fr_handle, next_tvb, pinfo, tree);
1470                 break;
1471         case L2TPv3_PROTOCOL_PPP:
1472                 /*
1473                  * PPP is transported without Address and Control
1474                  * fields, ppp_hdlc_handle can handle that as if if
1475                  * was ACFC (NULL Address and Control)
1476                  */
1477                 call_dissector(ppp_hdlc_handle, next_tvb, pinfo, tree);
1478                 break;
1479         case L2TPv3_PROTOCOL_IP:
1480                 call_dissector(ip_handle, next_tvb, pinfo, tree);
1481                 break;
1482         case L2TPv3_PROTOCOL_MPLS:
1483                 call_dissector(mpls_handle, next_tvb, pinfo, tree);
1484                 break;
1485         case L2TPv3_PROTOCOL_DOCSIS_DMPT:
1486                 call_dissector(mp2t_handle, next_tvb, pinfo, tree);
1487                 break;
1488         case L2TPv3_PROTOCOL_AAL5:
1489                 if (oam_cell) {
1490                         call_dissector(atm_oam_handle, next_tvb, pinfo, tree);
1491                 } else {
1492                         call_dissector(llc_handle, next_tvb, pinfo, tree);
1493                 }
1494                 break;
1495         case L2TPv3_PROTOCOL_LAPD:
1496                 call_dissector(lapd_handle, next_tvb, pinfo, tree);
1497                 break;
1498         default:
1499                 call_dissector(data_handle, next_tvb, pinfo, tree);
1500                 break;
1501         }
1502 }
1503
1504 /*
1505  * Processes v3 data message over UDP, to then call process_l2tpv3_data
1506  * from the common part (Session ID)
1507  */
1508 static void
1509 process_l2tpv3_data_udp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
1510 {
1511         proto_tree *l2tp_tree = NULL, *ctrl_tree;
1512         proto_item *l2tp_item = NULL, *ti;
1513
1514         int idx = 0;
1515         int control;
1516         int sid;
1517
1518         control = tvb_get_ntohs(tvb, idx);
1519         idx += 2;                       /* skip ahead */
1520         idx += 2;                       /* Skip the reserved */
1521         sid = tvb_get_ntohl(tvb, idx);
1522
1523         if (tree) {
1524                 l2tp_item = proto_tree_add_item(tree, proto_l2tp, tvb, 0, -1, FALSE);
1525                 l2tp_tree = proto_item_add_subtree(l2tp_item, ett_l2tp);
1526                 proto_item_append_text(l2tp_item, " version 3");
1527
1528                 ti = proto_tree_add_text(l2tp_tree, tvb, 0, 2,
1529                                          "Packet Type: %s Session Id=%u",
1530                                          data_msg, sid);
1531
1532                 ctrl_tree = proto_item_add_subtree(ti, ett_l2tp_ctrl);
1533                 proto_tree_add_uint(ctrl_tree, hf_l2tp_type, tvb, 0, 2, control);
1534                 proto_tree_add_boolean(ctrl_tree, hf_l2tp_length_bit, tvb, 0, 2, control);
1535                 proto_tree_add_boolean(ctrl_tree, hf_l2tp_seq_bit, tvb, 0, 2, control);
1536                 proto_tree_add_uint(ctrl_tree, hf_l2tp_version, tvb, 0, 2, control);
1537                 /* Data in v3 over UDP has this reserved */
1538                 proto_tree_add_item(l2tp_tree, hf_l2tp_res, tvb, 2, 2, FALSE);
1539         }
1540
1541         /* Call process_l2tpv3_data from Session ID (offset in idx of 4) */
1542         process_l2tpv3_data(tvb, pinfo, tree, l2tp_tree, l2tp_item, &idx);
1543 }
1544
1545 /*
1546  * Processes v3 data message over IP, to then call process_l2tpv3_data
1547  * from the common part (Session ID)
1548  */
1549 static void
1550 process_l2tpv3_data_ip(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
1551 {
1552         proto_tree *l2tp_tree = NULL;
1553         proto_item *l2tp_item = NULL;
1554
1555         int idx = 0;
1556         int sid;
1557
1558         sid = tvb_get_ntohl(tvb, idx);
1559
1560         if (tree) {
1561                 l2tp_item = proto_tree_add_item(tree, proto_l2tp, tvb, 0, -1, FALSE);
1562                 l2tp_tree = proto_item_add_subtree(l2tp_item, ett_l2tp);
1563                 proto_item_append_text(l2tp_item, " version 3");
1564
1565                 proto_tree_add_text(l2tp_tree, tvb, 0, 4,
1566                                          "Packet Type: %s Session Id=%u",
1567                                          data_msg, sid);
1568         }
1569
1570         /* Call process_l2tpv3_data from Session ID (offset in idx of 0) */
1571         process_l2tpv3_data(tvb, pinfo, tree, l2tp_tree, l2tp_item, &idx);
1572 }
1573
1574 /*
1575  * Processes v3 Control Message over IP, that carries NULL Session ID
1576  * to then call process_control_avps after dissecting the control.
