packet-l2tp.c

   1 /* packet-l2tp.c
   2  * Routines for Layer Two Tunnelling Protocol (L2TP) (RFC 2661) packet
   3  * disassembly
   4  * John Thomes <john@ensemblecom.com>
   5  *
   6  * Minor changes by: (2000-01-10)
   7  * Laurent Cazalet <laurent.cazalet@mailclub.net>
   8  * Thomas Parvais <thomas.parvais@advalvas.be>
   9  *
  10  * $Id: packet-l2tp.c,v 1.31 2002/03/09 22:54:27 guy Exp $
  11  *
  12  * Ethereal - Network traffic analyzer
  13  * By Gerald Combs <gerald@ethereal.com>
  14  * Copyright 1998 Gerald Combs
  15  *
  16  * This program is free software; you can redistribute it and/or
  17  * modify it under the terms of the GNU General Public License
  18  * as published by the Free Software Foundation; either version 2
  19  * of the License, or (at your option) any later version.
  20  *
  21  * This program is distributed in the hope that it will be useful,
  22  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  23  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  24  * GNU General Public License for more details.
  25  *
  26  * You should have received a copy of the GNU General Public License
  27  * along with this program; if not, write to the Free Software
  28  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  29  */
  30
  31 static int proto_l2tp = -1;
  32 static int hf_l2tp_type = -1;
  33 static int hf_l2tp_length_bit = -1;
  34 static int hf_l2tp_seq_bit = -1;
  35 static int hf_l2tp_offset_bit = -1;
  36 static int hf_l2tp_priority = -1;
  37 static int hf_l2tp_version = -1;
  38 static int hf_l2tp_length = -1;
  39 static int hf_l2tp_tunnel = -1;
  40 static int hf_l2tp_session = -1;
  41 static int hf_l2tp_Ns = -1;
  42 static int hf_l2tp_Nr = -1;
  43 static int hf_l2tp_offset = -1;
  44 static int hf_l2tp_avp_mandatory = -1;
  45 static int hf_l2tp_avp_hidden = -1;
  46 static int hf_l2tp_avp_length = -1;
  47 static int hf_l2tp_avp_vendor_id = -1;
  48 static int hf_l2tp_avp_type = -1;
  49 static int hf_l2tp_tie_breaker = -1;
  50
  51 #ifdef HAVE_CONFIG_H
  52 #include "config.h"
  53 #endif
  54
  55 #ifdef HAVE_SYS_TYPES_H
  56 # include <sys/types.h>
  57 #endif
  58
  59 #ifdef HAVE_NETINET_IN_H
  60 #include <netinet/in.h>
  61 #endif
  62
  63 #include <stdio.h>
  64 #include <stdlib.h>
  65 #include <string.h>
  66 #include <ctype.h>
  67 #include <glib.h>
  68 #include <epan/packet.h>
  69 #include <epan/resolv.h>
  70
  71 #define UDP_PORT_L2TP   1701
  72
  73 #define CONTROL_BIT(msg_info) (msg_info & 0x8000)   /* Type bit control = 1 data = 0 */
  74 #define LENGTH_BIT(msg_info) (msg_info & 0x4000)    /* Length bit = 1  */
  75 #define RESERVE_BITS(msg_info) (msg_info &0x37F8)   /* Reserved bit - usused */
  76 #define SEQUENCE_BIT(msg_info) (msg_info & 0x0800)  /* SEQUENCE bit = 1 Ns and Nr fields */
  77 #define OFFSET_BIT(msg_info) (msg_info & 0x0200)    /* Offset */
  78 #define PRIORITY_BIT(msg_info) (msg_info & 0x0100)  /* Priority */
  79 #define L2TP_VERSION(msg_info) (msg_info & 0x000f)  /* Version of l2tp */
  80 #define MANDATORY_BIT(msg_info) (msg_info & 0x8000) /* Mandatory = 1 */
  81 #define HIDDEN_BIT(msg_info) (msg_info & 0x4000)    /* Hidden = 1 */
  82 #define AVP_LENGTH(msg_info) (msg_info & 0x03ff)    /* AVP Length */
  83 #define FRAMING_SYNC(msg_info)  (msg_info & 0x0001) /* SYNC Framing Type */
  84 #define FRAMING_ASYNC(msg_info) (msg_info & 0x0002) /* ASYNC Framing Type */
  85 #define BEARER_DIGITAL(msg_info) (msg_info & 0x0001) /* Digital Bearer Type */
  86 #define BEARER_ANALOG(msg_info) (msg_info & 0x0002) /* Analog Bearer Type */
  87
  88 static gint ett_l2tp = -1;
  89 static gint ett_l2tp_ctrl = -1;
  90 static gint ett_l2tp_avp = -1;
  91
  92 #define AVP_SCCRQ      1
  93 #define AVP_SCCRP      2
  94 #define AVP_SCCCN      3
  95 #define AVP_StopCCN    4
  96 #define AVP_Reserved   5
  97 #define AVP_HELLO      6
  98 #define AVP_OCRQ       7
  99 #define AVP_OCRP       8
 100 #define AVP_ORCRP      9
 101 #define AVP_ICRQ      10
 102 #define AVP_ICRP      11
 103 #define AVP_ICCN      12
 104 #define AVP_Reserved1 13
 105 #define AVP_CDN       14
 106
 107
 108 #define NUM_CONTROL_CALL_TYPES  16
 109 static const char *calltypestr[NUM_CONTROL_CALL_TYPES+1] = {
 110   "Unknown Call Type           ",
 111   "Start_Control_Request       ",
 112   "Start_Control_Reply         ",
 113   "Start_Control_Connected     ",
 114   "Stop_Control_Notification   ",
 115   "Reserved                    ",
 116   "Hello                       ",
 117   "Outgoing_Call_Request       ",
 118   "Outgoing_Call_Reply         ",
 119   "Outgoing_Call_Connected     ",
 120   "Incoming_Call_Request       ",
 121   "Incoming_Call_Reply         ",
 122   "Incoming_Call_Connected     ",
 123   "Reserved                    ",
