packet-l2tp.c

   1 /* packet-l2tp.c
   2  * Routines for Layer Two Tunnelling Protocol (L2TP) (RFC 2661) packet
   3  * disassembly
   4  * John Thomes <john@ensemblecom.com>
   5  *
   6  * Minor changes by: (2000-01-10)
   7  * Laurent Cazalet <laurent.cazalet@mailclub.net>
   8  * Thomas Parvais <thomas.parvais@advalvas.be>
   9  *
  10  * $Id: packet-l2tp.c,v 1.35 2002/08/28 21:00:19 jmayer Exp $
  11  *
  12  * Ethereal - Network traffic analyzer
  13  * By Gerald Combs <gerald@ethereal.com>
  14  * Copyright 1998 Gerald Combs
  15  *
  16  * This program is free software; you can redistribute it and/or
  17  * modify it under the terms of the GNU General Public License
  18  * as published by the Free Software Foundation; either version 2
  19  * of the License, or (at your option) any later version.
  20  *
  21  * This program is distributed in the hope that it will be useful,
  22  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  23  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  24  * GNU General Public License for more details.
  25  *
  26  * You should have received a copy of the GNU General Public License
  27  * along with this program; if not, write to the Free Software
  28  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  29  */
  30
  31 static int proto_l2tp = -1;
  32 static int hf_l2tp_type = -1;
  33 static int hf_l2tp_length_bit = -1;
  34 static int hf_l2tp_seq_bit = -1;
  35 static int hf_l2tp_offset_bit = -1;
  36 static int hf_l2tp_priority = -1;
  37 static int hf_l2tp_version = -1;
  38 static int hf_l2tp_length = -1;
  39 static int hf_l2tp_tunnel = -1;
  40 static int hf_l2tp_session = -1;
  41 static int hf_l2tp_Ns = -1;
  42 static int hf_l2tp_Nr = -1;
  43 static int hf_l2tp_offset = -1;
  44 static int hf_l2tp_avp_mandatory = -1;
  45 static int hf_l2tp_avp_hidden = -1;
  46 static int hf_l2tp_avp_length = -1;
  47 static int hf_l2tp_avp_vendor_id = -1;
  48 static int hf_l2tp_avp_type = -1;
  49 static int hf_l2tp_tie_breaker = -1;
  50
  51 #ifdef HAVE_CONFIG_H
  52 #include "config.h"
  53 #endif
  54
  55 #include <stdio.h>
  56 #include <stdlib.h>
  57 #include <string.h>
  58 #include <ctype.h>
  59 #include <glib.h>
  60 #include <epan/packet.h>
  61 #include <epan/resolv.h>
  62
  63 #define UDP_PORT_L2TP   1701
  64
  65 #define CONTROL_BIT(msg_info) (msg_info & 0x8000)   /* Type bit control = 1 data = 0 */
  66 #define LENGTH_BIT(msg_info) (msg_info & 0x4000)    /* Length bit = 1  */
  67 #define RESERVE_BITS(msg_info) (msg_info &0x37F8)   /* Reserved bit - usused */
  68 #define SEQUENCE_BIT(msg_info) (msg_info & 0x0800)  /* SEQUENCE bit = 1 Ns and Nr fields */
  69 #define OFFSET_BIT(msg_info) (msg_info & 0x0200)    /* Offset */
  70 #define PRIORITY_BIT(msg_info) (msg_info & 0x0100)  /* Priority */
  71 #define L2TP_VERSION(msg_info) (msg_info & 0x000f)  /* Version of l2tp */
  72 #define MANDATORY_BIT(msg_info) (msg_info & 0x8000) /* Mandatory = 1 */