1577  */
1578 static void
1579 process_l2tpv3_control(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int baseIdx)
1580 {
1581         proto_tree *l2tp_tree=NULL, *ctrl_tree;
1582         proto_item *l2tp_item = NULL, *ti;
1583
1584         int idx = baseIdx;
1585         int tmp_idx;
1586         guint16 length = 0;             /* Length field */
1587         guint32 ccid = 0;               /* Control Connection ID */
1588         guint16 avp_type;
1589         guint16 msg_type;
1590         guint16 control = 0;
1591
1592         control = tvb_get_ntohs(tvb, idx);
1593         idx += 2;                       /* skip ahead */
1594         if (LENGTH_BIT(control)) {      /* length field included ? */
1595                 length = tvb_get_ntohs(tvb, idx);
1596                 idx += 2;
1597         }
1598
1599         /* Get Control Channel ID */
1600         ccid = tvb_get_ntohl(tvb, idx);
1601         idx += 4;
1602
1603         if (check_col(pinfo->cinfo, COL_INFO)) {
1604                 tmp_idx = idx;
1605
1606                 if ((LENGTH_BIT(control))&&(length==12))                /* ZLB Message */
1607                         col_add_fstr(pinfo->cinfo, COL_INFO,
1608                                      "%s - ZLB      (tunnel id=%u)",
1609                                      control_msg , ccid);
1610                 else
1611                 {
1612                         if (SEQUENCE_BIT(control)) {
1613                                 tmp_idx += 4;
1614                         }
1615
1616                         tmp_idx+=4;
1617
1618                         avp_type = tvb_get_ntohs(tvb, tmp_idx);
1619                         tmp_idx += 2;
1620
1621                         if (avp_type == CONTROL_MESSAGE) {
1622                                 /* We print message type */
1623                                 msg_type = tvb_get_ntohs(tvb, tmp_idx);
1624                                 col_add_fstr(pinfo->cinfo, COL_INFO,
1625                                              "%s - %s (tunnel id=%u)",
1626                                              control_msg ,
1627                                              ((NUM_CONTROL_CALL_TYPES + 1 ) > msg_type) ?
1628                                              calltype_short_str[msg_type] : "Unknown",
1629                                              ccid);
1630                         }
1631                         else {
1632                                 /*
1633                                  * This is not a control message.
1634                                  * We never pass here except in case of bad l2tp packet!
1635                                  */
1636                                 col_add_fstr(pinfo->cinfo, COL_INFO,
1637                                              "%s (tunnel id=%u)",
1638                                              control_msg,  ccid);
1639                         }
1640                 }
1641         }
1642
1643         if (LENGTH_BIT(control)) {
1644                 /*
1645                  * Set the length of this tvbuff to be no longer than the length
1646                  * in the header.
1647                  *
1648                  * XXX - complain if that length is longer than the length of
1649                  * the tvbuff?  Have "set_actual_length()" return a Boolean
1650                  * and have its callers check the result?