 124   "Call_Disconnect_Notification",
 125   "WAN_Error_Notify            ",
 126   "Set_Link_Info               ",
 127 };
 128
 129 static const char *calltype_short_str[NUM_CONTROL_CALL_TYPES+1] = {
 130   "Unknown ",
 131   "SCCRQ   ",
 132   "SCCRP   ",
 133   "SCCCN   ",
 134   "StopCCN ",
 135   "Reserved",
 136   "Hello   ",
 137   "OCRQ    ",
 138   "OCRP    ",
 139   "OCCN    ",
 140   "ICRQ    ",
 141   "ICRP    ",
 142   "ICCN    ",
 143   "Reserved",
 144   "CDN     ",
 145   "WEN     ",
 146   "SLI     ",
 147 };
 148
 149
 150 static const char *control_msg  = "Control Message";
 151 static const char *data_msg     = "Data    Message";
 152 static const value_string l2tp_type_vals[] = {
 153         { 0, "Data Message" },
 154         { 1, "Control Message" },
 155         { 0, NULL },
 156 };
 157
 158 static const value_string cause_code_direction_vals[] = {
 159         { 0, "global error" },
 160         { 1, "at peer" },
 161         { 2, "at local" },
 162         { 0, NULL },
 163 };
 164
 165 static const true_false_string l2tp_length_bit_truth =
 166         { "Length field is present", "Length field is not present" };
 167
 168 static const true_false_string l2tp_seq_bit_truth =
 169         { "Ns and Nr fields are present", "Ns and Nr fields are not present" };
 170
 171 static const true_false_string l2tp_offset_bit_truth =
 172         { "Offset Size field is present", "Offset size field is not present" };
 173
 174 static const true_false_string l2tp_priority_truth =
 175         { "This data message has priority", "No priority" };
 176
 177 static const value_string authen_type_vals[] = {
 178   { 0, "Reserved" },
 179   { 1, "Textual username and password" },
 180   { 2, "PPP CHAP" },
 181   { 3, "PPP PAP" },
 182   { 4, "No Authentication" },
 183   { 5, "Microsoft CHAP Version 1" },
 184   { 0, NULL }
 185 };
 186
 187 #define  CONTROL_MESSAGE  0
 188 #define  RESULT_ERROR_CODE 1
 189 #define  PROTOCOL_VERSION  2
 190 #define  FRAMING_CAPABILITIES 3
 191 #define  BEARER_CAPABILITIES 4
 192 #define  TIE_BREAKER 5
 193 #define  FIRMWARE_REVISION 6
 194 #define  HOST_NAME 7
 195 #define  VENDOR_NAME 8
 196 #define  ASSIGNED_TUNNEL_ID 9
 197 #define  RECEIVE_WINDOW_SIZE 10
 198 #define  CHALLENGE 11
 199 #define  CAUSE_CODE 12
 200 #define  CHALLENGE_RESPONSE 13
 201 #define  ASSIGNED_SESSION 14
 202 #define  CALL_SERIAL_NUMBER 15
 203 #define  MINIMUM_BPS 16
 204 #define  MAXIMUM_BPS 17
 205 #define  BEARER_TYPE 18
 206 #define  FRAMING_TYPE 19
 207 #define  CALLED_NUMBER 21
 208 #define  CALLING_NUMBER 22
 209 #define  SUB_ADDRESS 23
 210 #define  TX_CONNECT_SPEED 24
 211 #define  PHYSICAL_CHANNEL 25
 212 #define  INITIAL_RECEIVED_LCP 26
 213 #define  LAST_SEND_LCP_CONFREQ 27
 214 #define  LAST_RECEIVED_LCP_CONFREQ 28
 215 #define  PROXY_AUTHEN_TYPE 29
 216 #define  PROXY_AUTHEN_NAME 30
 217 #define  PROXY_AUTHEN_CHALLENGE 31
 218 #define  PROXY_AUTHEN_ID 32
 219 #define  PROXY_AUTHEN_RESPONSE 33
 220 #define  CALL_STATUS_AVPS 34
 221 #define  ACCM 35
 222 #define  RANDOM_VECTOR 36
 223 #define  PRIVATE_GROUP_ID 37
 224 #define  RX_CONNECT_SPEED 38
 225 #define  SEQUENCING_REQUIRED 39
 226 #define  PPP_DISCONNECT_CAUSE_CODE 46   /* RFC 3145 */
 227
 228 #define NUM_AVP_TYPES  40
 229 static const value_string avp_type_vals[] = {
 230   { CONTROL_MESSAGE,           "Control Message" },
 231   { RESULT_ERROR_CODE,         "Result-Error Code" },
 232   { PROTOCOL_VERSION,          "Protocol Version" },
 233   { FRAMING_CAPABILITIES,      "Framing Capabilities" },
 234   { BEARER_CAPABILITIES,       "Bearer Capabilities" },
 235   { TIE_BREAKER,               "Tie Breaker" },
 236   { FIRMWARE_REVISION,         "Firmware Revision" },
 237   { HOST_NAME,                 "Host Name" },
 238   { VENDOR_NAME,               "Vendor Name" },
 239   { ASSIGNED_TUNNEL_ID,        "Assigned Tunnel ID" },
 240   { RECEIVE_WINDOW_SIZE,       "Receive Window Size" },
 241   { CHALLENGE,                 "Challenge" },
 242   { CAUSE_CODE,                "Cause Code" },
 243   { CHALLENGE_RESPONSE,        "Challenge Response" },
 244   { ASSIGNED_SESSION,          "Assigned Session" },
 245   { CALL_SERIAL_NUMBER,        "Call Serial Number" },
 246   { MINIMUM_BPS,               "Minimum BPS" },
 247   { MAXIMUM_BPS,               "Maximum BPS" },
 248   { BEARER_TYPE,               "Bearer Type" },
 249   { FRAMING_TYPE,              "Framing Type" },
 250   { CALLED_NUMBER,             "Called Number" },
 251   { CALLING_NUMBER,            "Calling Number" },
 252   { SUB_ADDRESS,               "Sub-Address" },
 253   { TX_CONNECT_SPEED,          "Connect Speed" },
 254   { PHYSICAL_CHANNEL,          "Physical Channel" },
 255   { INITIAL_RECEIVED_LCP,      "Initial Received LCP" },
 256   { LAST_SEND_LCP_CONFREQ,     "Last Send LCP CONFREQ" },