  73 #define HIDDEN_BIT(msg_info) (msg_info & 0x4000)    /* Hidden = 1 */
  74 #define AVP_LENGTH(msg_info) (msg_info & 0x03ff)    /* AVP Length */
  75 #define FRAMING_SYNC(msg_info)  (msg_info & 0x0001) /* SYNC Framing Type */
  76 #define FRAMING_ASYNC(msg_info) (msg_info & 0x0002) /* ASYNC Framing Type */
  77 #define BEARER_DIGITAL(msg_info) (msg_info & 0x0001) /* Digital Bearer Type */
  78 #define BEARER_ANALOG(msg_info) (msg_info & 0x0002) /* Analog Bearer Type */
  79
  80 static gint ett_l2tp = -1;
  81 static gint ett_l2tp_ctrl = -1;
  82 static gint ett_l2tp_avp = -1;
  83
  84 #define AVP_SCCRQ      1
  85 #define AVP_SCCRP      2
  86 #define AVP_SCCCN      3
  87 #define AVP_StopCCN    4
  88 #define AVP_Reserved   5
  89 #define AVP_HELLO      6
  90 #define AVP_OCRQ       7
  91 #define AVP_OCRP       8
  92 #define AVP_ORCRP      9
  93 #define AVP_ICRQ      10
  94 #define AVP_ICRP      11
  95 #define AVP_ICCN      12
  96 #define AVP_Reserved1 13
  97 #define AVP_CDN       14
  98
  99
 100 #define NUM_CONTROL_CALL_TYPES  16
 101 static const char *calltypestr[NUM_CONTROL_CALL_TYPES+1] = {
 102   "Unknown Call Type           ",
 103   "Start_Control_Request       ",
 104   "Start_Control_Reply         ",
 105   "Start_Control_Connected     ",
 106   "Stop_Control_Notification   ",
 107   "Reserved                    ",
 108   "Hello                       ",
 109   "Outgoing_Call_Request       ",
 110   "Outgoing_Call_Reply         ",
 111   "Outgoing_Call_Connected     ",
 112   "Incoming_Call_Request       ",
 113   "Incoming_Call_Reply         ",
 114   "Incoming_Call_Connected     ",
 115   "Reserved                    ",
 116   "Call_Disconnect_Notification",
 117   "WAN_Error_Notify            ",
 118   "Set_Link_Info               ",
 119 };
 120
 121 static const char *calltype_short_str[NUM_CONTROL_CALL_TYPES+1] = {
 122   "Unknown ",
 123   "SCCRQ   ",
 124   "SCCRP   ",
 125   "SCCCN   ",
 126   "StopCCN ",
 127   "Reserved",
 128   "Hello   ",
 129   "OCRQ    ",
 130   "OCRP    ",
 131   "OCCN    ",
 132   "ICRQ    ",
 133   "ICRP    ",
 134   "ICCN    ",
 135   "Reserved",
 136   "CDN     ",
 137   "WEN     ",
 138   "SLI     ",
 139 };
 140
 141
 142 static const char *control_msg  = "Control Message";
 143 static const char *data_msg     = "Data    Message";
 144 static const value_string l2tp_type_vals[] = {
 145         { 0, "Data Message" },
 146         { 1, "Control Message" },
 147         { 0, NULL },
 148 };
 149
 150 static const value_string cause_code_direction_vals[] = {
 151         { 0, "global error" },
 152         { 1, "at peer" },
 153         { 2, "at local" },
 154         { 0, NULL },
 155 };
 156
 157 static const true_false_string l2tp_length_bit_truth =
 158         { "Length field is present", "Length field is not present" };
 159
 160 static const true_false_string l2tp_seq_bit_truth =