1651                  */
1652                 set_actual_length(tvb, length+baseIdx);
1653         }
1654
1655         if (tree) {
1656                 l2tp_item = proto_tree_add_item(tree, proto_l2tp, tvb, 0, -1, FALSE);
1657                 l2tp_tree = proto_item_add_subtree(l2tp_item, ett_l2tp);
1658                 proto_item_append_text(l2tp_item, " version 3");
1659
1660                 if (baseIdx) {
1661                         proto_tree_add_item(l2tp_tree, hf_l2tp_sid, tvb, 0, 4, FALSE);
1662                 }
1663                 ti = proto_tree_add_text(l2tp_tree, tvb, baseIdx, 2,
1664                                                                  "Packet Type: %s Control Connection Id=%d",
1665                                                                  (CONTROL_BIT(control) ? control_msg : data_msg), ccid);
1666
1667                 ctrl_tree = proto_item_add_subtree(ti, ett_l2tp_ctrl);
1668                 proto_tree_add_uint(ctrl_tree, hf_l2tp_type, tvb, baseIdx, 2, control);
1669                 proto_tree_add_boolean(ctrl_tree, hf_l2tp_length_bit, tvb, baseIdx, 2, control);
1670                 proto_tree_add_boolean(ctrl_tree, hf_l2tp_seq_bit, tvb, baseIdx, 2, control);
1671                 proto_tree_add_uint(ctrl_tree, hf_l2tp_version, tvb, baseIdx, 2, control);
1672         }
1673         idx = baseIdx + 2;
1674         if (LENGTH_BIT(control)) {
1675                 if (tree) {
1676                         proto_tree_add_item(l2tp_tree, hf_l2tp_length, tvb, idx, 2, FALSE);
1677                 }
1678                 idx += 2;
1679         }
1680
1681         if (tree) {
1682                 proto_tree_add_item(l2tp_tree, hf_l2tp_ccid, tvb, idx, 4, FALSE);
1683         }
1684         idx += 4;
1685
1686         if (SEQUENCE_BIT(control)) {
1687                 if (tree) {
1688                         proto_tree_add_item(l2tp_tree, hf_l2tp_Ns, tvb, idx, 2, FALSE);
1689                 }
1690                 idx += 2;
1691                 if (tree) {
1692                         proto_tree_add_item(l2tp_tree, hf_l2tp_Nr, tvb, idx, 2, FALSE);
1693                 }
1694                 idx += 2;
1695         }
1696
1697         if (tree && (LENGTH_BIT(control))&&(length==12)) {
1698                 proto_tree_add_text(l2tp_tree, tvb, 0, 0, "Zero Length Bit message");
1699         }
1700
1701         if (!LENGTH_BIT(control)) {
1702                 return;
1703         }
1704
1705         process_control_avps(tvb, pinfo, l2tp_tree, idx, length+baseIdx);
1706 }
1707
1708 /*
1709  * Dissector for L2TP over UDP. For v2, calls process_control_avps for
1710  * control messages, or the ppp dissector based on the control bit.
1711  * For v3, calls either process_l2tpv3_control or process_l2tpv3_data_udp
1712  * based on the control bit.
1713  */
1714 static int
1715 dissect_l2tp_udp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
1716 {
1717         proto_tree *l2tp_tree=NULL, *ctrl_tree;
1718         proto_item *l2tp_item = NULL, *ti;
1719         int idx = 0;
1720         int tmp_idx;
1721         guint16 length = 0;             /* Length field */
1722         guint16 tid;                    /* Tunnel ID */
1723         guint16 cid;                    /* Call ID */
1724         guint16 offset_size;            /* Offset size */
1725         guint16 avp_type;
1726         guint16 msg_type;
1727         guint16 control;
1728         tvbuff_t        *next_tvb;
1729
1730         /*
1731          * Don't accept packets that aren't for an L2TP version we know,
1732          * as they might not be L2TP packets even though they happen
1733          * to be coming from or going to the L2TP port.