 257   { LAST_RECEIVED_LCP_CONFREQ, "Last Received LCP CONFREQ" },
 258   { PROXY_AUTHEN_TYPE,         "Proxy Authen Type" },
 259   { PROXY_AUTHEN_NAME,         "Proxy Authen Name" },
 260   { PROXY_AUTHEN_CHALLENGE,    "Proxy Authen Challenge" },
 261   { PROXY_AUTHEN_ID,           "Proxy Authen ID" },
 262   { PROXY_AUTHEN_RESPONSE,     "Proxy Authen Response" },
 263   { CALL_STATUS_AVPS,          "Call status AVPs" },
 264   { ACCM,                      "ACCM" },
 265   { RANDOM_VECTOR,             "Random Vector" },
 266   { PRIVATE_GROUP_ID,          "Private group ID" },
 267   { RX_CONNECT_SPEED,          "RxConnect Speed" },
 268   { SEQUENCING_REQUIRED,       "Sequencing Required" },
 269   { PPP_DISCONNECT_CAUSE_CODE, "PPP Disconnect Cause Code" },
 270   { 0,                         NULL }
 271 };
 272
 273 /*
 274  * These are SMI Network Management Private Enterprise Codes for
 275  * organizations; see
 276  *
 277  *      http://www.isi.edu/in-notes/iana/assignments/enterprise-numbers
 278  *
 279  * for a list.
 280  */
 281 #define VENDOR_IETF 0
 282 #define VENDOR_ACC 5
 283 #define VENDOR_CISCO 9
 284 #define VENDOR_SHIVA 166
 285 #define VENDOR_LIVINGSTON 307
 286 #define VENDOR_3COM 429
 287 #define VENDOR_ASCEND 529
 288 #define VENDOR_BAY 1584
 289 #define VENDOR_JUNIPER 2636
 290 #define VENDOR_COSINE 3085
 291 #define VENDOR_UNISPHERE 4874
 292
 293 static const value_string avp_vendor_id_vals[] =
 294 {{VENDOR_IETF,"IETF"},
 295 {VENDOR_ACC,"ACC"},
 296 {VENDOR_CISCO,"Cisco"},
 297 {VENDOR_SHIVA,"Shiva"},
 298 {VENDOR_LIVINGSTON,"Livingston"},
 299 {VENDOR_3COM,"3Com"},
 300 {VENDOR_ASCEND,"Ascend"},
 301 {VENDOR_BAY,"Bay Networks"},
 302 {VENDOR_JUNIPER,"Juniper Networks"},
 303 {VENDOR_COSINE,"CoSine Communications"},
 304 {VENDOR_UNISPHERE,"Unisphere Networks"},
 305 {0,NULL}};
 306
 307 static gchar textbuffer[200];
 308
 309 static dissector_handle_t ppp_hdlc_handle;
 310
 311 static void
 312 dissect_l2tp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 313 {
 314   proto_tree *l2tp_tree=NULL, *l2tp_avp_tree, *ctrl_tree;
 315   proto_item *ti, *tf;
 316   int rhcode;
 317   int index = 0;
 318   int tmp_index;
 319   int proto_length = 0;
 320   guint16 length = 0;           /* Length field */
 321   guint16 tid;                  /* Tunnel ID */
 322   guint16 cid;                  /* Call ID */
 323   guint16 offset_size;          /* Offset size */
 324   guint16 ver_len_hidden;
 325   guint16 avp_vendor_id;
 326   guint16 avp_type;
 327   guint16 msg_type;
 328   guint16 avp_len;
 329   guint16 result_code;
 330   guint16 error_code;
 331   guint32 bits;
 332   guint16 firmware_rev;
 333   guint16       control;
 334   tvbuff_t      *next_tvb;
 335
 336   if (check_col(pinfo->cinfo, COL_PROTOCOL))    /* build output for closed L2tp frame displayed  */
 337         col_set_str(pinfo->cinfo, COL_PROTOCOL, "L2TP");
 338   if (check_col(pinfo->cinfo, COL_INFO))
 339         col_clear(pinfo->cinfo, COL_INFO);
 340
 341   control = tvb_get_ntohs(tvb, 0);
 342
 343   if (L2TP_VERSION(control) != 2) {
 344           if (check_col(pinfo->cinfo, COL_INFO)) {
 345                 col_add_fstr(pinfo->cinfo, COL_INFO, "L2TP Version %u", L2TP_VERSION(control) );
 346           }
 347           return;
 348   }
 349
 350   rhcode= 10;
 351
 352   if (LENGTH_BIT(control)) {            /* length field included ? */
 353       index += 2;                       /* skip ahead */
 354       length = tvb_get_ntohs(tvb, index);
 355   }
 356
 357   /* collect the tunnel id & call id */
 358   index += 2;
 359   tid = tvb_get_ntohs(tvb, index);
 360   index += 2;
 361   cid = tvb_get_ntohs(tvb, index);
 362
 363   if (check_col(pinfo->cinfo, COL_INFO)) {
 364         if (CONTROL_BIT(control)) {
 365             /* CONTROL MESSAGE */
 366             tmp_index = index;
 367
 368               if ((LENGTH_BIT(control))&&(length==12))                  /* ZLB Message */
 369                   sprintf(textbuffer,"%s - ZLB      (tunnel id=%d, session id=%d)",
 370                           control_msg , tid ,cid);
 371               else
 372               {
 373                 if (SEQUENCE_BIT(control)) {
 374                     tmp_index += 4;
 375                 }
 376
 377                 tmp_index+=4;
 378
 379                 avp_type = tvb_get_ntohs(tvb, (tmp_index+=2));
 380
 381                 if (avp_type == CONTROL_MESSAGE)
 382                 {
 383                     /* We print message type */
 384                     msg_type = tvb_get_ntohs(tvb, (tmp_index+=2));
 385                     sprintf(textbuffer,"%s - %s (tunnel id=%d, session id=%d)",
 386                             control_msg ,
 387                             ((NUM_CONTROL_CALL_TYPES + 1 ) > msg_type) ?