 161         { "Ns and Nr fields are present", "Ns and Nr fields are not present" };
 162
 163 static const true_false_string l2tp_offset_bit_truth =
 164         { "Offset Size field is present", "Offset size field is not present" };
 165
 166 static const true_false_string l2tp_priority_truth =
 167         { "This data message has priority", "No priority" };
 168
 169 static const value_string authen_type_vals[] = {
 170   { 0, "Reserved" },
 171   { 1, "Textual username and password" },
 172   { 2, "PPP CHAP" },
 173   { 3, "PPP PAP" },
 174   { 4, "No Authentication" },
 175   { 5, "Microsoft CHAP Version 1" },
 176   { 0, NULL }
 177 };
 178
 179 #define  CONTROL_MESSAGE  0
 180 #define  RESULT_ERROR_CODE 1
 181 #define  PROTOCOL_VERSION  2
 182 #define  FRAMING_CAPABILITIES 3
 183 #define  BEARER_CAPABILITIES 4
 184 #define  TIE_BREAKER 5
 185 #define  FIRMWARE_REVISION 6
 186 #define  HOST_NAME 7
 187 #define  VENDOR_NAME 8
 188 #define  ASSIGNED_TUNNEL_ID 9
 189 #define  RECEIVE_WINDOW_SIZE 10
 190 #define  CHALLENGE 11
 191 #define  CAUSE_CODE 12
 192 #define  CHALLENGE_RESPONSE 13
 193 #define  ASSIGNED_SESSION 14
 194 #define  CALL_SERIAL_NUMBER 15
 195 #define  MINIMUM_BPS 16
 196 #define  MAXIMUM_BPS 17
 197 #define  BEARER_TYPE 18
 198 #define  FRAMING_TYPE 19
 199 #define  CALLED_NUMBER 21
 200 #define  CALLING_NUMBER 22
 201 #define  SUB_ADDRESS 23
 202 #define  TX_CONNECT_SPEED 24
 203 #define  PHYSICAL_CHANNEL 25
 204 #define  INITIAL_RECEIVED_LCP 26
 205 #define  LAST_SEND_LCP_CONFREQ 27
 206 #define  LAST_RECEIVED_LCP_CONFREQ 28
 207 #define  PROXY_AUTHEN_TYPE 29
 208 #define  PROXY_AUTHEN_NAME 30
 209 #define  PROXY_AUTHEN_CHALLENGE 31
 210 #define  PROXY_AUTHEN_ID 32
 211 #define  PROXY_AUTHEN_RESPONSE 33
 212 #define  CALL_STATUS_AVPS 34
 213 #define  ACCM 35
 214 #define  RANDOM_VECTOR 36
 215 #define  PRIVATE_GROUP_ID 37
 216 #define  RX_CONNECT_SPEED 38
 217 #define  SEQUENCING_REQUIRED 39
 218 #define  PPP_DISCONNECT_CAUSE_CODE 46   /* RFC 3145 */
 219
 220 #define NUM_AVP_TYPES  40
 221 static const value_string avp_type_vals[] = {
 222   { CONTROL_MESSAGE,           "Control Message" },
 223   { RESULT_ERROR_CODE,         "Result-Error Code" },
 224   { PROTOCOL_VERSION,          "Protocol Version" },
 225   { FRAMING_CAPABILITIES,      "Framing Capabilities" },
 226   { BEARER_CAPABILITIES,       "Bearer Capabilities" },
 227   { TIE_BREAKER,               "Tie Breaker" },
 228   { FIRMWARE_REVISION,         "Firmware Revision" },
 229   { HOST_NAME,                 "Host Name" },
 230   { VENDOR_NAME,               "Vendor Name" },
 231   { ASSIGNED_TUNNEL_ID,        "Assigned Tunnel ID" },
 232   { RECEIVE_WINDOW_SIZE,       "Receive Window Size" },
 233   { CHALLENGE,                 "Challenge" },
 234   { CAUSE_CODE,                "Cause Code" },
 235   { CHALLENGE_RESPONSE,        "Challenge Response" },
 236   { ASSIGNED_SESSION,          "Assigned Session" },
