packet-l2tp.c

   1 /* packet-l2tp.c
   2  * Routines for Layer Two Tunnelling Protocol (L2TP) (RFC 2661) packet
   3  * disassembly
   4  * John Thomes <john@ensemblecom.com>
   5  *
   6  * Minor changes by: (2000-01-10)
   7  * Laurent Cazalet <laurent.cazalet@mailclub.net>
   8  * Thomas Parvais <thomas.parvais@advalvas.be>
   9  *
  10  * $Id: packet-l2tp.c,v 1.27 2001/10/29 21:13:07 guy Exp $
  11  *
  12  * Ethereal - Network traffic analyzer
  13  * By Gerald Combs <gerald@ethereal.com>
  14  * Copyright 1998 Gerald Combs
  15  *
  16  * This program is free software; you can redistribute it and/or
  17  * modify it under the terms of the GNU General Public License
  18  * as published by the Free Software Foundation; either version 2
  19  * of the License, or (at your option) any later version.
  20  *
  21  * This program is distributed in the hope that it will be useful,
  22  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  23  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  24  * GNU General Public License for more details.
  25  *
  26  * You should have received a copy of the GNU General Public License
  27  * along with this program; if not, write to the Free Software
  28  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  29  */
  30
  31
  32 static int proto_l2tp = -1;
  33 static int hf_l2tp_type = -1;
  34 static int hf_l2tp_length_bit = -1;
  35 static int hf_l2tp_seq_bit = -1;
  36 static int hf_l2tp_offset_bit = -1;
  37 static int hf_l2tp_priority = -1;
  38 static int hf_l2tp_version = -1;
  39 static int hf_l2tp_length = -1;
  40 static int hf_l2tp_tunnel = -1;
  41 static int hf_l2tp_session = -1;
  42 static int hf_l2tp_Ns = -1;
  43 static int hf_l2tp_Nr = -1;
  44 static int hf_l2tp_offset = -1;
  45 static int hf_l2tp_avp_mandatory = -1;
  46 static int hf_l2tp_avp_hidden = -1;
  47 static int hf_l2tp_avp_length = -1;
  48 static int hf_l2tp_avp_vendor_id = -1;
  49 static int hf_l2tp_avp_type = -1;
  50 static int hf_l2tp_tie_breaker = -1;
  51
  52 #ifdef HAVE_CONFIG_H
  53 #include "config.h"
  54 #endif
  55
  56 #ifdef HAVE_SYS_TYPES_H
  57 # include <sys/types.h>
  58 #endif
  59
  60 #ifdef HAVE_NETINET_IN_H
  61 #include <netinet/in.h>
  62 #endif
  63
  64 #include <stdio.h>
  65 #include <stdlib.h>
  66 #include <string.h>
  67 #include <ctype.h>
  68 #include <glib.h>
  69 #include "packet.h"
  70 #include "resolv.h"
  71
  72 #define UDP_PORT_L2TP   1701
  73
  74 #define CONTROL_BIT(msg_info) (msg_info & 0x8000)   /* Type bit control = 1 data = 0 */
  75 #define LENGTH_BIT(msg_info) (msg_info & 0x4000)    /* Length bit = 1  */
  76 #define RESERVE_BITS(msg_info) (msg_info &0x37F8)   /* Reserved bit - usused */
  77 #define SEQUENCE_BIT(msg_info) (msg_info & 0x0800)  /* SEQUENCE bit = 1 Ns and Nr fields */
  78 #define OFFSET_BIT(msg_info) (msg_info & 0x0200)    /* Offset */
  79 #define PRIORITY_BIT(msg_info) (msg_info & 0x0100)  /* Priority */
  80 #define L2TP_VERSION(msg_info) (msg_info & 0x000f)  /* Version of l2tp */
  81 #define MANDATORY_BIT(msg_info) (msg_info & 0x8000) /* Mandatory = 1 */
  82 #define HIDDEN_BIT(msg_info) (msg_info & 0x4000)    /* Hidden = 1 */
  83 #define AVP_LENGTH(msg_info) (msg_info & 0x03ff)    /* AVP Length */
  84 #define FRAMING_SYNC(msg_info)  (msg_info & 0x0001) /* SYNC Framing Type */
  85 #define FRAMING_ASYNC(msg_info) (msg_info & 0x0002) /* ASYNC Framing Type */
  86 #define BEARER_DIGITAL(msg_info) (msg_info & 0x0001) /* Digital Bearer Type */
  87 #define BEARER_ANALOG(msg_info) (msg_info & 0x0002) /* Analog Bearer Type */
  88
  89 static gint ett_l2tp = -1;
  90 static gint ett_l2tp_ctrl = -1;
  91 static gint ett_l2tp_avp = -1;
  92
  93 #define AVP_SCCRQ      1
  94 #define AVP_SCCRP      2
  95 #define AVP_SCCCN      3
  96 #define AVP_StopCCN    4
  97 #define AVP_Reserved   5
  98 #define AVP_HELLO      6
  99 #define AVP_OCRQ       7
 100 #define AVP_OCRP       8
 101 #define AVP_ORCRP      9
 102 #define AVP_ICRQ      10
 103 #define AVP_ICRP      11
 104 #define AVP_ICCN      12
 105 #define AVP_Reserved1 13
 106 #define AVP_CDN       14
 107
 108
 109 #define NUM_CONTROL_CALL_TYPES  16
 110 static const char *calltypestr[NUM_CONTROL_CALL_TYPES+1] = {
 111   "Unknown Call Type           ",
 112   "Start_Control_Request       ",
 113   "Start_Control_Reply         ",
 114   "Start_Control_Connected     ",
 115   "Stop_Control_Notification   ",
 116   "Reserved                    ",
 117   "Hello                       ",
 118   "Outgoing_Call_Request       ",
 119   "Outgoing_Call_Reply         ",
 120   "Outgoing_Call_Connected     ",
 121   "Incoming_Call_Request       ",
 122   "Incoming_Call_Reply         ",
 123   "Incoming_Call_Connected     ",
 124   "Reserved                    ",