 388                             calltype_short_str[msg_type] : "Unknown",
 389                             tid ,cid);
 390                 }
 391                 else
 392                 {
 393                     /*
 394                      * This is not a control message.
 395                      * We never pass here except in case of bad l2tp packet!
 396                      */
 397                     sprintf(textbuffer,"%s (tunnel id=%d, session id=%d)",
 398                             control_msg ,  tid ,cid);
 399
 400                 }
 401               }
 402         }
 403         else {
 404             /* DATA Message */
 405                sprintf(textbuffer,"%s            (tunnel id=%d, session id=%d)",
 406                        data_msg, tid ,cid);
 407         }
 408         col_add_fstr(pinfo->cinfo,COL_INFO,textbuffer);
 409   }
 410
 411   if (LENGTH_BIT(control)) {
 412         proto_length = length;
 413   }
 414   else {
 415         proto_length = tvb_length(tvb);
 416   }
 417
 418   if (tree) {
 419         ti = proto_tree_add_item(tree,proto_l2tp, tvb, 0, proto_length, FALSE);
 420         l2tp_tree = proto_item_add_subtree(ti, ett_l2tp);
 421
 422         ti = proto_tree_add_text(l2tp_tree, tvb, 0, 2,
 423                         "Packet Type: %s Tunnel Id=%d Session Id=%d",
 424                         (CONTROL_BIT(control) ? control_msg : data_msg), tid, cid);
 425
 426         ctrl_tree = proto_item_add_subtree(ti, ett_l2tp_ctrl);
 427         proto_tree_add_uint(ctrl_tree, hf_l2tp_type, tvb, 0, 2, control);
 428         proto_tree_add_boolean(ctrl_tree, hf_l2tp_length_bit, tvb, 0, 2, control);
 429         proto_tree_add_boolean(ctrl_tree, hf_l2tp_seq_bit, tvb, 0, 2, control);
 430         proto_tree_add_boolean(ctrl_tree, hf_l2tp_offset_bit, tvb, 0, 2, control);
 431         proto_tree_add_boolean(ctrl_tree, hf_l2tp_priority, tvb, 0, 2, control);
 432         proto_tree_add_uint(ctrl_tree, hf_l2tp_version, tvb, 0, 2, control);
 433   }
 434   index = 2;
 435   if (LENGTH_BIT(control)) {
 436           if (tree) {
 437                 proto_tree_add_item(l2tp_tree, hf_l2tp_length, tvb, index, 2, FALSE);
 438           }
 439         index += 2;
 440   }
 441
 442   if (tree) {
 443         proto_tree_add_item(l2tp_tree, hf_l2tp_tunnel, tvb, index, 2, FALSE);
 444   }
 445   index += 2;
 446   if (tree) {
 447         proto_tree_add_item(l2tp_tree, hf_l2tp_session, tvb, index, 2, FALSE);
 448   }
 449   index += 2;
 450
 451   if (SEQUENCE_BIT(control)) {
 452           if (tree) {
 453                 proto_tree_add_item(l2tp_tree, hf_l2tp_Ns, tvb, index, 2, FALSE);
 454           }
 455           index += 2;
 456           if (tree) {
 457                 proto_tree_add_item(l2tp_tree, hf_l2tp_Nr, tvb, index, 2, FALSE);
 458           }
 459           index += 2;
 460   }
 461   if (OFFSET_BIT(control)) {
 462         offset_size = tvb_get_ntohs(tvb, index);
 463         if (tree) {
 464                 proto_tree_add_uint(l2tp_tree, hf_l2tp_offset, tvb, index, 2,
 465                     offset_size);
 466         }
 467         index += 2;
 468         if (tree) {
 469                 proto_tree_add_text(l2tp_tree, tvb, index, offset_size, "Offset Padding");
 470         }
 471         index += offset_size;
 472   }
 473   if (tree && (LENGTH_BIT(control))&&(length==12)) {
 474             proto_tree_add_text(l2tp_tree, tvb, 0, 0, "Zero Length Bit message");
 475   }
 476
 477   if (!CONTROL_BIT(control)) {  /* Data Messages so we are done */
 478         /* If we have data, signified by having a length bit, dissect it */
 479         if (tvb_offset_exists(tvb, index)) {
 480                 next_tvb = tvb_new_subset(tvb, index, -1, proto_length - index);
 481                 call_dissector(ppp_hdlc_handle, next_tvb, pinfo, tree);
 482         }
 483         return;
 484   }
 485
 486   if (tree) {
 487         if (!LENGTH_BIT(control)) {
 488                 return;
 489         }
 490         while (index < length ) {    /* Process AVP's */
 491                 ver_len_hidden  = tvb_get_ntohs(tvb, index);
 492                 avp_len         = AVP_LENGTH(ver_len_hidden);
 493                 avp_vendor_id   = tvb_get_ntohs(tvb, index + 2);
 494                 avp_type        = tvb_get_ntohs(tvb, index + 4);
 495
 496                 if (avp_vendor_id == VENDOR_IETF) {
 497                         tf =  proto_tree_add_text(l2tp_tree, tvb, index,
 498                         avp_len, "%s AVP",
 499                         val_to_str(avp_type, avp_type_vals, "Unknown (%u)"));
 500                 } else {         /* Vendor-Specific AVP */
 501                         tf =  proto_tree_add_text(l2tp_tree, tvb, index,
 502                         avp_len, "Vendor %s AVP",
 503                         val_to_str(avp_vendor_id, avp_vendor_id_vals, "Unknown (%u)"));
 504                 }
 505
 506                 l2tp_avp_tree = proto_item_add_subtree(tf,  ett_l2tp_avp);
 507
 508                 proto_tree_add_boolean_format(l2tp_avp_tree,hf_l2tp_avp_mandatory, tvb, index, 1,
 509                                            rhcode, "Mandatory: %s",
 510                                            (MANDATORY_BIT(ver_len_hidden)) ? "True" : "False" );
 511                 proto_tree_add_boolean_format(l2tp_avp_tree,hf_l2tp_avp_hidden, tvb, index, 1,
 512                                            rhcode, "Hidden: %s",
 513                                            (HIDDEN_BIT(ver_len_hidden)) ? "True" : "False" );
 514                 proto_tree_add_uint_format(l2tp_avp_tree,hf_l2tp_avp_length, tvb, index, 2,
 515                                            rhcode, "Length: %u", avp_len);
 516                 if (HIDDEN_BIT(ver_len_hidden)) { /* don't try do display hidden */
 517                         index += avp_len;
 518                         continue;
 519                 }
 520
 521                 if (avp_len == 0) {
 522                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 0,
 523                           "AVP length must not be zero");
 524                         return;
 525                 }
 526                 index += 2;
 527                 avp_len -= 2;
 528
 529                 proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_vendor_id,
 530                     tvb, index, 2, FALSE);
 531                 index += 2;