 237   { CALL_SERIAL_NUMBER,        "Call Serial Number" },
 238   { MINIMUM_BPS,               "Minimum BPS" },
 239   { MAXIMUM_BPS,               "Maximum BPS" },
 240   { BEARER_TYPE,               "Bearer Type" },
 241   { FRAMING_TYPE,              "Framing Type" },
 242   { CALLED_NUMBER,             "Called Number" },
 243   { CALLING_NUMBER,            "Calling Number" },
 244   { SUB_ADDRESS,               "Sub-Address" },
 245   { TX_CONNECT_SPEED,          "Connect Speed" },
 246   { PHYSICAL_CHANNEL,          "Physical Channel" },
 247   { INITIAL_RECEIVED_LCP,      "Initial Received LCP" },
 248   { LAST_SEND_LCP_CONFREQ,     "Last Send LCP CONFREQ" },
 249   { LAST_RECEIVED_LCP_CONFREQ, "Last Received LCP CONFREQ" },
 250   { PROXY_AUTHEN_TYPE,         "Proxy Authen Type" },
 251   { PROXY_AUTHEN_NAME,         "Proxy Authen Name" },
 252   { PROXY_AUTHEN_CHALLENGE,    "Proxy Authen Challenge" },
 253   { PROXY_AUTHEN_ID,           "Proxy Authen ID" },
 254   { PROXY_AUTHEN_RESPONSE,     "Proxy Authen Response" },
 255   { CALL_STATUS_AVPS,          "Call status AVPs" },
 256   { ACCM,                      "ACCM" },
 257   { RANDOM_VECTOR,             "Random Vector" },
 258   { PRIVATE_GROUP_ID,          "Private group ID" },
 259   { RX_CONNECT_SPEED,          "RxConnect Speed" },
 260   { SEQUENCING_REQUIRED,       "Sequencing Required" },
 261   { PPP_DISCONNECT_CAUSE_CODE, "PPP Disconnect Cause Code" },
 262   { 0,                         NULL }
 263 };
 264
 265 /*
 266  * These are SMI Network Management Private Enterprise Codes for
 267  * organizations; see
 268  *
 269  *      http://www.isi.edu/in-notes/iana/assignments/enterprise-numbers
 270  *
 271  * for a list.
 272  */
 273 #define VENDOR_IETF 0
 274 #define VENDOR_ACC 5
 275 #define VENDOR_CISCO 9
 276 #define VENDOR_SHIVA 166
 277 #define VENDOR_LIVINGSTON 307
 278 #define VENDOR_3COM 429
 279 #define VENDOR_ASCEND 529
 280 #define VENDOR_BAY 1584
 281 #define VENDOR_REDBACK 2352
 282 #define VENDOR_JUNIPER 2636
 283 #define VENDOR_COSINE 3085
 284 #define VENDOR_UNISPHERE 4874
 285
 286 static const value_string avp_vendor_id_vals[] =
 287 {{VENDOR_IETF,"IETF"},
 288 {VENDOR_ACC,"ACC"},
 289 {VENDOR_CISCO,"Cisco"},
 290 {VENDOR_SHIVA,"Shiva"},
 291 {VENDOR_LIVINGSTON,"Livingston"},
 292 {VENDOR_3COM,"3Com"},
 293 {VENDOR_ASCEND,"Ascend"},
 294 {VENDOR_BAY,"Bay Networks"},
 295 {VENDOR_REDBACK,"Redback"},
 296 {VENDOR_JUNIPER,"Juniper Networks"},
 297 {VENDOR_COSINE,"CoSine Communications"},
 298 {VENDOR_UNISPHERE,"Unisphere Networks"},
 299 {0,NULL}};
 300
 301 static gchar textbuffer[200];
 302
 303 static dissector_handle_t ppp_hdlc_handle;
 304
 305 static void
 306 dissect_l2tp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 307 {
 308   proto_tree *l2tp_tree=NULL, *l2tp_avp_tree, *ctrl_tree;
 309   proto_item *ti, *tf;
 310   int rhcode;
 311   int index = 0;
 312   int tmp_index;
 313   int proto_length = 0;
