epan/dissectors/packet-llc.c

   1 /* packet-llc.c
   2  * Routines for IEEE 802.2 LLC layer
   3  * Gilbert Ramirez <gram@alumni.rice.edu>
   4  *
   5  * $Id$
   6  *
   7  * Wireshark - Network traffic analyzer
   8  * By Gerald Combs <gerald@wireshark.org>
   9  * Copyright 1998 Gerald Combs
  10  *
  11  * This program is free software; you can redistribute it and/or
  12  * modify it under the terms of the GNU General Public License
  13  * as published by the Free Software Foundation; either version 2
  14  * of the License, or (at your option) any later version.
  15  *
  16  * This program is distributed in the hope that it will be useful,
  17  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  18  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19  * GNU General Public License for more details.
  20  *
  21  * You should have received a copy of the GNU General Public License
  22  * along with this program; if not, write to the Free Software
  23  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  24  */
  25
  26 #ifdef HAVE_CONFIG_H
  27 # include "config.h"
  28 #endif
  29
  30 #include <glib.h>
  31 #include <epan/packet.h>
  32 #include <epan/oui.h>
  33 #include <epan/xdlc.h>
  34 #include <epan/etypes.h>
  35 #include <epan/llcsaps.h>
  36 #include <epan/bridged_pids.h>
  37 #include <epan/ppptypes.h>
  38 #include <epan/arcnet_pids.h>
  39 #include <epan/conversation.h>
  40 #include "packet-fc.h"
  41 #include "packet-ip.h"
  42 #include "packet-ipx.h"
  43 #include "packet-netbios.h"
  44 #include "packet-vines.h"
  45 #include <epan/sna-utils.h>
  46
  47 #include "packet-llc.h"
  48
  49 #define UDP_PORT_LLC1   12000
  50 #define UDP_PORT_LLC2   12001
  51 #define UDP_PORT_LLC3   12002
  52 #define UDP_PORT_LLC4   12003
  53 #define UDP_PORT_LLC5   12004
  54
  55 static int proto_llc = -1;
  56 static int hf_llc_dsap = -1;
  57 static int hf_llc_ssap = -1;
  58 static int hf_llc_dsap_ig = -1;
  59 static int hf_llc_ssap_cr = -1;
  60 static int hf_llc_ctrl = -1;
  61 static int hf_llc_n_r = -1;
  62 static int hf_llc_n_s = -1;
  63 static int hf_llc_p = -1;
  64 static int hf_llc_p_ext = -1;
  65 static int hf_llc_f = -1;
  66 static int hf_llc_f_ext = -1;
  67 static int hf_llc_s_ftype = -1;
  68 static int hf_llc_u_modifier_cmd = -1;
  69 static int hf_llc_u_modifier_resp = -1;
  70 static int hf_llc_ftype_i = -1;
  71 static int hf_llc_ftype_s_u = -1;
  72 static int hf_llc_ftype_s_u_ext = -1;
  73 static int hf_llc_type = -1;
  74 static int hf_llc_oui = -1;
  75 static int hf_llc_pid = -1;
  76
  77 static int proto_basicxid = -1;
  78 static int hf_llc_xid_format = -1;
  79 static int hf_llc_xid_types = -1;
  80 static int hf_llc_xid_wsize = -1;
  81
  82 static gint ett_llc = -1;
  83 static gint ett_llc_ctrl = -1;
  84 static gint ett_llc_basicxid = -1;
  85
  86 static dissector_table_t subdissector_table;
  87 static dissector_table_t xid_subdissector_table;
  88
  89 static dissector_handle_t bpdu_handle;
  90 static dissector_handle_t eth_withoutfcs_handle;
  91 static dissector_handle_t eth_withfcs_handle;
  92 static dissector_handle_t fddi_handle;
  93 static dissector_handle_t tr_handle;
  94 static dissector_handle_t data_handle;
  95
  96 /*
  97  * Group/Individual bit, in the DSAP.
  98  */
  99 #define DSAP_GI_BIT     0x01
 100
 101 /*
 102  * Command/Response bit, in the SSAP.
 103  *
 104  * The low-order bit of the SSAP apparently determines whether this
 105  * is a request or a response.  (RFC 1390, "Transmission of IP and
 106  * ARP over FDDI Networks", says
 107  *
 108  *      Command frames are identified by having the low order
 109  *      bit of the SSAP address reset to zero.  Response frames
 110  *      have the low order bit of the SSAP address set to one.
 111  *
 112  * and a page I've seen seems to imply that's part of 802.2.)
 113  */
 114 #define SSAP_CR_BIT     0x01
 115
 116 /*
 117  * Mask to extrace the SAP number from the DSAP or the SSAP.
 118  */
 119 #define SAP_MASK        0xFE
 120
 121 /*
 122  * These are for SSAP and DSAP, wth last bit always zero.