 532                 avp_len -= 2;
 533
 534                 if (avp_vendor_id != VENDOR_IETF) {
 535                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 2,
 536                                             "Type: %u", avp_type);
 537                         index += 2;
 538                         avp_len -= 2;
 539
 540                         /* For the time being, we don't decode any Vendor-
 541                            specific AVP. */
 542                         proto_tree_add_text(l2tp_avp_tree, tvb, index,
 543                                             avp_len, "Vendor-Specific AVP");
 544
 545                         index += avp_len;
 546                         continue;
 547                 }
 548
 549                 proto_tree_add_uint(l2tp_avp_tree, hf_l2tp_avp_type,
 550                     tvb, index, 2, avp_type);
 551                 index += 2;
 552                 avp_len -= 2;
 553
 554                 switch (avp_type) {
 555
 556                 case CONTROL_MESSAGE:
 557                         msg_type = tvb_get_ntohs(tvb, index);
 558                         proto_tree_add_text(l2tp_avp_tree,tvb, index, 2,
 559                           "Control Message Type: (%u) %s", msg_type,
 560                           ((NUM_CONTROL_CALL_TYPES + 1 ) > msg_type) ?
 561                           calltypestr[msg_type] : "Unknown");
 562                         break;
 563
 564                 case RESULT_ERROR_CODE:
 565                         if (avp_len < 2)
 566                                 break;
 567                         result_code = tvb_get_ntohs(tvb, index);
 568                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 2,
 569                           "Result code: %u",  result_code);
 570                         index += 2;
 571                         avp_len -= 2;
 572
 573                         if (avp_len < 2)
 574                                 break;
 575                         error_code = tvb_get_ntohs(tvb, index);
 576                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 2,
 577                           "Error code: %u", error_code);
 578                         index += 2;
 579                         avp_len -= 2;
 580
 581                         if (avp_len == 0)
 582                                 break;
 583                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 584                           "Error Message: %.*s", avp_len,
 585                           tvb_get_ptr(tvb, index, avp_len));
 586                         break;
 587
 588                 case PROTOCOL_VERSION:
 589                         if (avp_len < 1)
 590                                 break;
 591                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 1,
 592                           "Version: %u", tvb_get_guint8(tvb, index));
 593                         index += 1;
 594                         avp_len -= 1;
 595
 596                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 1,
 597                           "Revision: %u", tvb_get_guint8(tvb, index));
 598                         break;
 599
 600                 case FRAMING_CAPABILITIES:
 601                         bits = tvb_get_ntohl(tvb, index);
 602                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 603                           "Async Framing Supported: %s",
 604                           (FRAMING_ASYNC(bits)) ? "True" : "False");
 605                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 606                           "Sync Framing Supported: %s",
 607                           (FRAMING_SYNC(bits)) ? "True" : "False");
 608                         break;
 609
 610                 case BEARER_CAPABILITIES:
 611                         bits = tvb_get_ntohl(tvb, index);
 612                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 613                           "Analog Access Supported: %s",
 614                           (BEARER_ANALOG(bits)) ? "True" : "False");
 615                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 616                           "Digital Access Supported: %s",
 617                           (BEARER_DIGITAL(bits)) ? "True" : "False");
 618                         break;
 619
 620                 case TIE_BREAKER:
 621                         proto_tree_add_item(l2tp_avp_tree, hf_l2tp_tie_breaker, tvb, index, 8, FALSE);
 622                         break;
 623
 624                 case FIRMWARE_REVISION:
 625                         firmware_rev = tvb_get_ntohs(tvb, index);
 626                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 2,
 627                           "Firmware Revision: %d 0x%x", firmware_rev,firmware_rev );
 628                         break;
 629
 630                 case HOST_NAME:
 631                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 632                           "Host Name: %.*s", avp_len,
 633                           tvb_get_ptr(tvb, index, avp_len));
 634                         break;
 635
 636                 case VENDOR_NAME:
 637                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 638                           "Vendor Name: %.*s", avp_len,
 639                           tvb_get_ptr(tvb, index, avp_len));
 640                         break;
 641
 642                 case ASSIGNED_TUNNEL_ID:
 643                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 2,
 644                           "Tunnel ID: %u", tvb_get_ntohs(tvb, index));
 645                         break;
 646
 647                 case RECEIVE_WINDOW_SIZE:
 648                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 2,
 649                           "Receive Window Size: %u",
 650                           tvb_get_ntohs(tvb, index));
 651                         break;
 652
 653                 case CHALLENGE:
 654                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 655                           "CHAP Challenge: %s",
 656                           tvb_bytes_to_str(tvb, index, avp_len));
 657                         break;
 658
 659                 case CAUSE_CODE:
 660                         /*
 661                          * XXX - export stuff from the Q.931 dissector
 662                          * to dissect the cause code and cause message,
 663                          * and use it.