 314   guint16 length = 0;           /* Length field */
 315   guint16 tid;                  /* Tunnel ID */
 316   guint16 cid;                  /* Call ID */
 317   guint16 offset_size;          /* Offset size */
 318   guint16 ver_len_hidden;
 319   guint16 avp_vendor_id;
 320   guint16 avp_type;
 321   guint16 msg_type;
 322   guint16 avp_len;
 323   guint16 result_code;
 324   guint16 error_code;
 325   guint32 bits;
 326   guint16 firmware_rev;
 327   guint16       control;
 328   tvbuff_t      *next_tvb;
 329
 330   if (check_col(pinfo->cinfo, COL_PROTOCOL))    /* build output for closed L2tp frame displayed  */
 331         col_set_str(pinfo->cinfo, COL_PROTOCOL, "L2TP");
 332   if (check_col(pinfo->cinfo, COL_INFO))
 333         col_clear(pinfo->cinfo, COL_INFO);
 334
 335   control = tvb_get_ntohs(tvb, 0);
 336
 337   if (L2TP_VERSION(control) != 2) {
 338           if (check_col(pinfo->cinfo, COL_INFO)) {
 339                 col_add_fstr(pinfo->cinfo, COL_INFO, "L2TP Version %u", L2TP_VERSION(control) );
 340           }
 341           return;
 342   }
 343
 344   rhcode= 10;
 345
 346   if (LENGTH_BIT(control)) {            /* length field included ? */
 347       index += 2;                       /* skip ahead */
 348       length = tvb_get_ntohs(tvb, index);
 349   }
 350
 351   /* collect the tunnel id & call id */
 352   index += 2;
 353   tid = tvb_get_ntohs(tvb, index);
 354   index += 2;
 355   cid = tvb_get_ntohs(tvb, index);
 356
 357   if (check_col(pinfo->cinfo, COL_INFO)) {
 358         if (CONTROL_BIT(control)) {
 359             /* CONTROL MESSAGE */
 360             tmp_index = index;
 361
 362               if ((LENGTH_BIT(control))&&(length==12))                  /* ZLB Message */
 363                   sprintf(textbuffer,"%s - ZLB      (tunnel id=%d, session id=%d)",
 364                           control_msg , tid ,cid);
 365               else
 366               {
 367                 if (SEQUENCE_BIT(control)) {
 368                     tmp_index += 4;
 369                 }
 370
 371                 tmp_index+=4;
 372
 373                 avp_type = tvb_get_ntohs(tvb, (tmp_index+=2));
 374
 375                 if (avp_type == CONTROL_MESSAGE)
 376                 {
 377                     /* We print message type */
 378                     msg_type = tvb_get_ntohs(tvb, (tmp_index+=2));
 379                     sprintf(textbuffer,"%s - %s (tunnel id=%d, session id=%d)",
 380                             control_msg ,
 381                             ((NUM_CONTROL_CALL_TYPES + 1 ) > msg_type) ?
 382                             calltype_short_str[msg_type] : "Unknown",
 383                             tid ,cid);
 384                 }
 385                 else
 386                 {
 387                     /*
 388                      * This is not a control message.
 389                      * We never pass here except in case of bad l2tp packet!