 125   "Call_Disconnect_Notification",
 126   "WAN_Error_Notify            ",
 127   "Set_Link_Info               ",
 128 };
 129
 130 static const char *calltype_short_str[NUM_CONTROL_CALL_TYPES+1] = {
 131   "Unknown ",
 132   "SCCRQ   ",
 133   "SCCRP   ",
 134   "SCCCN   ",
 135   "StopCCN ",
 136   "Reserved",
 137   "Hello   ",
 138   "OCRQ    ",
 139   "OCRP    ",
 140   "OCCN    ",
 141   "ICRQ    ",
 142   "ICRP    ",
 143   "ICCN    ",
 144   "Reserved",
 145   "CDN     ",
 146   "WEN     ",
 147   "SLI     ",
 148 };
 149
 150
 151 static const char *control_msg  = "Control Message";
 152 static const char *data_msg     = "Data    Message";
 153 static const value_string l2tp_type_vals[] = {
 154         { 0, "Data Message" },
 155         { 1, "Control Message" },
 156         { 0, NULL },
 157 };
 158
 159 static const value_string cause_code_direction_vals[] = {
 160         { 0, "global error" },
 161         { 1, "at peer" },
 162         { 2, "at local" },
 163         { 0, NULL },
 164 };
 165
 166 static const true_false_string l2tp_length_bit_truth =
 167         { "Length field is present", "Length field is not present" };
 168
 169 static const true_false_string l2tp_seq_bit_truth =
 170         { "Ns and Nr fields are present", "Ns and Nr fields are not present" };
 171
 172 static const true_false_string l2tp_offset_bit_truth =
 173         { "Offset Size field is present", "Offset size field is not present" };
 174
 175 static const true_false_string l2tp_priority_truth =
 176         { "This data message has priority", "No priority" };
 177
 178 static const value_string authen_type_vals[] = {
 179   { 0, "Reserved" },
 180   { 1, "Textual username and password" },
 181   { 2, "PPP CHAP" },
 182   { 3, "PPP PAP" },
 183   { 4, "No Authentication" },
 184   { 5, "Microsoft CHAP Version 1" },
 185   { 0, NULL }
 186 };
 187
 188 #define  CONTROL_MESSAGE  0
 189 #define  RESULT_ERROR_CODE 1
 190 #define  PROTOCOL_VERSION  2
 191 #define  FRAMING_CAPABILITIES 3
 192 #define  BEARER_CAPABILITIES 4
 193 #define  TIE_BREAKER 5
 194 #define  FIRMWARE_REVISION 6
 195 #define  HOST_NAME 7
 196 #define  VENDOR_NAME 8
 197 #define  ASSIGNED_TUNNEL_ID 9
 198 #define  RECEIVE_WINDOW_SIZE 10
 199 #define  CHALLENGE 11
 200 #define  CAUSE_CODE 12
 201 #define  CHALLENGE_RESPONSE 13
 202 #define  ASSIGNED_SESSION 14
 203 #define  CALL_SERIAL_NUMBER 15
 204 #define  MINIMUM_BPS 16
 205 #define  MAXIMUM_BPS 17
 206 #define  BEARER_TYPE 18
 207 #define  FRAMING_TYPE 19
 208 #define  CALLED_NUMBER 21
 209 #define  CALLING_NUMBER 22
 210 #define  SUB_ADDRESS 23
 211 #define  TX_CONNECT_SPEED 24
 212 #define  PHYSICAL_CHANNEL 25
 213 #define  INITIAL_RECEIVED_LCP 26
 214 #define  LAST_SEND_LCP_CONFREQ 27
 215 #define  LAST_RECEIVED_LCP_CONFREQ 28
 216 #define  PROXY_AUTHEN_TYPE 29
 217 #define  PROXY_AUTHEN_NAME 30
 218 #define  PROXY_AUTHEN_CHALLENGE 31
 219 #define  PROXY_AUTHEN_ID 32
 220 #define  PROXY_AUTHEN_RESPONSE 33
 221 #define  CALL_STATUS_AVPS 34
 222 #define  ACCM 35
 223 #define  RANDOM_VECTOR 36
 224 #define  PRIVATE_GROUP_ID 37
 225 #define  RX_CONNECT_SPEED 38
 226 #define  SEQUENCING_REQUIRED 39
 227 #define  PPP_DISCONNECT_CAUSE_CODE 46   /* RFC 3145 */
 228
 229 #define NUM_AVP_TYPES  40
 230 static const value_string avp_type_vals[] = {
 231   { CONTROL_MESSAGE,           "Control Message" },
 232   { RESULT_ERROR_CODE,         "Result-Error Code" },
 233   { PROTOCOL_VERSION,          "Protocol Version" },
 234   { FRAMING_CAPABILITIES,      "Framing Capabilities" },
 235   { BEARER_CAPABILITIES,       "Bearer Capabilities" },
 236   { TIE_BREAKER,               "Tie Breaker" },
 237   { FIRMWARE_REVISION,         "Firmware Revision" },
 238   { HOST_NAME,                 "Host Name" },
 239   { VENDOR_NAME,               "Vendor Name" },
 240   { ASSIGNED_TUNNEL_ID,        "Assigned Tunnel ID" },
 241   { RECEIVE_WINDOW_SIZE,       "Receive Window Size" },
 242   { CHALLENGE,                 "Challenge" },
 243   { CAUSE_CODE,                "Cause Code" },
 244   { CHALLENGE_RESPONSE,        "Challenge Response" },
 245   { ASSIGNED_SESSION,          "Assigned Session" },
 246   { CALL_SERIAL_NUMBER,        "Call Serial Number" },
 247   { MINIMUM_BPS,               "Minimum BPS" },
 248   { MAXIMUM_BPS,               "Maximum BPS" },
 249   { BEARER_TYPE,               "Bearer Type" },
 250   { FRAMING_TYPE,              "Framing Type" },
 251   { CALLED_NUMBER,             "Called Number" },
 252   { CALLING_NUMBER,            "Calling Number" },
 253   { SUB_ADDRESS,               "Sub-Address" },
 254   { TX_CONNECT_SPEED,          "Connect Speed" },
 255   { PHYSICAL_CHANNEL,          "Physical Channel" },
 256   { INITIAL_RECEIVED_LCP,      "Initial Received LCP" },