 664                          */
 665                         if (avp_len < 2)
 666                                 break;
 667                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 2,
 668                           "Cause Code: %u",
 669                           tvb_get_ntohs(tvb, index));
 670                         index += 2;
 671                         avp_len -= 2;
 672
 673                         if (avp_len < 1)
 674                                 break;
 675                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 1,
 676                           "Cause Msg: %u",
 677                           tvb_get_guint8(tvb, index));
 678                         index += 1;
 679                         avp_len -= 1;
 680
 681                         if (avp_len == 0)
 682                                 break;
 683                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 684                           "Advisory Msg: %.*s", avp_len,
 685                           tvb_get_ptr(tvb, index, avp_len));
 686                         break;
 687
 688                 case CHALLENGE_RESPONSE:
 689                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 16,
 690                           "CHAP Challenge Response: %s",
 691                           tvb_bytes_to_str(tvb, index, 16));
 692                         break;
 693
 694                 case ASSIGNED_SESSION:
 695                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 2,
 696                           "Assigned Session: %u",
 697                           tvb_get_ntohs(tvb, index));
 698                         break;
 699
 700                 case CALL_SERIAL_NUMBER:
 701                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 702                           "Call Serial Number: %u",
 703                           tvb_get_ntohl(tvb, index));
 704                         break;
 705
 706                 case MINIMUM_BPS:
 707                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 708                           "Minimum BPS: %u",
 709                           tvb_get_ntohl(tvb, index));
 710                         break;
 711
 712                 case MAXIMUM_BPS:
 713                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 714                           "Maximum BPS: %u",
 715                           tvb_get_ntohl(tvb, index));
 716                         break;
 717
 718                 case BEARER_TYPE:
 719                         bits = tvb_get_ntohl(tvb, index);
 720                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 721                           "Analog Bearer Type: %s",
 722                           (BEARER_ANALOG(bits)) ? "True" : "False");
 723                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 724                           "Digital Bearer Type: %s",
 725                           (BEARER_DIGITAL(bits)) ? "True" : "False");
 726                         break;
 727
 728                 case FRAMING_TYPE:
 729                         bits = tvb_get_ntohl(tvb, index);
 730                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 731                           "Async Framing Type: %s",
 732                           (FRAMING_ASYNC(bits)) ? "True" : "False");
 733                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 734                           "Sync Framing Type: %s",
 735                           (FRAMING_SYNC(bits)) ? "True" : "False");
 736                         break;
 737
 738                 case CALLED_NUMBER:
 739                         if (avp_len == 0)
 740                                 break;
 741                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 742                           "Called Number: %.*s", avp_len,
 743                           tvb_get_ptr(tvb, index, avp_len));
 744                         break;
 745
 746                 case CALLING_NUMBER:
 747                         if (avp_len == 0)
 748                                 break;
 749                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 750                           "Calling Number: %.*s", avp_len,
 751                           tvb_get_ptr(tvb, index, avp_len));
 752                         break;
 753
 754                 case SUB_ADDRESS:
 755                         if (avp_len == 0)
 756                                 break;
 757                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 758                           "Sub-Address: %.*s", avp_len,
 759                           tvb_get_ptr(tvb, index, avp_len));
 760                         break;
 761
 762                 case TX_CONNECT_SPEED:
 763                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 764                           "Connect Speed: %u",
 765                           tvb_get_ntohl(tvb, index));
 766                         break;
 767
 768                 case PHYSICAL_CHANNEL:
 769                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 770                           "Physical Channel: %u",
 771                           tvb_get_ntohl(tvb, index));
 772                         break;
 773
 774                 case INITIAL_RECEIVED_LCP:
 775                         /*
 776                          * XXX - can this be dissected by stuff in the
 777                          * LCP dissector?
 778                          */
 779                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 780                           "Initial LCP CONFREQ: %s",
 781                           tvb_bytes_to_str(tvb, index, avp_len));
 782                         break;
 783
 784                 case LAST_SEND_LCP_CONFREQ:
 785                         /*
 786                          * XXX - can this be dissected by stuff in the
 787                          * LCP dissector?