1734          */
1735         if (tvb_length(tvb) < 2)
1736                 return 0;       /* not enough information to check */
1737         control = tvb_get_ntohs(tvb, 0);
1738         switch (L2TP_VERSION(control)) {
1739
1740         case 2:
1741         case 3:
1742                 break;
1743
1744         default:
1745                 return 0;
1746         }
1747
1748         col_set_str(pinfo->cinfo, COL_PROTOCOL, "L2TP");
1749         col_clear(pinfo->cinfo, COL_INFO);
1750
1751         switch (L2TP_VERSION(control)) {
1752
1753         case 2:
1754                 break;
1755
1756         case 3:
1757                 col_set_str(pinfo->cinfo, COL_PROTOCOL, "L2TPv3");
1758                 if (CONTROL_BIT(control)) {
1759                         /* Call to process l2tp v3 control message */
1760                         process_l2tpv3_control(tvb, pinfo, tree, 0);
1761                 }
1762                 else {
1763                         /* Call to process l2tp v3 data message */
1764                         process_l2tpv3_data_udp(tvb, pinfo, tree);
1765                 }
1766                 return tvb_length(tvb);
1767         }
1768
1769         if (LENGTH_BIT(control)) {              /* length field included ? */
1770                 idx += 2;                       /* skip ahead */
1771                 length = tvb_get_ntohs(tvb, idx);
1772         }
1773
1774         /* collect the tunnel id & call id */
1775         idx += 2;
1776         tid = tvb_get_ntohs(tvb, idx);
1777         idx += 2;
1778         cid = tvb_get_ntohs(tvb, idx);
1779
1780         if (check_col(pinfo->cinfo, COL_INFO)) {
1781                 if (CONTROL_BIT(control)) {
1782                         /* CONTROL MESSAGE */
1783                         tmp_idx = idx;
1784
1785                         if ((LENGTH_BIT(control))&&(length==12))        /* ZLB Message */
1786                                 col_add_fstr(pinfo->cinfo, COL_INFO,
1787                                              "%s - ZLB      (tunnel id=%d, session id=%u)",
1788                                              control_msg, tid, cid);
1789                         else
1790                         {
1791                                 if (SEQUENCE_BIT(control)) {
1792                                         tmp_idx += 4;
1793                                 }
1794
1795                                 tmp_idx+=4;
1796
1797                                 avp_type = tvb_get_ntohs(tvb, (tmp_idx+=2));
1798
1799                                 if (avp_type == CONTROL_MESSAGE) {
1800                                         /* We print message type */
1801                                         msg_type = tvb_get_ntohs(tvb, tmp_idx+2);
1802                                         col_add_fstr(pinfo->cinfo, COL_INFO,
1803                                                      "%s - %s (tunnel id=%u, session id=%u)",
1804                                                      control_msg,
1805                                                      ((NUM_CONTROL_CALL_TYPES + 1 ) > msg_type) ?
1806                                                      calltype_short_str[msg_type] : "Unknown",
1807                                                      tid, cid);
1808                                 }
1809                                 else
1810                                 {
1811                                         /*
1812                                          * This is not a control message.
1813                                          * We never pass here except in case of bad l2tp packet!
1814                                          */
1815                                         col_add_fstr(pinfo->cinfo, COL_INFO,
1816                                                      "%s (tunnel id=%u, session id=%u)",
1817                                                      control_msg, tid, cid);
1818
1819                                 }
1820                         }
1821                 }
1822                 else {
1823                         /* DATA Message */
1824                         col_add_fstr(pinfo->cinfo, COL_INFO,
1825                                      "%s            (tunnel id=%u, session id=%u)",
1826                                      data_msg, tid, cid);
1827                 }
1828         }
1829
1830         if (LENGTH_BIT(control)) {
1831                 /*
1832                  * Set the length of this tvbuff to be no longer than the length
1833                  * in the header.
1834                  *
1835                  * XXX - complain if that length is longer than the length of
1836                  * the tvbuff?  Have "set_actual_length()" return a Boolean
1837                  * and have its callers check the result?