 123  * XXX - some DSAPs come in separate "individual" and "group" versions,
 124  * with the last bit 0 and 1, respectively (e.g., LLC Sub-layer Management,
 125  * IBM SNA Path Control, IBM Net Management), but, whilst 0xFE is
 126  * the ISO Network Layer Protocol, 0xFF is the Global LSAP.
 127  */
 128 const value_string sap_vals[] = {
 129         { SAP_NULL,           "NULL LSAP" },
 130         { SAP_LLC_SLMGMT,     "LLC Sub-Layer Management" },
 131         { SAP_SNA_PATHCTRL,   "SNA Path Control" },
 132         { SAP_IP,             "TCP/IP" },
 133         { SAP_SNA1,           "SNA" },
 134         { SAP_SNA2,           "SNA" },
 135         { SAP_PROWAY_NM_INIT, "PROWAY (IEC955) Network Management and Initialization" },
 136         { SAP_NETWARE1,       "NetWare (unofficial?)" },
 137         { SAP_OSINL1,         "ISO Network Layer (OSLAN 1)" },
 138         { SAP_TI,             "Texas Instruments" },
 139         { SAP_OSINL2,         "ISO Network Layer (unofficial?)" },
 140         { SAP_OSINL3,         "ISO Network Layer (unofficial?)" },
 141         { SAP_BPDU,           "Spanning Tree BPDU" },
 142         { SAP_RS511,          "EIA RS-511 Manufacturing Message Service" },
 143         { SAP_OSINL4,         "ISO Network Layer (OSLAN 2)" },
 144         { SAP_X25,            "ISO 8208 (X.25 over 802.2)" },
 145         /*
 146          * XXX - setting the group bit of SAP_X25 make 0x7F; is this just
 147          * a group version of that?
 148          */
 149         { 0x7F,               "ISO 802.2" },
 150         { SAP_XNS,            "XNS" },
 151         { SAP_BACNET,         "BACnet" },
 152         { SAP_NESTAR,         "Nestar" },
 153         { SAP_PROWAY_ASLM,    "PROWAY (IEC955) Active Station List Maintenance" },
 154         { SAP_ARP,            "ARP" },  /* XXX - hand to "dissect_arp()"? */
 155         { SAP_HPJD,           "HP JetDirect Printer" },
 156         { SAP_SNAP,           "SNAP" },
 157         { SAP_VINES1,         "Banyan Vines" },
 158         { SAP_VINES2,         "Banyan Vines" },
 159         { SAP_NETWARE2,       "NetWare" },
 160         { SAP_NETBIOS,        "NetBIOS" },
 161         { SAP_IBMNM,          "IBM Net Management" },
 162         { SAP_HPEXT,          "HP Extended LLC" },
 163         { SAP_UB,             "Ungermann-Bass" },
 164         { SAP_RPL,            "Remote Program Load" },
 165         { SAP_OSINL5,         "ISO Network Layer" },
 166         { SAP_GLOBAL,         "Global LSAP" },
 167         { 0x00,               NULL }
 168 };
 169
 170 /*
 171  * See
 172  *
 173  * http://standards.ieee.org/regauth/oui/oui.txt
 174  *
 175  * http://www.cisco.com/univercd/cc/td/doc/product/lan/trsrb/vlan.htm
 176  *
 177  * for the PIDs for VTP and DRiP that go with an OUI of OUI_CISCO.
 178  */
 179 const value_string oui_vals[] = {
 180         { OUI_ENCAP_ETHER, "Encapsulated Ethernet" },
 181         { OUI_APPLE_ATALK, "Apple (AppleTalk)" },
 182         { OUI_ATM_FORUM,   "ATM Forum" },
 183         /* RFC 2427, RFC 2684 */
 184         { OUI_BRIDGED,     "Frame Relay or ATM bridged frames" },
 185         { OUI_CABLE_BPDU,  "DOCSIS Spanning Tree" }, /* DOCSIS spanning tree BPDU */
 186         { OUI_SIEMENS,     "Siemens AG" },
 187         { OUI_XEROX,       "Xerox" },
 188 /*
 189 http://www.cisco.com/univercd/cc/td/doc/product/software/ios113ed/113ed_cr/ibm_r/brprt1/brsrb.htm
 190 */
 191         { OUI_CISCO,       "Cisco" },
 192         { OUI_CISCO_90,    "Cisco IOS 9.0 Compatible" },
 193         { OUI_CISCOWL,     "Cisco Wireless (Aironet) L2" },
 194         { OUI_EXTREME,     "Extreme Networks" },
 195         { OUI_HP,          "Hewlett-Packard" },
 196         { OUI_NORTEL,      "Nortel Networks SONMP" },
 197         { 0,               NULL }
 198 };
 199
 200 const value_string format_vals[] = {
 201         { 0x81,        "LLC basic format" },
 202         { 0,           NULL }
 203 };
 204
 205 /*
 206  * Mask to extract the type from XID frame.