 257   { LAST_SEND_LCP_CONFREQ,     "Last Send LCP CONFREQ" },
 258   { LAST_RECEIVED_LCP_CONFREQ, "Last Received LCP CONFREQ" },
 259   { PROXY_AUTHEN_TYPE,         "Proxy Authen Type" },
 260   { PROXY_AUTHEN_NAME,         "Proxy Authen Name" },
 261   { PROXY_AUTHEN_CHALLENGE,    "Proxy Authen Challenge" },
 262   { PROXY_AUTHEN_ID,           "Proxy Authen ID" },
 263   { PROXY_AUTHEN_RESPONSE,     "Proxy Authen Response" },
 264   { CALL_STATUS_AVPS,          "Call status AVPs" },
 265   { ACCM,                      "ACCM" },
 266   { RANDOM_VECTOR,             "Random Vector" },
 267   { PRIVATE_GROUP_ID,          "Private group ID" },
 268   { RX_CONNECT_SPEED,          "RxConnect Speed" },
 269   { SEQUENCING_REQUIRED,       "Sequencing Required" },
 270   { PPP_DISCONNECT_CAUSE_CODE, "PPP Disconnect Cause Code" },
 271   { 0,                         NULL }
 272 };
 273
 274 /*
 275  * These are SMI Network Management Private Enterprise Codes for
 276  * organizations; see
 277  *
 278  *      http://www.isi.edu/in-notes/iana/assignments/enterprise-numbers
 279  *
 280  * for a list.
 281  */
 282 #define VENDOR_IETF 0
 283 #define VENDOR_ACC 5
 284 #define VENDOR_CISCO 9
 285 #define VENDOR_SHIVA 166
 286 #define VENDOR_LIVINGSTON 307
 287 #define VENDOR_3COM 429
 288 #define VENDOR_ASCEND 529
 289 #define VENDOR_BAY 1584
 290 #define VENDOR_JUNIPER 2636
 291 #define VENDOR_COSINE 3085
 292 #define VENDOR_UNISPHERE 4874
 293
 294 static const value_string avp_vendor_id_vals[] =
 295 {{VENDOR_IETF,"IETF"},
 296 {VENDOR_ACC,"ACC"},
 297 {VENDOR_CISCO,"Cisco"},
 298 {VENDOR_SHIVA,"Shiva"},
 299 {VENDOR_LIVINGSTON,"Livingston"},
 300 {VENDOR_3COM,"3Com"},
 301 {VENDOR_ASCEND,"Ascend"},
 302 {VENDOR_BAY,"Bay Networks"},
 303 {VENDOR_JUNIPER,"Juniper Networks"},
 304 {VENDOR_COSINE,"CoSine Communications"},
 305 {VENDOR_UNISPHERE,"Unisphere Networks"},
 306 {0,NULL}};
 307
 308 static gchar textbuffer[200];
 309
 310 static dissector_handle_t ppp_hdlc_handle;
 311
 312 static void
 313 dissect_l2tp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 314 {
 315   proto_tree *l2tp_tree=NULL, *l2tp_avp_tree, *ctrl_tree;
 316   proto_item *ti, *tf;
 317   int rhcode;
 318   int index = 0;
 319   int tmp_index;
 320   int proto_length = 0;
 321   guint16 length = 0;           /* Length field */
 322   guint16 tid;                  /* Tunnel ID */
 323   guint16 cid;                  /* Call ID */
 324   guint16 offset_size;          /* Offset size */
 325   guint16 ver_len_hidden;
 326   guint16 avp_vendor_id;
 327   guint16 avp_type;
 328   guint16 msg_type;
 329   guint16 avp_len;
 330   guint16 result_code;
 331   guint16 error_code;
 332   guint32 bits;
 333   guint16 firmware_rev;
 334   guint16       control;
 335   tvbuff_t      *next_tvb;
 336
 337   if (check_col(pinfo->fd, COL_PROTOCOL))       /* build output for closed L2tp frame displayed  */
 338         col_set_str(pinfo->fd, COL_PROTOCOL, "L2TP");
 339   if (check_col(pinfo->fd, COL_INFO))
 340         col_clear(pinfo->fd, COL_INFO);
 341
 342   control = tvb_get_ntohs(tvb, 0);
 343
 344   if (L2TP_VERSION(control) != 2) {
 345           if (check_col(pinfo->fd, COL_INFO)) {
 346                 col_add_fstr(pinfo->fd, COL_INFO, "L2TP Version %u", L2TP_VERSION(control) );
 347           }
 348           return;
 349   }
 350
 351   rhcode= 10;
 352
 353   if (LENGTH_BIT(control)) {            /* length field included ? */
 354       index += 2;                       /* skip ahead */
 355       length = tvb_get_ntohs(tvb, index);
 356   }
 357
 358   /* collect the tunnel id & call id */
 359   index += 2;
 360   tid = tvb_get_ntohs(tvb, index);
 361   index += 2;
 362   cid = tvb_get_ntohs(tvb, index);
 363
 364   if (check_col(pinfo->fd, COL_INFO)) {
 365         if (CONTROL_BIT(control)) {
 366             /* CONTROL MESSAGE */
 367             tmp_index = index;
 368
 369               if ((LENGTH_BIT(control))&&(length==12))                  /* ZLB Message */
 370                   sprintf(textbuffer,"%s - ZLB      (tunnel id=%d, session id=%d)",
 371                           control_msg , tid ,cid);
 372               else
 373               {
 374                 if (SEQUENCE_BIT(control)) {
 375                     tmp_index += 4;
 376                 }
 377
 378                 tmp_index+=4;
 379
 380                 avp_type = tvb_get_ntohs(tvb, (tmp_index+=2));
 381
 382                 if (avp_type == CONTROL_MESSAGE)
 383                 {
 384                     /* We print message type */
 385                     msg_type = tvb_get_ntohs(tvb, (tmp_index+=2));
 386                     sprintf(textbuffer,"%s - %s (tunnel id=%d, session id=%d)",
 387                             control_msg ,
 388                             ((NUM_CONTROL_CALL_TYPES + 1 ) > msg_type) ?