 788                          */
 789                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 790                           "Last Sent LCP CONFREQ: %s",
 791                           tvb_bytes_to_str(tvb, index, avp_len));
 792                         break;
 793
 794                 case LAST_RECEIVED_LCP_CONFREQ:
 795                         /*
 796                          * XXX - can this be dissected by stuff in the
 797                          * LCP dissector?
 798                          */
 799                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 800                           "Last Received LCP CONFREQ: %s",
 801                           tvb_bytes_to_str(tvb, index, avp_len));
 802                         break;
 803
 804                 case PROXY_AUTHEN_TYPE:
 805                         msg_type = tvb_get_ntohs(tvb, index);
 806                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 2,
 807                           "Proxy Authen Type: %s",
 808                           val_to_str(msg_type, authen_type_vals, "Unknown (%u)"));
 809                         break;
 810
 811                 case PROXY_AUTHEN_NAME:
 812                         if (avp_len == 0)
 813                                 break;
 814                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 815                           "Proxy Authen Name: %.*s", avp_len,
 816                           tvb_get_ptr(tvb, index, avp_len));
 817                         break;
 818
 819                 case PROXY_AUTHEN_CHALLENGE:
 820                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 821                           "Proxy Authen Challenge: %s",
 822                           tvb_bytes_to_str(tvb, index, avp_len));
 823                         break;
 824
 825                 case PROXY_AUTHEN_ID:
 826                         proto_tree_add_text(l2tp_avp_tree, tvb, index + 1, 1,
 827                           "Proxy Authen ID: %u",
 828                           tvb_get_guint8(tvb, index + 1));
 829                         break;
 830
 831                 case PROXY_AUTHEN_RESPONSE:
 832                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 833                           "Proxy Authen Response: %s",
 834                           tvb_bytes_to_str(tvb, index, avp_len));
 835                         break;
 836
 837                 case CALL_STATUS_AVPS:
 838                         if (avp_len < 2)
 839                                 break;
 840                         index += 2;
 841                         avp_len -= 2;
 842
 843                         if (avp_len < 4)
 844                                 break;
 845                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 846                           "CRC Errors: %u", tvb_get_ntohl(tvb, index));
 847                         index += 4;
 848                         avp_len -= 4;
 849
 850                         if (avp_len < 4)
 851                                 break;
 852                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 853                           "Framing Errors: %u", tvb_get_ntohl(tvb, index));
 854                         index += 4;
 855                         avp_len -= 4;
 856
 857                         if (avp_len < 4)
 858                                 break;
 859                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 860                           "Hardware Overruns: %u", tvb_get_ntohl(tvb, index));
 861                         index += 4;
 862                         avp_len -= 4;
 863
 864                         if (avp_len < 4)
 865                                 break;
 866                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 867                           "Buffer Overruns: %u", tvb_get_ntohl(tvb, index));
 868                         index += 4;
 869                         avp_len -= 4;
 870
 871                         if (avp_len < 4)
 872                                 break;
 873                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 874                           "Time-out Errors: %u", tvb_get_ntohl(tvb, index));
 875                         index += 4;
 876                         avp_len -= 4;
 877
 878                         if (avp_len < 4)
 879                                 break;
 880                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 881                           "Alignment Errors: %u", tvb_get_ntohl(tvb, index));
 882                         index += 4;
 883                         avp_len -= 4;
 884                         break;
 885
 886                 case ACCM:
 887                         if (avp_len < 2)
 888                                 break;
 889                         index += 2;
 890                         avp_len -= 2;
 891
 892                         if (avp_len < 4)
 893                                 break;
 894                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 895                           "Send ACCM: %u", tvb_get_ntohl(tvb, index));
 896                         index += 4;
 897                         avp_len -= 4;
 898
 899                         if (avp_len < 4)
 900                                 break;
 901                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 902                           "Receive ACCM: %u", tvb_get_ntohl(tvb, index));
 903                         index += 4;
 904                         avp_len -= 4;
 905                         break;
 906
 907                 case RANDOM_VECTOR:
 908                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 909                           "Random Vector: %s",
 910                           tvb_bytes_to_str(tvb, index, avp_len));
 911                         break;
 912
 913                 case PRIVATE_GROUP_ID:
 914                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 915                           "Private Group ID: %s",
 916                           tvb_bytes_to_str(tvb, index, avp_len));
 917                         break;
 918
 919                 case RX_CONNECT_SPEED:
 920                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 921                           "Rx Connect Speed: %u",
 922                           tvb_get_ntohl(tvb, index));
 923                         break;
 924
 925                 case PPP_DISCONNECT_CAUSE_CODE:
 926                         if (avp_len < 2)
 927                                 break;