 207  */
 208 #define TYPES_MASK      0x1F
 209
 210 const value_string type_vals[] = {
 211         { 1,           "Type 1 LLC (Class I LLC)" },
 212         { 2,           "Type 2 LLC" },
 213         { 3,           "Type 1 and Type 2 LLCs (Class II LLC)" },
 214         { 4,           "Type 3 LLC" },
 215         { 5,           "Type 1 and Type 3 LLCs (Class III LLC)" },
 216         { 6,           "Type 2 and Type 3 LLCs" },
 217         { 7,           "Type 1 and Type 2 and Type 3 LLCs (Class IV LLC)" },
 218         { 0,           NULL }
 219 };
 220
 221 /*
 222  * Hash table for translating OUIs to a dissector table/field info pair;
 223  * the dissector table maps PID values to dissectors, and the field
 224  * corresponds to the PID for that OUI.
 225  */
 226 typedef struct {
 227         dissector_table_t table;
 228         hf_register_info *field_info;
 229 } oui_info_t;
 230
 231 static GHashTable *oui_info_table = NULL;
 232
 233 /*
 234  * Add an entry for a new OUI.
 235  */
 236 void
 237 llc_add_oui(guint32 oui, const char *table_name, const char *table_ui_name,
 238     hf_register_info *hf_item)
 239 {
 240         oui_info_t *new_info;
 241
 242         new_info = g_malloc(sizeof (oui_info_t));
 243         new_info->table = register_dissector_table(table_name,
 244             table_ui_name, FT_UINT16, BASE_HEX);
 245         new_info->field_info = hf_item;
 246
 247         /*
 248          * Create the hash table for OUI information, if it doesn't
 249          * already exist.
 250          */
 251         if (oui_info_table == NULL) {
 252                 oui_info_table = g_hash_table_new(g_direct_hash,
 253                     g_direct_equal);
 254         }
 255         g_hash_table_insert(oui_info_table, GUINT_TO_POINTER(oui), new_info);
 256 }
 257
 258 void
 259 capture_llc(const guchar *pd, int offset, int len, packet_counts *ld) {
 260
 261         int             is_snap;
 262         guint16         control;
 263         int             llc_header_len;
 264
 265         if (!BYTES_ARE_IN_FRAME(offset, len, 2)) {
 266                 ld->other++;
 267                 return;
 268         }
 269         is_snap = (pd[offset] == SAP_SNAP) && (pd[offset+1] == SAP_SNAP);
 270         llc_header_len = 2;     /* DSAP + SSAP */
 271
 272         /*
 273          * XXX - the page referred to in the comment above about the
 274          * Command/Response bit also implies that LLC Type 2 always
 275          * uses extended operation, so we don't need to determine
 276          * whether it's basic or extended operation; is that the case?
 277          */
 278         control = get_xdlc_control(pd, offset+2, pd[offset+1] & SSAP_CR_BIT);
 279         llc_header_len += XDLC_CONTROL_LEN(control, TRUE);
 280         if (!BYTES_ARE_IN_FRAME(offset, len, llc_header_len)) {
 281                 ld->other++;
 282                 return;
 283         }
 284
 285         if (!XDLC_IS_INFORMATION(control)) {
 286                 ld->other++;
 287                 return;
 288         }
 289         if (is_snap)
 290                 capture_snap(pd, offset+3, len, ld);
 291         else {
 292                 /* non-SNAP */
 293                 switch (pd[offset]) {
 294
 295                 case SAP_IP:
 296                         capture_ip(pd, offset + llc_header_len, len, ld);
 297                         break;
 298
 299                 case SAP_NETWARE1:
 300                 case SAP_NETWARE2:
 301                         capture_ipx(ld);
 302                         break;
 303
 304                 case SAP_NETBIOS:
 305                         capture_netbios(ld);
 306                         break;
 307
 308                 case SAP_VINES1:
 309                 case SAP_VINES2:
 310                         capture_vines(ld);
 311                         break;
 312
 313                 default:
 314                         ld->other++;
 315                         break;
 316                 }
 317         }
 318 }
 319
 320 void
 321 capture_snap(const guchar *pd, int offset, int len, packet_counts *ld)
 322 {
 323         guint32         oui;
 324         guint16         etype;
 325
 326         if (!BYTES_ARE_IN_FRAME(offset, len, 5)) {
 327                 ld->other++;
 328                 return;
 329         }
 330
 331         oui = pd[offset] << 16 | pd[offset+1] << 8 | pd[offset+2];
 332         etype = pntohs(&pd[offset+3]);
 333         switch (oui) {
 334
 335         case OUI_ENCAP_ETHER:
 336         case OUI_CISCO_90:
 337         case OUI_APPLE_ATALK:
 338                 /* No, I have no idea why Apple used
 339                    one of their own OUIs, rather than
 340                    OUI_ENCAP_ETHER, and an Ethernet
 341                    packet type as protocol ID, for
 342                    AppleTalk data packets - but used
 343                    OUI_ENCAP_ETHER and an Ethernet
 344                    packet type for AARP packets. */