 389                             calltype_short_str[msg_type] : "Unknown",
 390                             tid ,cid);
 391                 }
 392                 else
 393                 {
 394                     /*
 395                      * This is not a control message.
 396                      * We never pass here except in case of bad l2tp packet!
 397                      */
 398                     sprintf(textbuffer,"%s (tunnel id=%d, session id=%d)",
 399                             control_msg ,  tid ,cid);
 400
 401                 }
 402               }
 403         }
 404         else {
 405             /* DATA Message */
 406                sprintf(textbuffer,"%s            (tunnel id=%d, session id=%d)",
 407                        data_msg, tid ,cid);
 408         }
 409         col_add_fstr(pinfo->fd,COL_INFO,textbuffer);
 410   }
 411
 412   if (LENGTH_BIT(control)) {
 413         proto_length = length;
 414   }
 415   else {
 416         proto_length = tvb_length(tvb);
 417   }
 418
 419   if (tree) {
 420         ti = proto_tree_add_item(tree,proto_l2tp, tvb, 0, proto_length, FALSE);
 421         l2tp_tree = proto_item_add_subtree(ti, ett_l2tp);
 422
 423         ti = proto_tree_add_text(l2tp_tree, tvb, 0, 2,
 424                         "Packet Type: %s Tunnel Id=%d Session Id=%d",
 425                         (CONTROL_BIT(control) ? control_msg : data_msg), tid, cid);
 426
 427         ctrl_tree = proto_item_add_subtree(ti, ett_l2tp_ctrl);
 428         proto_tree_add_uint(ctrl_tree, hf_l2tp_type, tvb, 0, 2, control);
 429         proto_tree_add_boolean(ctrl_tree, hf_l2tp_length_bit, tvb, 0, 2, control);
 430         proto_tree_add_boolean(ctrl_tree, hf_l2tp_seq_bit, tvb, 0, 2, control);
 431         proto_tree_add_boolean(ctrl_tree, hf_l2tp_offset_bit, tvb, 0, 2, control);
 432         proto_tree_add_boolean(ctrl_tree, hf_l2tp_priority, tvb, 0, 2, control);
 433         proto_tree_add_uint(ctrl_tree, hf_l2tp_version, tvb, 0, 2, control);
 434   }
 435   index = 2;
 436   if (LENGTH_BIT(control)) {
 437           if (tree) {
 438                 proto_tree_add_item(l2tp_tree, hf_l2tp_length, tvb, index, 2, FALSE);
 439           }
 440         index += 2;
 441   }
 442
 443   if (tree) {
 444         proto_tree_add_item(l2tp_tree, hf_l2tp_tunnel, tvb, index, 2, FALSE);
 445   }
 446   index += 2;
 447   if (tree) {
 448         proto_tree_add_item(l2tp_tree, hf_l2tp_session, tvb, index, 2, FALSE);
 449   }
 450   index += 2;
 451
 452   if (SEQUENCE_BIT(control)) {
 453           if (tree) {
 454                 proto_tree_add_item(l2tp_tree, hf_l2tp_Ns, tvb, index, 2, FALSE);
 455           }
 456           index += 2;
 457           if (tree) {
 458                 proto_tree_add_item(l2tp_tree, hf_l2tp_Nr, tvb, index, 2, FALSE);
 459           }
 460           index += 2;
 461   }
 462   if (OFFSET_BIT(control)) {
 463         offset_size = tvb_get_ntohs(tvb, index);
 464         if (tree) {
 465                 proto_tree_add_uint(l2tp_tree, hf_l2tp_offset, tvb, index, 2, FALSE);
 466         }
 467         index += 2;
 468         if (tree) {
 469                 proto_tree_add_text(l2tp_tree, tvb, index, offset_size, "Offset Padding");
 470         }
 471         index += offset_size;
 472   }
 473   if (tree && (LENGTH_BIT(control))&&(length==12)) {
 474             proto_tree_add_text(l2tp_tree, tvb, 0, 0, "Zero Length Bit message");
 475   }
 476
 477   if (!CONTROL_BIT(control)) {  /* Data Messages so we are done */
 478         /* If we have data, signified by having a length bit, dissect it */
 479         if (tvb_offset_exists(tvb, index)) {
 480                 next_tvb = tvb_new_subset(tvb, index, -1, proto_length - index);
 481                 call_dissector(ppp_hdlc_handle, next_tvb, pinfo, tree);
 482         }
 483         return;
 484   }
 485
 486   if (tree) {
 487         if (!LENGTH_BIT(control)) {
 488                 return;
 489         }
 490         while (index < length ) {    /* Process AVP's */
 491                 ver_len_hidden  = tvb_get_ntohs(tvb, index);
 492                 avp_len         = AVP_LENGTH(ver_len_hidden);
 493                 avp_vendor_id   = tvb_get_ntohs(tvb, index + 2);
 494                 avp_type        = tvb_get_ntohs(tvb, index + 4);
 495
 496                 if (avp_vendor_id == VENDOR_IETF) {
 497                         tf =  proto_tree_add_text(l2tp_tree, tvb, index,
 498                         avp_len, "%s AVP",
 499                         val_to_str(avp_type, avp_type_vals, "Unknown (%u)"));
 500                 } else {         /* Vendor-Specific AVP */
 501                         tf =  proto_tree_add_text(l2tp_tree, tvb, index,
 502                         avp_len, "Vendor %s AVP",
 503                         val_to_str(avp_vendor_id, avp_vendor_id_vals, "Unknown (%u)"));
 504                 }
 505
 506                 l2tp_avp_tree = proto_item_add_subtree(tf,  ett_l2tp_avp);
 507
 508                 proto_tree_add_boolean_format(l2tp_avp_tree,hf_l2tp_avp_mandatory, tvb, index, 1,
 509                                            rhcode, "Mandatory: %s",
 510                                            (MANDATORY_BIT(ver_len_hidden)) ? "True" : "False" );
 511                 proto_tree_add_boolean_format(l2tp_avp_tree,hf_l2tp_avp_hidden, tvb, index, 1,
 512                                            rhcode, "Hidden: %s",
 513                                            (HIDDEN_BIT(ver_len_hidden)) ? "True" : "False" );
 514                 proto_tree_add_uint_format(l2tp_avp_tree,hf_l2tp_avp_length, tvb, index, 2,
 515                                            rhcode, "Length: %u", avp_len);
 516                 if (HIDDEN_BIT(ver_len_hidden)) { /* don't try do display hidden */
 517                         index += avp_len;
 518                         continue;
 519                 }
 520
 521                 if (avp_len == 0) {
 522                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 0,
 523                           "AVP length must not be zero");
 524                         return;
 525                 }
 526                 index += 2;
 527                 avp_len -= 2;
 528