 928                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 2,
 929                           "Disconnect Code: %u",
 930                           tvb_get_ntohs(tvb, index));
 931                         index += 2;
 932                         avp_len -= 2;
 933
 934                         if (avp_len < 2)
 935                                 break;
 936                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 2,
 937                           "Control Protocol Number: %u",
 938                           tvb_get_ntohs(tvb, index));
 939                         index += 2;
 940                         avp_len -= 2;
 941
 942                         if (avp_len < 1)
 943                                 break;
 944                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 1,
 945                           "Direction: %s",
 946                           val_to_str(tvb_get_guint8(tvb, index),
 947                                      cause_code_direction_vals,
 948                                      "Reserved (%u)"));
 949                         index += 1;
 950                         avp_len -= 1;
 951
 952                         if (avp_len == 0)
 953                                 break;
 954                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 955                           "Message: %.*s", avp_len,
 956                           tvb_get_ptr(tvb, index, avp_len));
 957                         break;
 958
 959                 default:
 960                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 961                           "Unknown AVP");
 962                         break;
 963                 }
 964
 965                 /* printf("Avp Decode avp_len= %d index= %d length= %d %x\n ",avp_len,
 966                    index,length,length); */
 967
 968                 index += avp_len;
 969         }
 970
 971   }
 972 }
 973
 974 /* registration with the filtering engine */
 975 void
 976 proto_register_l2tp(void)
 977 {
 978         static hf_register_info hf[] = {
 979                 { &hf_l2tp_type,
 980                 { "Type", "lt2p.type", FT_UINT16, BASE_DEC, VALS(l2tp_type_vals), 0x8000,
 981                         "Type bit", HFILL }},
 982
 983                 { &hf_l2tp_length_bit,
 984                 { "Length Bit", "lt2p.length_bit", FT_BOOLEAN, 16, TFS(&l2tp_length_bit_truth), 0x4000,
 985                         "Length bit", HFILL }},
 986
 987                 { &hf_l2tp_seq_bit,
 988                 { "Sequence Bit", "lt2p.seq_bit", FT_BOOLEAN, 16, TFS(&l2tp_seq_bit_truth), 0x0800,
 989                         "Sequence bit", HFILL }},
 990
 991                 { &hf_l2tp_offset_bit,
 992                 { "Offset bit", "lt2p.offset_bit", FT_BOOLEAN, 16, TFS(&l2tp_offset_bit_truth), 0x0200,
 993                         "Offset bit", HFILL }},
 994
 995                 { &hf_l2tp_priority,
 996                 { "Priority", "lt2p.priority", FT_BOOLEAN, 16, TFS(&l2tp_priority_truth), 0x0100,
 997                         "Priority bit", HFILL }},
 998
 999                 { &hf_l2tp_version,
1000                 { "Version", "lt2p.version", FT_UINT16, BASE_DEC, NULL, 0x000f,
1001                         "Version", HFILL }},
1002
1003                 { &hf_l2tp_length,
1004                 { "Length","l2tp.length", FT_UINT16, BASE_DEC, NULL, 0x0,
1005                         "", HFILL }},
1006
1007                 { &hf_l2tp_tunnel,
1008                 { "Tunnel ID","l2tp.tunnel", FT_UINT16, BASE_DEC, NULL, 0x0, /* Probably should be FT_BYTES */
1009                         "Tunnel ID", HFILL }},
1010
1011                 { &hf_l2tp_session,
1012                 { "Session ID","l2tp.session", FT_UINT16, BASE_DEC, NULL, 0x0, /* Probably should be FT_BYTES */
1013                         "Session ID", HFILL }},
1014
1015                 { &hf_l2tp_Ns,
1016                 { "Ns","l2tp.Ns", FT_UINT16, BASE_DEC, NULL, 0x0,
1017                         "", HFILL }},
1018
1019                 { &hf_l2tp_Nr,
1020                 { "Nr","l2tp.Nr", FT_UINT16, BASE_DEC, NULL, 0x0,
1021                         "", HFILL }},
1022
1023                 { &hf_l2tp_offset,
1024                 { "Offset","l2tp.offset", FT_UINT16, BASE_DEC, NULL, 0x0,
1025                         "Number of octest past the L2TP header at which the"
1026                                 "payload data starts.", HFILL }},
1027
1028                 { &hf_l2tp_avp_mandatory,
1029                 { "Mandatory", "lt2p.avp.mandatory", FT_BOOLEAN, BASE_NONE, NULL, 0,
1030                         "Mandatory AVP", HFILL }},
1031
1032                 { &hf_l2tp_avp_hidden,
1033                 { "Hidden", "lt2p.avp.hidden", FT_BOOLEAN, BASE_NONE, NULL, 0,
1034                         "Hidden AVP", HFILL }},
1035
1036                 { &hf_l2tp_avp_length,
1037                 { "Length", "lt2p.avp.length", FT_UINT16, BASE_DEC, NULL, 0,
1038                         "AVP Length", HFILL }},
1039
1040                 { &hf_l2tp_avp_vendor_id,
1041                 { "Vendor ID", "lt2p.avp.vendor_id", FT_UINT16, BASE_DEC, VALS(avp_vendor_id_vals), 0,
1042                         "AVP Vendor ID", HFILL }},
1043
1044                 { &hf_l2tp_avp_type,
1045                 { "Type", "lt2p.avp.type", FT_UINT16, BASE_DEC, VALS(avp_type_vals), 0,
1046                         "AVP Type", HFILL }},
1047
1048                 { &hf_l2tp_tie_breaker,
1049                 { "Tie Breaker", "lt2p.tie_breaker", FT_UINT64, BASE_HEX, NULL, 0,
1050                         "Tie Breaker", HFILL }},
1051
1052         };
1053
1054         static gint *ett[] = {
1055                 &ett_l2tp,
1056                 &ett_l2tp_ctrl,
1057                 &ett_l2tp_avp,
1058         };
1059
1060         proto_l2tp = proto_register_protocol(
1061                 "Layer 2 Tunneling Protocol", "L2TP", "l2tp");
1062         proto_register_field_array(proto_l2tp, hf, array_length(hf));
1063         proto_register_subtree_array(ett, array_length(ett));
1064 }
1065
1066 void
1067 proto_reg_handoff_l2tp(void)
1068 {
1069         dissector_handle_t l2tp_handle;
1070
1071         l2tp_handle = create_dissector_handle(dissect_l2tp, proto_l2tp);
1072         dissector_add("udp.port", UDP_PORT_L2TP, l2tp_handle);
1073
1074         /*
1075          * Get a handle for the PPP-in-HDLC-like-framing dissector.
1076          */
1077         ppp_hdlc_handle = find_dissector("ppp_hdlc");
1078 }