 390                      */
 391                     sprintf(textbuffer,"%s (tunnel id=%d, session id=%d)",
 392                             control_msg ,  tid ,cid);
 393
 394                 }
 395               }
 396         }
 397         else {
 398             /* DATA Message */
 399                sprintf(textbuffer,"%s            (tunnel id=%d, session id=%d)",
 400                        data_msg, tid ,cid);
 401         }
 402         col_add_fstr(pinfo->cinfo,COL_INFO,textbuffer);
 403   }
 404
 405   if (LENGTH_BIT(control)) {
 406         proto_length = length;
 407   }
 408   else {
 409         proto_length = tvb_length(tvb);
 410   }
 411
 412   if (tree) {
 413         ti = proto_tree_add_item(tree,proto_l2tp, tvb, 0, proto_length, FALSE);
 414         l2tp_tree = proto_item_add_subtree(ti, ett_l2tp);
 415
 416         ti = proto_tree_add_text(l2tp_tree, tvb, 0, 2,
 417                         "Packet Type: %s Tunnel Id=%d Session Id=%d",
 418                         (CONTROL_BIT(control) ? control_msg : data_msg), tid, cid);
 419
 420         ctrl_tree = proto_item_add_subtree(ti, ett_l2tp_ctrl);
 421         proto_tree_add_uint(ctrl_tree, hf_l2tp_type, tvb, 0, 2, control);
 422         proto_tree_add_boolean(ctrl_tree, hf_l2tp_length_bit, tvb, 0, 2, control);
 423         proto_tree_add_boolean(ctrl_tree, hf_l2tp_seq_bit, tvb, 0, 2, control);
 424         proto_tree_add_boolean(ctrl_tree, hf_l2tp_offset_bit, tvb, 0, 2, control);
 425         proto_tree_add_boolean(ctrl_tree, hf_l2tp_priority, tvb, 0, 2, control);
 426         proto_tree_add_uint(ctrl_tree, hf_l2tp_version, tvb, 0, 2, control);
 427   }
 428   index = 2;
 429   if (LENGTH_BIT(control)) {
 430           if (tree) {
 431                 proto_tree_add_item(l2tp_tree, hf_l2tp_length, tvb, index, 2, FALSE);
 432           }
 433         index += 2;
 434   }
 435
 436   if (tree) {
 437         proto_tree_add_item(l2tp_tree, hf_l2tp_tunnel, tvb, index, 2, FALSE);
 438   }
 439   index += 2;
 440   if (tree) {
 441         proto_tree_add_item(l2tp_tree, hf_l2tp_session, tvb, index, 2, FALSE);
 442   }
 443   index += 2;
 444
 445   if (SEQUENCE_BIT(control)) {
 446           if (tree) {
 447                 proto_tree_add_item(l2tp_tree, hf_l2tp_Ns, tvb, index, 2, FALSE);
 448           }
 449           index += 2;
 450           if (tree) {
 451                 proto_tree_add_item(l2tp_tree, hf_l2tp_Nr, tvb, index, 2, FALSE);
 452           }
 453           index += 2;
 454   }
 455   if (OFFSET_BIT(control)) {
 456         offset_size = tvb_get_ntohs(tvb, index);
 457         if (tree) {
 458                 proto_tree_add_uint(l2tp_tree, hf_l2tp_offset, tvb, index, 2,
 459                     offset_size);
 460         }
 461         index += 2;
 462         if (tree) {
 463                 proto_tree_add_text(l2tp_tree, tvb, index, offset_size, "Offset Padding");
 464         }
 465         index += offset_size;
 466   }
 467   if (tree && (LENGTH_BIT(control))&&(length==12)) {
 468             proto_tree_add_text(l2tp_tree, tvb, 0, 0, "Zero Length Bit message");
 469   }
 470
 471   if (!CONTROL_BIT(control)) {  /* Data Messages so we are done */
 472         /* If we have data, signified by having a length bit, dissect it */
 473         if (tvb_offset_exists(tvb, index)) {
 474                 next_tvb = tvb_new_subset(tvb, index, -1, proto_length - index);
 475                 call_dissector(ppp_hdlc_handle, next_tvb, pinfo, tree);
 476         }
 477         return;
 478   }
 479
 480   if (tree) {
 481         if (!LENGTH_BIT(control)) {
 482                 return;
 483         }
 484         while (index < length ) {    /* Process AVP's */
 485                 ver_len_hidden  = tvb_get_ntohs(tvb, index);
 486                 avp_len         = AVP_LENGTH(ver_len_hidden);
 487                 avp_vendor_id   = tvb_get_ntohs(tvb, index + 2);
 488                 avp_type        = tvb_get_ntohs(tvb, index + 4);
 489
 490                 if (avp_vendor_id == VENDOR_IETF) {
 491                         tf =  proto_tree_add_text(l2tp_tree, tvb, index,
 492                         avp_len, "%s AVP",