 345                 capture_ethertype(etype, pd, offset+5, len, ld);
 346                 break;
 347
 348         case OUI_CISCO:
 349                 capture_ethertype(etype, pd, offset+5, len, ld);
 350                 break;
 351
 352         default:
 353                 ld->other++;
 354                 break;
 355         }
 356 }
 357
 358 /* Used only for U frames */
 359 static const xdlc_cf_items llc_cf_items = {
 360         NULL,
 361         NULL,
 362         &hf_llc_p,
 363         &hf_llc_f,
 364         NULL,
 365         &hf_llc_u_modifier_cmd,
 366         &hf_llc_u_modifier_resp,
 367         NULL,
 368         &hf_llc_ftype_s_u
 369 };
 370
 371 /* Used only for I and S frames */
 372 static const xdlc_cf_items llc_cf_items_ext = {
 373         &hf_llc_n_r,
 374         &hf_llc_n_s,
 375         &hf_llc_p_ext,
 376         &hf_llc_f_ext,
 377         &hf_llc_s_ftype,
 378         NULL,
 379         NULL,
 380         &hf_llc_ftype_i,
 381         &hf_llc_ftype_s_u_ext
 382 };
 383
 384 static void
 385 dissect_basicxid(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 386 {
 387         proto_tree      *xid_tree = NULL;
 388         proto_item      *ti = NULL;
 389         guint8          format, types, wsize;
 390
 391         if (check_col(pinfo->cinfo, COL_PROTOCOL)) {
 392                 col_set_str(pinfo->cinfo, COL_PROTOCOL, "XID");
 393         }
 394         if (check_col(pinfo->cinfo, COL_INFO)) {
 395                 col_clear(pinfo->cinfo, COL_INFO);
 396         }
 397
 398         format = tvb_get_guint8(tvb, 0);
 399         if (tree) {
 400                 ti = proto_tree_add_item(tree, proto_basicxid, tvb, 0, -1, FALSE);
 401                 xid_tree = proto_item_add_subtree(ti, ett_llc_basicxid);
 402                 proto_tree_add_uint(xid_tree, hf_llc_xid_format, tvb, 0,
 403                         1, format);
 404         } else
 405                 xid_tree = NULL;
 406         if (check_col(pinfo->cinfo, COL_INFO)) {
 407                 col_append_fstr(pinfo->cinfo, COL_INFO,
 408                     "Basic Format");
 409         }
 410
 411         types = tvb_get_guint8(tvb, 1);
 412         if (tree) {
 413                 proto_tree_add_uint(xid_tree, hf_llc_xid_types, tvb, 1,
 414                         1, types & TYPES_MASK);
 415         }
 416         if (check_col(pinfo->cinfo, COL_INFO)) {
 417                 col_append_fstr(pinfo->cinfo, COL_INFO,
 418                     "; %s", val_to_str(types & TYPES_MASK, type_vals, "0x%02x")
 419                 );
 420         }
 421         wsize = tvb_get_guint8(tvb, 2);
 422         if (tree) {
 423                 proto_tree_add_uint(xid_tree, hf_llc_xid_wsize, tvb, 2,
 424                         1, (wsize & 0xFE) >> 1);
 425         }
 426         if (check_col(pinfo->cinfo, COL_INFO)) {
 427                 col_append_fstr(pinfo->cinfo, COL_INFO,
 428                     "; Window Size %d", (wsize & 0xFE) >> 1);
 429         }
 430 }
 431
 432 static void
 433 dissect_llc(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 434 {
 435         proto_tree      *llc_tree = NULL;
 436         proto_item      *ti = NULL;
 437         int             is_snap;
 438         guint16         control;
 439         int             llc_header_len;
 440         guint8          dsap, ssap, format;
 441         tvbuff_t        *next_tvb;
 442
 443         if (check_col(pinfo->cinfo, COL_PROTOCOL)) {
 444                 col_set_str(pinfo->cinfo, COL_PROTOCOL, "LLC");
 445         }
 446         if (check_col(pinfo->cinfo, COL_INFO)) {
 447                 col_clear(pinfo->cinfo, COL_INFO);
 448         }
 449
 450         dsap = tvb_get_guint8(tvb, 0);
 451         if (tree) {
 452                 ti = proto_tree_add_item(tree, proto_llc, tvb, 0, -1, FALSE);
 453                 llc_tree = proto_item_add_subtree(ti, ett_llc);
 454                 proto_tree_add_uint(llc_tree, hf_llc_dsap, tvb, 0,
 455                         1, dsap & SAP_MASK);
 456                 proto_tree_add_boolean(llc_tree, hf_llc_dsap_ig, tvb, 0,
 457                         1, dsap & DSAP_GI_BIT);
 458         } else
 459                 llc_tree = NULL;
 460
 461         ssap = tvb_get_guint8(tvb, 1);
 462         if (tree) {
 463                 proto_tree_add_uint(llc_tree, hf_llc_ssap, tvb, 1,
 464                         1, ssap & SAP_MASK);
 465                 proto_tree_add_boolean(llc_tree, hf_llc_ssap_cr, tvb, 1,
 466                         1, ssap & SSAP_CR_BIT);
 467         } else
 468                 llc_tree = NULL;
 469
 470         is_snap = (dsap == SAP_SNAP) && (ssap == SAP_SNAP);
 471         llc_header_len = 2;     /* DSAP + SSAP */
 472
 473         /*
 474          * XXX - the page referred to in the comment above about the
 475          * Command/Response bit also implies that LLC Type 2 always
 476          * uses extended operation, so we don't need to determine
 477          * whether it's basic or extended operation; is that the case?