1838                  */
1839                 set_actual_length(tvb, length);
1840         }
1841
1842         if (tree) {
1843                 l2tp_item = proto_tree_add_item(tree,proto_l2tp, tvb, 0, -1, FALSE);
1844                 l2tp_tree = proto_item_add_subtree(l2tp_item, ett_l2tp);
1845
1846                 ti = proto_tree_add_text(l2tp_tree, tvb, 0, 2,
1847                                          "Packet Type: %s Tunnel Id=%d Session Id=%d",
1848                                          (CONTROL_BIT(control) ? control_msg : data_msg), tid, cid);
1849
1850                 ctrl_tree = proto_item_add_subtree(ti, ett_l2tp_ctrl);
1851                 proto_tree_add_uint(ctrl_tree, hf_l2tp_type, tvb, 0, 2, control);
1852                 proto_tree_add_boolean(ctrl_tree, hf_l2tp_length_bit, tvb, 0, 2, control);
1853                 proto_tree_add_boolean(ctrl_tree, hf_l2tp_seq_bit, tvb, 0, 2, control);
1854                 proto_tree_add_boolean(ctrl_tree, hf_l2tp_offset_bit, tvb, 0, 2, control);
1855                 proto_tree_add_boolean(ctrl_tree, hf_l2tp_priority, tvb, 0, 2, control);
1856                 proto_tree_add_uint(ctrl_tree, hf_l2tp_version, tvb, 0, 2, control);
1857         }
1858         idx = 2;
1859         if (LENGTH_BIT(control)) {
1860                 if (tree) {
1861                         proto_tree_add_item(l2tp_tree, hf_l2tp_length, tvb, idx, 2, FALSE);
1862                 }
1863                 idx += 2;
1864         }
1865
1866         if (tree) {
1867                 proto_tree_add_item(l2tp_tree, hf_l2tp_tunnel, tvb, idx, 2, FALSE);
1868         }
1869         idx += 2;
1870         if (tree) {
1871                 proto_tree_add_item(l2tp_tree, hf_l2tp_session, tvb, idx, 2, FALSE);
1872         }
1873         idx += 2;
1874
1875         if (SEQUENCE_BIT(control)) {
1876                 if (tree) {
1877                         proto_tree_add_item(l2tp_tree, hf_l2tp_Ns, tvb, idx, 2, FALSE);
1878                 }
1879                 idx += 2;
1880                 if (tree) {
1881                         proto_tree_add_item(l2tp_tree, hf_l2tp_Nr, tvb, idx, 2, FALSE);
1882                 }
1883                 idx += 2;
1884         }
1885         if (OFFSET_BIT(control)) {
1886                 offset_size = tvb_get_ntohs(tvb, idx);
1887                 if (tree) {
1888                         proto_tree_add_uint(l2tp_tree, hf_l2tp_offset, tvb, idx, 2,
1889                                                                 offset_size);
1890                 }
1891                 idx += 2;
1892                 if (offset_size != 0) {
1893                         if (tree) {
1894                                 proto_tree_add_text(l2tp_tree, tvb, idx, offset_size, "Offset Padding");
1895                         }
1896                         idx += offset_size;
1897                 }
1898         }
1899
1900         if (tree && (LENGTH_BIT(control))&&(length==12)) {
1901                 proto_tree_add_text(l2tp_tree, tvb, 0, 0, "Zero Length Bit message");
1902         }
1903
1904         if (!CONTROL_BIT(control)) {  /* Data Messages so we are done */
1905                 if (tree)
1906                         proto_item_set_len(l2tp_item, idx);
1907                 /* If we have data, signified by having a length bit, dissect it */
1908                 if (tvb_offset_exists(tvb, idx)) {
1909                         next_tvb = tvb_new_subset_remaining(tvb, idx);
1910                         call_dissector(ppp_hdlc_handle, next_tvb, pinfo, tree);
1911                 }
1912                 return tvb_length(tvb);
1913         }
1914
1915         if (LENGTH_BIT(control))
1916                 process_control_avps(tvb, pinfo, l2tp_tree, idx, length);