 529                 proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_vendor_id,
 530                     tvb, index, 2, FALSE);
 531                 index += 2;
 532                 avp_len -= 2;
 533
 534                 if (avp_vendor_id != VENDOR_IETF) {
 535                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 2,
 536                                             "Type: %u", avp_type);
 537                         index += 2;
 538                         avp_len -= 2;
 539
 540                         /* For the time being, we don't decode any Vendor-
 541                            specific AVP. */
 542                         proto_tree_add_text(l2tp_avp_tree, tvb, index,
 543                                             avp_len, "Vendor-Specific AVP");
 544
 545                         index += avp_len;
 546                         continue;
 547                 }
 548
 549                 proto_tree_add_uint(l2tp_avp_tree, hf_l2tp_avp_type,
 550                     tvb, index, 2, avp_type);
 551                 index += 2;
 552                 avp_len -= 2;
 553
 554                 switch (avp_type) {
 555
 556                 case CONTROL_MESSAGE:
 557                         msg_type = tvb_get_ntohs(tvb, index);
 558                         proto_tree_add_text(l2tp_avp_tree,tvb, index, 2,
 559                           "Control Message Type: (%u) %s", msg_type,
 560                           ((NUM_CONTROL_CALL_TYPES + 1 ) > msg_type) ?
 561                           calltypestr[msg_type] : "Unknown");
 562                         break;
 563
 564                 case RESULT_ERROR_CODE:
 565                         if (avp_len < 2)
 566                                 break;
 567                         result_code = tvb_get_ntohs(tvb, index);
 568                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 2,
 569                           "Result code: %u",  result_code);
 570                         index += 2;
 571                         avp_len -= 2;
 572
 573                         if (avp_len < 2)
 574                                 break;
 575                         error_code = tvb_get_ntohs(tvb, index);
 576                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 2,
 577                           "Error code: %u", error_code);
 578                         index += 2;
 579                         avp_len -= 2;
 580
 581                         if (avp_len == 0)
 582                                 break;
 583                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 584                           "Error Message: %.*s", avp_len,
 585                           tvb_get_ptr(tvb, index, avp_len));
 586                         break;
 587
 588                 case PROTOCOL_VERSION:
 589                         if (avp_len < 1)
 590                                 break;
 591                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 1,
 592                           "Version: %u", tvb_get_guint8(tvb, index));
 593                         index += 1;
 594                         avp_len -= 1;
 595
 596                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 1,
 597                           "Revision: %u", tvb_get_guint8(tvb, index));
 598                         break;
 599
 600                 case FRAMING_CAPABILITIES:
 601                         bits = tvb_get_ntohl(tvb, index);
 602                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 603                           "Async Framing Supported: %s",
 604                           (FRAMING_ASYNC(bits)) ? "True" : "False");
 605                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 606                           "Sync Framing Supported: %s",
 607                           (FRAMING_SYNC(bits)) ? "True" : "False");
 608                         break;
 609
 610                 case BEARER_CAPABILITIES:
 611                         bits = tvb_get_ntohl(tvb, index);
 612                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 613                           "Analog Access Supported: %s",
 614                           (BEARER_ANALOG(bits)) ? "True" : "False");
 615                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 616                           "Digital Access Supported: %s",
 617                           (BEARER_DIGITAL(bits)) ? "True" : "False");
 618                         break;
 619
 620                 case TIE_BREAKER:
 621                         proto_tree_add_item(l2tp_avp_tree, hf_l2tp_tie_breaker, tvb, index, 8, FALSE);
 622                         break;
 623
 624                 case FIRMWARE_REVISION:
 625                         firmware_rev = tvb_get_ntohs(tvb, index);
 626                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 2,
 627                           "Firmware Revision: %d 0x%x", firmware_rev,firmware_rev );
 628                         break;
 629
 630                 case HOST_NAME:
 631                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 632                           "Host Name: %.*s", avp_len,
 633                           tvb_get_ptr(tvb, index, avp_len));
 634                         break;
 635
 636                 case VENDOR_NAME:
 637                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 638                           "Vendor Name: %.*s", avp_len,
 639                           tvb_get_ptr(tvb, index, avp_len));
 640                         break;
 641
 642                 case ASSIGNED_TUNNEL_ID:
 643                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 2,
 644                           "Tunnel ID: %u", tvb_get_ntohs(tvb, index));
 645                         break;
 646
 647                 case RECEIVE_WINDOW_SIZE:
 648                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 2,
 649                           "Receive Window Size: %u",
 650                           tvb_get_ntohs(tvb, index));
 651                         break;
 652
 653                 case CHALLENGE:
 654                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 655                           "CHAP Challenge: %s",
 656                           tvb_bytes_to_str(tvb, index, avp_len));