 478          */
 479         control = dissect_xdlc_control(tvb, 2, pinfo, llc_tree,
 480                                 hf_llc_ctrl, ett_llc_ctrl,
 481                                 &llc_cf_items, &llc_cf_items_ext,
 482                                 NULL, NULL, ssap & SSAP_CR_BIT, TRUE, FALSE);
 483         llc_header_len += XDLC_CONTROL_LEN(control, TRUE);
 484         if (is_snap)
 485                 llc_header_len += 5;    /* 3 bytes of OUI, 2 bytes of protocol ID */
 486
 487         if (tree)
 488                 proto_item_set_len(ti, llc_header_len);
 489
 490         if (is_snap) {
 491                 dissect_snap(tvb, 3, pinfo, tree, llc_tree, control,
 492                     hf_llc_oui, hf_llc_type, hf_llc_pid, 2);
 493         }
 494         else {
 495                 if (check_col(pinfo->cinfo, COL_INFO)) {
 496                         col_append_fstr(pinfo->cinfo, COL_INFO,
 497                             "; DSAP %s %s, SSAP %s %s",
 498                             val_to_str(dsap & SAP_MASK, sap_vals, "0x%02x"),
 499                             dsap & DSAP_GI_BIT ?
 500                               "Group" : "Individual",
 501                             val_to_str(ssap & SAP_MASK, sap_vals, "0x%02x"),
 502                             ssap & SSAP_CR_BIT ?
 503                               "Response" : "Command"
 504                         );
 505                 }
 506
 507                 if (tvb_length_remaining(tvb, llc_header_len) > 0) {
 508                         next_tvb = tvb_new_subset(tvb, llc_header_len, -1, -1);
 509                         if (XDLC_IS_INFORMATION(control)) {
 510                                 /*
 511                                  * Non-SNAP I or UI frame.
 512                                  * Try the regular LLC subdissector table
 513                                  * with the DSAP.
 514                                  */
 515                                 if (!dissector_try_port(subdissector_table,
 516                                     dsap, next_tvb, pinfo, tree)) {
 517                                         call_dissector(data_handle, next_tvb,
 518                                             pinfo, tree);
 519                                 }
 520                         } else if ((control & (XDLC_U_MODIFIER_MASK|XDLC_U))
 521                             == (XDLC_XID|XDLC_U)) {
 522                                 /*
 523                                  * Non-SNAP XID frame.
 524                                  * Test for LLC basic format first
 525                                  */
 526                                 format = tvb_get_guint8(next_tvb, 0);
 527                                 if (format == 0x81) {
 528                                     dissect_basicxid(next_tvb, pinfo, tree);
 529                                 } else {
 530                                 /*
 531                                  * Try the XID LLC subdissector table
 532                                  * with the DSAP.
 533                                  */
 534                                     if (!dissector_try_port(
 535                                         xid_subdissector_table, dsap, next_tvb,
 536                                         pinfo, tree)) {
 537                                             call_dissector(data_handle,
 538                                                 next_tvb, pinfo, tree);
 539                                     }
 540                                 }
 541                         } else {
 542                                 call_dissector(data_handle, next_tvb, pinfo,
 543                                     tree);
 544                         }
 545                 }
 546         }
 547 }
 548
 549 /*
 550  * Dissect SNAP header; used elsewhere, e.g. in the Frame Relay dissector.
 551  */
 552 void
 553 dissect_snap(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree,
 554     proto_tree *snap_tree, int control, int hf_oui, int hf_type, int hf_pid,
 555     int bridge_pad)
 556 {
 557         guint32         oui;
 558         guint16         etype;
 559         tvbuff_t        *next_tvb;
 560         oui_info_t      *oui_info;
 561         dissector_table_t subdissector_table;
 562         int             hf;
 563
 564         /*
 565          * XXX - what about non-UI frames?