1917
1918         return tvb_length(tvb);
1919 }
1920
1921
1922 /*
1923  * Only L2TPv3 runs directly over IP, and dissect_l2tp_ip starts dissecting
1924  * those packets to call either process_l2tpv3_control for Control Messages
1925  * or process_l2tpv3_data_ip for Data Messages over IP, based on the
1926  * Session ID
1927  */
1928 static void
1929 dissect_l2tp_ip(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
1930 {
1931         int idx = 0;
1932         guint32 sid;                    /* Session ID */
1933
1934         /* Only L2TPv3 runs directly over IP */
1935         col_set_str(pinfo->cinfo, COL_PROTOCOL, "L2TPv3");
1936
1937         col_clear(pinfo->cinfo, COL_INFO);
1938
1939         sid = tvb_get_ntohl(tvb, idx);
1940         if (sid == 0) {
1941                 /* This is control message */
1942                 /* Call to process l2tp v3 control message */
1943                 process_l2tpv3_control(tvb, pinfo, tree, 4);
1944         }
1945         else {
1946                 /* Call to process l2tp v3 data message */
1947                 process_l2tpv3_data_ip(tvb, pinfo, tree);
1948         }
1949
1950         return;
1951 }
1952
1953 /* registration with the filtering engine */
1954 void
1955 proto_register_l2tp(void)
1956 {
1957         static hf_register_info hf[] = {
1958                 { &hf_l2tp_type,
1959                 { "Type", "l2tp.type", FT_UINT16, BASE_DEC, VALS(l2tp_type_vals), 0x8000,
1960                         "Type bit", HFILL }},
1961
1962                 { &hf_l2tp_length_bit,
1963                 { "Length Bit", "l2tp.length_bit", FT_BOOLEAN, 16, TFS(&l2tp_length_bit_truth), 0x4000,
1964                         NULL, HFILL }},
1965
1966                 { &hf_l2tp_seq_bit,
1967                 { "Sequence Bit", "l2tp.seq_bit", FT_BOOLEAN, 16, TFS(&l2tp_seq_bit_truth), 0x0800,
1968                         NULL, HFILL }},
1969
1970                 { &hf_l2tp_offset_bit,
1971                 { "Offset bit", "l2tp.offset_bit", FT_BOOLEAN, 16, TFS(&l2tp_offset_bit_truth), 0x0200,
1972                         NULL, HFILL }},
1973
1974                 { &hf_l2tp_priority,
1975                 { "Priority", "l2tp.priority", FT_BOOLEAN, 16, TFS(&l2tp_priority_truth), 0x0100,
1976                         "Priority bit", HFILL }},
1977
1978                 { &hf_l2tp_version,
1979                 { "Version", "l2tp.version", FT_UINT16, BASE_DEC, NULL, 0x000f,
1980                         NULL, HFILL }},
1981
1982                 { &hf_l2tp_length,
1983                 { "Length","l2tp.length", FT_UINT16, BASE_DEC, NULL, 0x0,
1984                         NULL, HFILL }},
1985
1986                 { &hf_l2tp_tunnel,
1987                 { "Tunnel ID","l2tp.tunnel", FT_UINT16, BASE_DEC, NULL, 0x0, /* Probably should be FT_BYTES */
1988                         NULL, HFILL }},
1989
1990                 { &hf_l2tp_session,
1991                 { "Session ID","l2tp.session", FT_UINT16, BASE_DEC, NULL, 0x0, /* Probably should be FT_BYTES */
1992                         NULL, HFILL }},
1993
1994                 { &hf_l2tp_Ns,
1995                 { "Ns","l2tp.Ns", FT_UINT16, BASE_DEC, NULL, 0x0,
1996                         NULL, HFILL }},
1997
1998                 { &hf_l2tp_Nr,
1999                 { "Nr","l2tp.Nr", FT_UINT16, BASE_DEC, NULL, 0x0,
2000                         NULL, HFILL }},
2001
2002                 { &hf_l2tp_offset,
2003                 { "Offset","l2tp.offset", FT_UINT16, BASE_DEC, NULL, 0x0,
2004                         "Number of octest past the L2TP header at which thepayload data starts.", HFILL }},
2005
2006                 { &hf_l2tp_avp_mandatory,
2007                 { "Mandatory", "l2tp.avp.mandatory", FT_BOOLEAN, BASE_NONE, NULL, 0x0,