 657                         break;
 658
 659                 case CAUSE_CODE:
 660                         /*
 661                          * XXX - export stuff from the Q.931 dissector
 662                          * to dissect the cause code and cause message,
 663                          * and use it.
 664                          */
 665                         if (avp_len < 2)
 666                                 break;
 667                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 2,
 668                           "Cause Code: %u",
 669                           tvb_get_ntohs(tvb, index));
 670                         index += 2;
 671                         avp_len -= 2;
 672
 673                         if (avp_len < 1)
 674                                 break;
 675                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 1,
 676                           "Cause Msg: %u",
 677                           tvb_get_guint8(tvb, index));
 678                         index += 1;
 679                         avp_len -= 1;
 680
 681                         if (avp_len == 0)
 682                                 break;
 683                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 684                           "Advisory Msg: %.*s", avp_len,
 685                           tvb_get_ptr(tvb, index, avp_len));
 686                         break;
 687
 688                 case CHALLENGE_RESPONSE:
 689                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 16,
 690                           "CHAP Challenge Response: %s",
 691                           tvb_bytes_to_str(tvb, index, 16));
 692                         break;
 693
 694                 case ASSIGNED_SESSION:
 695                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 2,
 696                           "Assigned Session: %u",
 697                           tvb_get_ntohs(tvb, index));
 698                         break;
 699
 700                 case CALL_SERIAL_NUMBER:
 701                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 702                           "Call Serial Number: %u",
 703                           tvb_get_ntohl(tvb, index));
 704                         break;
 705
 706                 case MINIMUM_BPS:
 707                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 708                           "Minimum BPS: %u",
 709                           tvb_get_ntohl(tvb, index));
 710                         break;
 711
 712                 case MAXIMUM_BPS:
 713                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 714                           "Maximum BPS: %u",
 715                           tvb_get_ntohl(tvb, index));
 716                         break;
 717
 718                 case BEARER_TYPE:
 719                         bits = tvb_get_ntohl(tvb, index);
 720                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 721                           "Analog Bearer Type: %s",
 722                           (BEARER_ANALOG(bits)) ? "True" : "False");
 723                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 724                           "Digital Bearer Type: %s",
 725                           (BEARER_DIGITAL(bits)) ? "True" : "False");
 726                         break;
 727
 728                 case FRAMING_TYPE:
 729                         bits = tvb_get_ntohl(tvb, index);
 730                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 731                           "Async Framing Type: %s",
 732                           (FRAMING_ASYNC(bits)) ? "True" : "False");
 733                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 734                           "Sync Framing Type: %s",
 735                           (FRAMING_SYNC(bits)) ? "True" : "False");
 736                         break;
 737
 738                 case CALLED_NUMBER:
 739                         if (avp_len == 0)
 740                                 break;
 741                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 742                           "Called Number: %.*s", avp_len,
 743                           tvb_get_ptr(tvb, index, avp_len));
 744                         break;
 745
 746                 case CALLING_NUMBER:
 747                         if (avp_len == 0)
 748                                 break;
 749                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 750                           "Calling Number: %.*s", avp_len,
 751                           tvb_get_ptr(tvb, index, avp_len));
 752                         break;
 753
 754                 case SUB_ADDRESS:
 755                         if (avp_len == 0)
 756                                 break;
 757                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 758                           "Sub-Address: %.*s", avp_len,
 759                           tvb_get_ptr(tvb, index, avp_len));
 760                         break;
 761
 762                 case TX_CONNECT_SPEED:
 763                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 764                           "Connect Speed: %u",
 765                           tvb_get_ntohl(tvb, index));
 766                         break;
 767
 768                 case PHYSICAL_CHANNEL:
 769                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 770                           "Physical Channel: %u",
 771                           tvb_get_ntohl(tvb, index));
 772                         break;
 773
 774                 case INITIAL_RECEIVED_LCP:
 775                         /*
 776                          * XXX - can this be dissected by stuff in the
 777                          * LCP dissector?
 778                          */
 779                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 780                           "Initial LCP CONFREQ: %s",
 781                           tvb_bytes_to_str(tvb, index, avp_len));
 782                         break;
 783
 784                 case LAST_SEND_LCP_CONFREQ:
 785                         /*
 786                          * XXX - can this be dissected by stuff in the
 787                          * LCP dissector?