 566          */
 567         oui =   tvb_get_ntoh24(tvb, offset);
 568         etype = tvb_get_ntohs(tvb, offset+3);
 569
 570         if (check_col(pinfo->cinfo, COL_INFO)) {
 571                 col_append_fstr(pinfo->cinfo, COL_INFO,
 572                     "; SNAP, OUI 0x%06X (%s), PID 0x%04X",
 573                     oui, val_to_str(oui, oui_vals, "Unknown"), etype);
 574         }
 575         if (tree) {
 576                 proto_tree_add_uint(snap_tree, hf_oui, tvb, offset, 3, oui);
 577         }
 578
 579         switch (oui) {
 580
 581         case OUI_ENCAP_ETHER:
 582         case OUI_CISCO_90:
 583         case OUI_APPLE_ATALK:
 584                 /* No, I have no idea why Apple used
 585                    one of their own OUIs, rather than
 586                    OUI_ENCAP_ETHER, and an Ethernet
 587                    packet type as protocol ID, for
 588                    AppleTalk data packets - but used
 589                    OUI_ENCAP_ETHER and an Ethernet
 590                    packet type for AARP packets. */
 591                 if (XDLC_IS_INFORMATION(control)) {
 592                         ethertype(etype, tvb, offset+5,
 593                             pinfo, tree, snap_tree, hf_type, -1, 0);
 594                 } else {
 595                         next_tvb = tvb_new_subset(tvb, offset+5, -1, -1);
 596                         call_dissector(data_handle,next_tvb, pinfo, tree);
 597                 }
 598                 break;
 599
 600         case OUI_BRIDGED:
 601                 /*
 602                  * MAC frames bridged over ATM (RFC 2684) or Frame Relay
 603                  * (RFC 2427).
 604                  *
 605                  * We have to figure out how much padding to put
 606                  * into the frame.  We were handed a "bridge_pad"
 607                  * argument which should be 0 for Frame Relay and
 608                  * 2 for ATM; we add to that the amount of padding
 609                  * common to both bridging types.
 610                  */
 611                 if (tree) {
 612                         proto_tree_add_uint(snap_tree, hf_pid, tvb, offset+3, 2,
 613                             etype);
 614                 }
 615
 616                 switch (etype) {
 617
 618                 case BPID_ETH_WITH_FCS:
 619                         next_tvb = tvb_new_subset(tvb, offset+5+bridge_pad,
 620                             -1, -1);
 621                         call_dissector(eth_withfcs_handle, next_tvb, pinfo,
 622                             tree);
 623                         break;
 624
 625                 case BPID_ETH_WITHOUT_FCS:
 626                         next_tvb = tvb_new_subset(tvb, offset+5+bridge_pad,
 627                             -1, -1);
 628                         call_dissector(eth_withoutfcs_handle, next_tvb, pinfo, tree);
 629                         break;
 630
 631                 case BPID_802_5_WITH_FCS:
 632                 case BPID_802_5_WITHOUT_FCS:
 633                         /*
 634                          * We treat the last padding byte as the Access
 635                          * Control byte, as that's what the Token
 636                          * Ring dissector expects the first byte to
 637                          * be.
 638                          */
 639                         next_tvb = tvb_new_subset(tvb, offset+5+bridge_pad,
 640                             -1, -1);
 641                         call_dissector(tr_handle, next_tvb, pinfo, tree);
 642                         break;
 643
 644                 case BPID_FDDI_WITH_FCS:
 645                 case BPID_FDDI_WITHOUT_FCS:
 646                         next_tvb = tvb_new_subset(tvb, offset+5+1+bridge_pad,
 647                             -1, -1);
 648                         call_dissector(fddi_handle, next_tvb, pinfo, tree);
 649                         break;
 650
 651                 case BPID_BPDU:
 652                         next_tvb = tvb_new_subset(tvb, offset+5, -1, -1);
 653                         call_dissector(bpdu_handle, next_tvb, pinfo, tree);
 654                         break;
 655
 656                 default:
 657                         next_tvb = tvb_new_subset(tvb, offset+5, -1, -1);
 658                         call_dissector(data_handle,next_tvb, pinfo, tree);
 659                         break;
 660                 }
 661                 break;
 662
 663         case OUI_CABLE_BPDU:    /* DOCSIS cable modem spanning tree BPDU */
 664                 if (tree) {
 665                         proto_tree_add_uint(snap_tree, hf_pid, tvb, offset+3, 2,
 666                             etype);
 667                 }
 668                 next_tvb = tvb_new_subset(tvb, offset+5, -1, -1);
 669                 call_dissector(bpdu_handle, next_tvb, pinfo, tree);
 670                 break;
 671
 672         default:
 673                 /*
 674                  * Do we have information for this OUI?
 675                  */
 676                 if (oui_info_table != NULL &&
 677                     (oui_info =
 678                      g_hash_table_lookup(oui_info_table,
 679                       GUINT_TO_POINTER(oui))) != NULL) {
 680                         /*
 681                          * Yes - use it.
 682                          */
 683                         hf = *oui_info->field_info->p_id;
 684                         subdissector_table = oui_info->table;
 685                 } else {
 686                         /*
 687                          * No, use hf_pid for the PID and just dissect
 688                          * the payload as data.