2008                         "Mandatory AVP", HFILL }},
2009
2010                 { &hf_l2tp_avp_hidden,
2011                 { "Hidden", "l2tp.avp.hidden", FT_BOOLEAN, BASE_NONE, NULL, 0x0,
2012                         "Hidden AVP", HFILL }},
2013
2014                 { &hf_l2tp_avp_length,
2015                 { "Length", "l2tp.avp.length", FT_UINT16, BASE_DEC, NULL, 0,
2016                         "AVP Length", HFILL }},
2017
2018                 { &hf_l2tp_avp_vendor_id,
2019                 { "Vendor ID", "l2tp.avp.vendor_id", FT_UINT16, BASE_DEC|BASE_EXT_STRING, &sminmpec_values_ext, 0,
2020                         "AVP Vendor ID", HFILL }},
2021
2022                 { &hf_l2tp_avp_type,
2023                 { "Type", "l2tp.avp.type", FT_UINT16, BASE_DEC, VALS(avp_type_vals), 0,
2024                         "AVP Type", HFILL }},
2025
2026                 { &hf_l2tp_tie_breaker,
2027                 { "Tie Breaker", "l2tp.tie_breaker", FT_UINT64, BASE_HEX, NULL, 0,
2028                         NULL, HFILL }},
2029
2030                 { &hf_l2tp_sid,
2031                 { "Session ID","l2tp.sid", FT_UINT32, BASE_DEC, NULL, 0x0,
2032                         NULL, HFILL }},
2033
2034                 { &hf_l2tp_ccid,
2035                 { "Control Connection ID","l2tp.ccid", FT_UINT32, BASE_DEC, NULL, 0x0,
2036                         NULL, HFILL }},
2037
2038                 { &hf_l2tp_res,
2039                 { "Reserved","l2tp.res", FT_UINT16, BASE_HEX, NULL, 0x0,
2040                         NULL, HFILL }},
2041
2042                 { &hf_l2tp_cookie,
2043                 { "Cookie","l2tp.cookie", FT_BYTES, BASE_NONE, NULL, 0x0,
2044                         NULL, HFILL }},
2045
2046                 { &hf_l2tp_l2_spec_def,
2047                 { "Default L2-Specific Sublayer","l2tp.l2_spec_def", FT_NONE, BASE_NONE, NULL, 0x0,
2048                         NULL, HFILL }},
2049
2050                 { &hf_l2tp_l2_spec_atm,
2051                 { "ATM-Specific Sublayer","l2tp.l2_spec_atm", FT_NONE, BASE_NONE, NULL, 0x0,
2052                         NULL, HFILL }},
2053
2054                 { &hf_l2tp_l2_spec_docsis_dmpt,
2055                 { "DOCSIS DMPT - Specific Sublayer","l2tp.l2_spec_docsis_dmpt", FT_NONE, BASE_NONE, NULL, 0x0,
2056                         NULL, HFILL }},
2057
2058                 { &hf_l2tp_l2_spec_v,
2059                 { "V-bit","l2tp.l2_spec_v", FT_BOOLEAN, 8, NULL, 0x80,
2060                         "VCCV Bit", HFILL }},
2061
2062                 { &hf_l2tp_l2_spec_s,
2063                 { "S-bit","l2tp.l2_spec_s", FT_BOOLEAN, 8, NULL, 0x40,
2064                         "Sequence Bit", HFILL }},
2065
2066                 { &hf_l2tp_l2_spec_t,
2067                 { "T-bit","l2tp.l2_spec_t", FT_BOOLEAN, 8, NULL, 0x08,
2068                         "Transport Type Bit", HFILL }},
2069
2070                 { &hf_l2tp_l2_spec_g,
2071                 { "G-bit","l2tp.l2_spec_g", FT_BOOLEAN, 8, NULL, 0x04,
2072                         "EFCI Bit", HFILL }},
2073
2074                 { &hf_l2tp_l2_spec_c,
2075                 { "C-bit","l2tp.l2_spec_c", FT_BOOLEAN, 8, NULL, 0x02,
2076                         "CLP Bit", HFILL }},
2077
2078                 { &hf_l2tp_l2_spec_u,
2079                 { "U-bit","l2tp.l2_spec_u", FT_BOOLEAN, 8, NULL, 0x01,
2080                         "C/R Bit", HFILL }},
2081
2082                 { &hf_l2tp_l2_spec_flow_id,
2083                 { "Flow ID","l2tp.l2_spec_flow_id", FT_UINT8, BASE_HEX, NULL, FLOW_ID_MASK,
2084                         NULL, HFILL }},
2085
2086                 { &hf_l2tp_l2_spec_sequence,
2087                 { "Sequence Number","l2tp.l2_spec_sequence", FT_UINT24, BASE_DEC, NULL, 0x0,