 788                          */
 789                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 790                           "Last Sent LCP CONFREQ: %s",
 791                           tvb_bytes_to_str(tvb, index, avp_len));
 792                         break;
 793
 794                 case LAST_RECEIVED_LCP_CONFREQ:
 795                         /*
 796                          * XXX - can this be dissected by stuff in the
 797                          * LCP dissector?
 798                          */
 799                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 800                           "Last Received LCP CONFREQ: %s",
 801                           tvb_bytes_to_str(tvb, index, avp_len));
 802                         break;
 803
 804                 case PROXY_AUTHEN_TYPE:
 805                         msg_type = tvb_get_ntohs(tvb, index);
 806                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 2,
 807                           "Proxy Authen Type: %s",
 808                           val_to_str(msg_type, authen_type_vals, "Unknown (%u)"));
 809                         break;
 810
 811                 case PROXY_AUTHEN_NAME:
 812                         if (avp_len == 0)
 813                                 break;
 814                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 815                           "Proxy Authen Name: %.*s", avp_len,
 816                           tvb_get_ptr(tvb, index, avp_len));
 817                         break;
 818
 819                 case PROXY_AUTHEN_CHALLENGE:
 820                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 821                           "Proxy Authen Challenge: %s",
 822                           tvb_bytes_to_str(tvb, index, avp_len));
 823                         break;
 824
 825                 case PROXY_AUTHEN_ID:
 826                         proto_tree_add_text(l2tp_avp_tree, tvb, index + 1, 1,
 827                           "Proxy Authen ID: %u",
 828                           tvb_get_guint8(tvb, index + 1));
 829                         break;
 830
 831                 case PROXY_AUTHEN_RESPONSE:
 832                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 833                           "Proxy Authen Response: %s",
 834                           tvb_bytes_to_str(tvb, index, avp_len));
 835                         break;
 836
 837                 case CALL_STATUS_AVPS:
 838                         if (avp_len < 2)
 839                                 break;
 840                         index += 2;
 841                         avp_len -= 2;
 842
 843                         if (avp_len < 4)
 844                                 break;
 845                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 846                           "CRC Errors: %u", tvb_get_ntohl(tvb, index));
 847                         index += 4;
 848                         avp_len -= 4;
 849
 850                         if (avp_len < 4)
 851                                 break;
 852                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 853                           "Framing Errors: %u", tvb_get_ntohl(tvb, index));
 854                         index += 4;
 855                         avp_len -= 4;
 856
 857                         if (avp_len < 4)
 858                                 break;
 859                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 860                           "Hardware Overruns: %u", tvb_get_ntohl(tvb, index));
 861                         index += 4;
 862                         avp_len -= 4;
 863
 864                         if (avp_len < 4)
 865                                 break;
 866                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 867                           "Buffer Overruns: %u", tvb_get_ntohl(tvb, index));
 868                         index += 4;
 869                         avp_len -= 4;
 870
 871                         if (avp_len < 4)
 872                                 break;
 873                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 874                           "Time-out Errors: %u", tvb_get_ntohl(tvb, index));
 875                         index += 4;
 876                         avp_len -= 4;
 877
 878                         if (avp_len < 4)
 879                                 break;
 880                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 881                           "Alignment Errors: %u", tvb_get_ntohl(tvb, index));
 882                         index += 4;
 883                         avp_len -= 4;
 884                         break;
 885
 886                 case ACCM:
 887                         if (avp_len < 2)
 888                                 break;
 889                         index += 2;
 890                         avp_len -= 2;
 891
 892                         if (avp_len < 4)
 893                                 break;
 894                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 895                           "Send ACCM: %u", tvb_get_ntohl(tvb, index));
 896                         index += 4;
 897                         avp_len -= 4;
 898
 899                         if (avp_len < 4)
 900                                 break;
 901                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 902                           "Receive ACCM: %u", tvb_get_ntohl(tvb, index));
 903                         index += 4;
 904                         avp_len -= 4;
 905                         break;
 906
 907                 case RANDOM_VECTOR:
 908                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 909                           "Random Vector: %s",
 910                           tvb_bytes_to_str(tvb, index, avp_len));
 911                         break;
 912
 913                 case PRIVATE_GROUP_ID:
 914                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 915                           "Private Group ID: %s",
 916                           tvb_bytes_to_str(tvb, index, avp_len));
 917                         break;
 918
 919                 case RX_CONNECT_SPEED:
 920                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 921                           "Rx Connect Speed: %u",
 922                           tvb_get_ntohl(tvb, index));
 923                         break;
 924
 925                 case PPP_DISCONNECT_CAUSE_CODE:
 926                         if (avp_len < 2)
 927                                 break;
 928                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 2,
 929                           "Disconnect Code: %u",
 930                           tvb_get_ntohs(tvb, index));
 931                         index += 2;
 932                         avp_len -= 2;
 933
 934                         if (avp_len < 2)
 935                                 break;
 936                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 2,
 937                           "Control Protocol Number: %u",
 938                           tvb_get_ntohs(tvb, index));
 939                         index += 2;
 940                         avp_len -= 2;
 941
 942                         if (avp_len < 1)
 943                                 break;
 944                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 1,
 945                           "Direction: %s",
 946                           val_to_str(tvb_get_guint8(tvb, index),
 947                                      cause_code_direction_vals,
 948                                      "Reserved (%u)"));
 949                         index += 1;
 950                         avp_len -= 1;
 951
 952                         if (avp_len == 0)
 953                                 break;
 954                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 955                           "Message: %.*s", avp_len,
 956                           tvb_get_ptr(tvb, index, avp_len));
 957                         break;
 958
 959                 default:
 960                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 961                           "Unknown AVP");
 962                         break;
 963                 }
 964
 965                 /* printf("Avp Decode avp_len= %d index= %d length= %d %x\n ",avp_len,
 966                    index,length,length); */
 967
 968                 index += avp_len;
 969         }
 970
 971   }
 972 }
 973
 974 /* registration with the filtering engine */
 975 void
 976 proto_register_l2tp(void)
 977 {
 978         static hf_register_info hf[] = {
 979                 { &hf_l2tp_type,
 980                 { "Type", "lt2p.type", FT_UINT16, BASE_DEC, VALS(l2tp_type_vals), 0x8000,
 981                         "Type bit", HFILL }},
 982
 983                 { &hf_l2tp_length_bit,
 984                 { "Length Bit", "lt2p.length_bit", FT_BOOLEAN, 16, TFS(&l2tp_length_bit_truth), 0x4000,
 985                         "Length bit", HFILL }},
 986
 987                 { &hf_l2tp_seq_bit,
 988                 { "Sequence Bit", "lt2p.seq_bit", FT_BOOLEAN, 16, TFS(&l2tp_seq_bit_truth), 0x0800,
 989                         "Sequence bit", HFILL }},
 990
 991                 { &hf_l2tp_offset_bit,
 992                 { "Offset bit", "lt2p.offset_bit", FT_BOOLEAN, 16, TFS(&l2tp_offset_bit_truth), 0x0200,
 993                         "Offset bit", HFILL }},
 994
 995                 { &hf_l2tp_priority,
 996                 { "Priority", "lt2p.priority", FT_BOOLEAN, 16, TFS(&l2tp_priority_truth), 0x0100,
 997                         "Priority bit", HFILL }},
 998
 999                 { &hf_l2tp_version,
1000                 { "Version", "lt2p.version", FT_UINT16, BASE_DEC, NULL, 0x000f,
1001                         "Version", HFILL }},
1002
1003                 { &hf_l2tp_length,
1004                 { "Length","l2tp.length", FT_UINT16, BASE_DEC, NULL, 0x0,
1005                         "", HFILL }},
1006
1007                 { &hf_l2tp_tunnel,
1008                 { "Tunnel ID","l2tp.tunnel", FT_UINT16, BASE_DEC, NULL, 0x0, /* Probably should be FT_BYTES */
1009                         "Tunnel ID", HFILL }},
1010
1011                 { &hf_l2tp_session,
1012                 { "Session ID","l2tp.session", FT_UINT16, BASE_DEC, NULL, 0x0, /* Probably should be FT_BYTES */
1013                         "Session ID", HFILL }},
1014
1015                 { &hf_l2tp_Ns,
1016                 { "Ns","l2tp.Ns", FT_UINT16, BASE_DEC, NULL, 0x0,
1017                         "", HFILL }},
1018
1019                 { &hf_l2tp_Nr,
1020                 { "Nr","l2tp.Nr", FT_UINT16, BASE_DEC, NULL, 0x0,
1021                         "", HFILL }},
1022
1023                 { &hf_l2tp_offset,
1024                 { "Offset","l2tp.offset", FT_UINT16, BASE_DEC, NULL, 0x0,
1025                         "Number of octest past the L2TP header at which the"
1026                                 "payload data starts.", HFILL }},
1027
1028                 { &hf_l2tp_avp_mandatory,
1029                 { "Mandatory", "lt2p.avp.mandatory", FT_BOOLEAN, BASE_NONE, NULL, 0,
1030                         "Mandatory AVP", HFILL }},
1031
1032                 { &hf_l2tp_avp_hidden,
1033                 { "Hidden", "lt2p.avp.hidden", FT_BOOLEAN, BASE_NONE, NULL, 0,
1034                         "Hidden AVP", HFILL }},
1035
1036                 { &hf_l2tp_avp_length,
1037                 { "Length", "lt2p.avp.length", FT_UINT16, BASE_DEC, NULL, 0,
1038                         "AVP Length", HFILL }},
1039
1040                 { &hf_l2tp_avp_vendor_id,
1041                 { "Vendor ID", "lt2p.avp.vendor_id", FT_UINT16, BASE_DEC, VALS(avp_vendor_id_vals), 0,
1042                         "AVP Vendor ID", HFILL }},
1043
1044                 { &hf_l2tp_avp_type,
1045                 { "Type", "lt2p.avp.type", FT_UINT16, BASE_DEC, VALS(avp_type_vals), 0,
1046                         "AVP Type", HFILL }},
1047
1048                 { &hf_l2tp_tie_breaker,
1049                 { "Tie Breaker", "lt2p.tie_breaker", FT_UINT64, BASE_HEX, NULL, 0,
1050                         "Tie Breaker", HFILL }},
1051
1052         };
1053
1054         static gint *ett[] = {
1055                 &ett_l2tp,
1056                 &ett_l2tp_ctrl,
1057                 &ett_l2tp_avp,
1058         };
1059
1060         proto_l2tp = proto_register_protocol(
1061                 "Layer 2 Tunneling Protocol", "L2TP", "l2tp");
1062         proto_register_field_array(proto_l2tp, hf, array_length(hf));
1063         proto_register_subtree_array(ett, array_length(ett));
1064 }
1065
1066 void
1067 proto_reg_handoff_l2tp(void)
1068 {
1069         dissector_add("udp.port", UDP_PORT_L2TP, dissect_l2tp,
1070             proto_l2tp);
1071
1072         /*
1073          * Get a handle for the PPP-in-HDLC-like-framing dissector.
1074          */
1075         ppp_hdlc_handle = find_dissector("ppp_hdlc");
1076 }