 689                          */
 690                         hf = hf_pid;
 691                         subdissector_table = NULL;
 692                 }
 693                 if (tree) {
 694                         proto_tree_add_uint(snap_tree, hf, tvb, offset+3, 2,
 695                             etype);
 696                 }
 697                 next_tvb = tvb_new_subset(tvb, offset+5, -1, -1);
 698                 if (XDLC_IS_INFORMATION(control)) {
 699                         if (subdissector_table != NULL) {
 700                                 /* do lookup with the subdissector table */
 701                                 if (dissector_try_port(subdissector_table,
 702                                     etype, next_tvb, pinfo, tree))
 703                                         break;
 704                         }
 705                 }
 706                 call_dissector(data_handle, next_tvb, pinfo, tree);
 707                 break;
 708         }
 709 }
 710
 711 void
 712 proto_register_llc(void)
 713 {
 714         static struct true_false_string ig_bit = { "Group", "Individual" };
 715         static struct true_false_string cr_bit = { "Response", "Command" };
 716
 717         static hf_register_info hf[] = {
 718                 { &hf_llc_dsap,
 719                 { "DSAP",       "llc.dsap", FT_UINT8, BASE_HEX,
 720                         VALS(sap_vals), 0x0, "DSAP - 7 Most Significant Bits only", HFILL }},
 721
 722                 { &hf_llc_dsap_ig,
 723                 { "IG Bit",     "llc.dsap.ig", FT_BOOLEAN, BASE_HEX,
 724                         &ig_bit, 0x0, "Individual/Group - Least Significant Bit only", HFILL }},
 725
 726                 { &hf_llc_ssap,
 727                 { "SSAP", "llc.ssap", FT_UINT8, BASE_HEX,
 728                         VALS(sap_vals), 0x0, "SSAP - 7 Most Significant Bits only", HFILL }},
 729
 730                 { &hf_llc_ssap_cr,
 731                 { "CR Bit", "llc.ssap.cr", FT_BOOLEAN, BASE_HEX,
 732                         &cr_bit, 0x0, "Command/Response - Least Significant Bit only", HFILL }},
 733
 734                 { &hf_llc_ctrl,
 735                 { "Control", "llc.control", FT_UINT16, BASE_HEX,
 736                         NULL, 0x0, "", HFILL }},
 737
 738                 { &hf_llc_n_r,
 739                 { "N(R)", "llc.control.n_r", FT_UINT16, BASE_DEC,
 740                         NULL, XDLC_N_R_EXT_MASK, "", HFILL }},
 741
 742                 { &hf_llc_n_s,
 743                 { "N(S)", "llc.control.n_s", FT_UINT16, BASE_DEC,
 744                         NULL, XDLC_N_S_EXT_MASK, "", HFILL }},
 745
 746                 { &hf_llc_p,
 747                 { "Poll", "llc.control.p", FT_BOOLEAN, 8,
 748                         TFS(&flags_set_truth), XDLC_P_F, "", HFILL }},
 749
 750                 { &hf_llc_p_ext,
 751                 { "Poll", "llc.control.p", FT_BOOLEAN, 16,
 752                         TFS(&flags_set_truth), XDLC_P_F_EXT, "", HFILL }},
 753
 754                 { &hf_llc_f,
 755                 { "Final", "llc.control.f", FT_BOOLEAN, 8,
 756                         TFS(&flags_set_truth), XDLC_P_F, "", HFILL }},
 757
 758                 { &hf_llc_f_ext,
 759                 { "Final", "llc.control.f", FT_BOOLEAN, 16,
 760                         TFS(&flags_set_truth), XDLC_P_F_EXT, "", HFILL }},
 761
 762                 { &hf_llc_s_ftype,
 763                 { "Supervisory frame type", "llc.control.s_ftype", FT_UINT16, BASE_HEX,
 764                         VALS(stype_vals), XDLC_S_FTYPE_MASK, "", HFILL }},
 765
 766                 { &hf_llc_u_modifier_cmd,
 767                 { "Command", "llc.control.u_modifier_cmd", FT_UINT8, BASE_HEX,
 768                         VALS(modifier_vals_cmd), XDLC_U_MODIFIER_MASK, "", HFILL }},
 769
 770                 { &hf_llc_u_modifier_resp,
 771                 { "Response", "llc.control.u_modifier_resp", FT_UINT8, BASE_HEX,
 772                         VALS(modifier_vals_resp), XDLC_U_MODIFIER_MASK, "", HFILL }},
 773
 774                 { &hf_llc_ftype_i,
 775                 { "Frame type", "llc.control.ftype", FT_UINT16, BASE_HEX,
 776                         VALS(ftype_vals), XDLC_I_MASK, "", HFILL }},
 777
 778                 { &hf_llc_ftype_s_u,
 779                 { "Frame type", "llc.control.ftype", FT_UINT8, BASE_HEX,
 780                         VALS(ftype_vals), XDLC_S_U_MASK, "", HFILL }},
 781
 782                 { &hf_llc_ftype_s_u_ext,
 783                 { "Frame type", "llc.control.ftype", FT_UINT16, BASE_HEX,