2088                         NULL, HFILL }},
2089
2090                 { &hf_l2tp_cisco_avp_type,
2091                 { "Type", "l2tp.avp.ciscotype", FT_UINT16, BASE_DEC, VALS(cisco_avp_type_vals), 0,
2092                         "AVP Type", HFILL }},
2093
2094         };
2095
2096         static gint *ett[] = {
2097                 &ett_l2tp,
2098                 &ett_l2tp_ctrl,
2099                 &ett_l2tp_avp,
2100                 &ett_l2tp_avp_sub,
2101                 &ett_l2tp_l2_spec,
2102                 &ett_l2tp_lcp,
2103         };
2104
2105         module_t *l2tp_module;
2106
2107         proto_l2tp = proto_register_protocol(
2108                 "Layer 2 Tunneling Protocol", "L2TP", "l2tp");
2109         proto_register_field_array(proto_l2tp, hf, array_length(hf));
2110         proto_register_subtree_array(ett, array_length(ett));
2111
2112         l2tp_module = prefs_register_protocol(proto_l2tp, NULL);
2113
2114         prefs_register_enum_preference(l2tp_module,
2115                                         "cookie_size",
2116                                         "L2TPv3 Cookie Size",
2117                                         "L2TPv3 Cookie Size",
2118                                         &l2tpv3_cookie,
2119                                         l2tpv3_cookies,
2120                                         FALSE);
2121
2122         prefs_register_enum_preference(l2tp_module,
2123                                         "l2_specific",
2124                                         "L2TPv3 L2-Specific Sublayer",
2125                                         "L2TPv3 L2-Specific Sublayer",
2126                                         &l2tpv3_l2_specific,
2127                                         l2tpv3_l2_specifics,
2128                                         FALSE);
2129
2130         prefs_register_enum_preference(l2tp_module,
2131                                         "protocol",
2132                                         "Decode L2TPv3 packet contents as this protocol",
2133                                         "Decode L2TPv3 packet contents as this protocol",
2134                                         &l2tpv3_protocol,
2135                                         l2tpv3_protocols,
2136                                         FALSE);
2137
2138 }
2139
2140 void
2141 proto_reg_handoff_l2tp(void)
2142 {
2143         dissector_handle_t l2tp_udp_handle;
2144         dissector_handle_t l2tp_ip_handle;
2145
2146         l2tp_udp_handle = new_create_dissector_handle(dissect_l2tp_udp, proto_l2tp);
2147         dissector_add_uint("udp.port", UDP_PORT_L2TP, l2tp_udp_handle);
2148
2149         l2tp_ip_handle = create_dissector_handle(dissect_l2tp_ip, proto_l2tp);
2150         dissector_add_uint("ip.proto", IP_PROTO_L2TP, l2tp_ip_handle);
2151
2152         /*
2153          * Get a handle for the PPP-in-HDLC-like-framing dissector.
2154          */
2155         ppp_hdlc_handle = find_dissector("ppp_hdlc");
2156         ppp_lcp_options_handle = find_dissector("ppp_lcp_options");
2157
2158         /*
2159          * Get a handle for the dissectors used in v3.
2160          */
2161         eth_withoutfcs_handle = find_dissector("eth_withoutfcs");
2162         chdlc_handle = find_dissector("chdlc");
2163         fr_handle = find_dissector("fr");
2164         ip_handle = find_dissector("ip");
2165         mpls_handle = find_dissector("mpls");
2166         atm_oam_handle = find_dissector("atm_oam_cell");
2167         llc_handle = find_dissector("llc");
2168         lapd_handle = find_dissector("lapd");
2169         mp2t_handle = find_dissector("mp2t");
2170         data_handle = find_dissector("data");
2171 }