 784                         VALS(ftype_vals), XDLC_S_U_MASK, "", HFILL }},
 785
 786                 /* registered here but handled in ethertype.c */
 787                 { &hf_llc_type,
 788                 { "Type", "llc.type", FT_UINT16, BASE_HEX,
 789                         VALS(etype_vals), 0x0, "", HFILL }},
 790
 791                 { &hf_llc_oui,
 792                 { "Organization Code",  "llc.oui", FT_UINT24, BASE_HEX,
 793                         VALS(oui_vals), 0x0, "", HFILL }},
 794
 795                 { &hf_llc_pid,
 796                 { "Protocol ID", "llc.pid", FT_UINT16, BASE_HEX,
 797                         NULL, 0x0, "", HFILL }},
 798         };
 799         static gint *ett[] = {
 800                 &ett_llc,
 801                 &ett_llc_ctrl,
 802         };
 803
 804         proto_llc = proto_register_protocol("Logical-Link Control", "LLC", "llc");
 805         proto_register_field_array(proto_llc, hf, array_length(hf));
 806         proto_register_subtree_array(ett, array_length(ett));
 807
 808 /* subdissector code */
 809         subdissector_table = register_dissector_table("llc.dsap",
 810           "LLC SAP", FT_UINT8, BASE_HEX);
 811         xid_subdissector_table = register_dissector_table("llc.xid_dsap",
 812           "LLC XID SAP", FT_UINT8, BASE_HEX);
 813
 814         register_dissector("llc", dissect_llc, proto_llc);
 815 }
 816
 817 void
 818 proto_register_basicxid(void)
 819 {
 820         static hf_register_info hf[] = {
 821                 { &hf_llc_xid_format,
 822                 { "XID Format", "llc.xid.format", FT_UINT8, BASE_HEX,
 823                         VALS(format_vals), 0x0, "", HFILL }},
 824
 825                 { &hf_llc_xid_types,
 826                 { "LLC Types/Classes", "llc.xid.types", FT_UINT8, BASE_HEX,
 827                         VALS(type_vals), 0x0, "", HFILL }},
 828
 829                 { &hf_llc_xid_wsize,
 830                 { "Receive Window Size", "llc.xid.wsize", FT_UINT8, BASE_DEC,
 831                         NULL, 0x0, "", HFILL }},
 832         };
 833         static gint *ett[] = {
 834                 &ett_llc_basicxid,
 835         };
 836
 837         proto_basicxid = proto_register_protocol("Logical-Link Control Basic Format XID", "Basic Format XID", "basicxid");
 838         proto_register_field_array(proto_basicxid, hf, array_length(hf));
 839         proto_register_subtree_array(ett, array_length(ett));
 840
 841         register_dissector("basicxid", dissect_basicxid, proto_basicxid);
 842 }
 843
 844 static void
 845 register_hf(gpointer key _U_, gpointer value, gpointer user_data _U_)
 846 {
 847         oui_info_t *info = value;
 848
 849         proto_register_field_array(proto_llc, info->field_info, 1);
 850 }
 851
 852 void
 853 proto_reg_handoff_llc(void)
 854 {
 855         dissector_handle_t llc_handle;
 856
 857         /*
 858          * Get handles for the BPDU, Ethernet, FDDI, and Token Ring
 859          * dissectors.
 860          */
 861         bpdu_handle = find_dissector("bpdu");
 862         eth_withoutfcs_handle = find_dissector("eth_withoutfcs");
 863         eth_withfcs_handle = find_dissector("eth_withfcs");
 864         fddi_handle = find_dissector("fddi");
 865         tr_handle = find_dissector("tr");
 866         data_handle = find_dissector("data");
 867
 868         llc_handle = find_dissector("llc");
 869         dissector_add("wtap_encap", WTAP_ENCAP_ATM_RFC1483, llc_handle);
 870         /* RFC 2043 */
 871         dissector_add("ppp.protocol", PPP_LLC, llc_handle);
 872         /* RFC 2353 */
 873         dissector_add("udp.port", UDP_PORT_LLC1, llc_handle);
 874         dissector_add("udp.port", UDP_PORT_LLC2, llc_handle);
 875         dissector_add("udp.port", UDP_PORT_LLC3, llc_handle);
 876         dissector_add("udp.port", UDP_PORT_LLC4, llc_handle);
 877         dissector_add("udp.port", UDP_PORT_LLC5, llc_handle);
 878         /* IP-over-FC when we have the full FC frame */
 879         dissector_add("fc.ftype", FC_FTYPE_IP, llc_handle);
 880
 881         /*
 882          * BACNET-over-ARCNET is really BACNET-over-802.2 LLC-over-ARCNET,
 883          * apparently.
 884          */
 885         dissector_add("arcnet.protocol_id", ARCNET_PROTO_BACNET, llc_handle);
 886
 887         /*
 888          * Register all the fields for PIDs for various OUIs.
 889          */
 890         if (oui_info_table != NULL)
 891                 g_hash_table_foreach(oui_info_table, register_hf, NULL);
 892 }