 493                         val_to_str(avp_type, avp_type_vals, "Unknown (%u)"));
 494                 } else {         /* Vendor-Specific AVP */
 495                         tf =  proto_tree_add_text(l2tp_tree, tvb, index,
 496                         avp_len, "Vendor %s AVP",
 497                         val_to_str(avp_vendor_id, avp_vendor_id_vals, "Unknown (%u)"));
 498                 }
 499
 500                 l2tp_avp_tree = proto_item_add_subtree(tf,  ett_l2tp_avp);
 501
 502                 proto_tree_add_boolean_format(l2tp_avp_tree,hf_l2tp_avp_mandatory, tvb, index, 1,
 503                                            rhcode, "Mandatory: %s",
 504                                            (MANDATORY_BIT(ver_len_hidden)) ? "True" : "False" );
 505                 proto_tree_add_boolean_format(l2tp_avp_tree,hf_l2tp_avp_hidden, tvb, index, 1,
 506                                            rhcode, "Hidden: %s",
 507                                            (HIDDEN_BIT(ver_len_hidden)) ? "True" : "False" );
 508                 proto_tree_add_uint_format(l2tp_avp_tree,hf_l2tp_avp_length, tvb, index, 2,
 509                                            rhcode, "Length: %u", avp_len);
 510                 if (HIDDEN_BIT(ver_len_hidden)) { /* don't try do display hidden */
 511                         index += avp_len;
 512                         continue;
 513                 }
 514
 515                 if (avp_len == 0) {
 516                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 0,
 517                           "AVP length must not be zero");
 518                         return;
 519                 }
 520                 index += 2;
 521                 avp_len -= 2;
 522
 523                 proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_vendor_id,
 524                     tvb, index, 2, FALSE);
 525                 index += 2;
 526                 avp_len -= 2;
 527
 528                 if (avp_vendor_id != VENDOR_IETF) {
 529                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 2,
 530                                             "Type: %u", avp_type);
 531                         index += 2;
 532                         avp_len -= 2;
 533
 534                         /* For the time being, we don't decode any Vendor-
 535                            specific AVP. */
 536                         proto_tree_add_text(l2tp_avp_tree, tvb, index,
 537                                             avp_len, "Vendor-Specific AVP");
 538
 539                         index += avp_len;
 540                         continue;
 541                 }
 542
 543                 proto_tree_add_uint(l2tp_avp_tree, hf_l2tp_avp_type,
 544                     tvb, index, 2, avp_type);
 545                 index += 2;
 546                 avp_len -= 2;
 547
 548                 switch (avp_type) {
 549
 550                 case CONTROL_MESSAGE:
 551                         msg_type = tvb_get_ntohs(tvb, index);
 552                         proto_tree_add_text(l2tp_avp_tree,tvb, index, 2,
 553                           "Control Message Type: (%u) %s", msg_type,
 554                           ((NUM_CONTROL_CALL_TYPES + 1 ) > msg_type) ?
 555                           calltypestr[msg_type] : "Unknown");
 556                         break;
 557
 558                 case RESULT_ERROR_CODE:
 559                         if (avp_len < 2)
 560                                 break;
 561                         result_code = tvb_get_ntohs(tvb, index);
 562                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 2,
 563                           "Result code: %u",  result_code);
 564                         index += 2;
 565                         avp_len -= 2;
 566
 567                         if (avp_len < 2)
 568                                 break;
 569                         error_code = tvb_get_ntohs(tvb, index);
 570                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 2,
 571                           "Error code: %u", error_code);
 572                         index += 2;
 573                         avp_len -= 2;
 574
 575                         if (avp_len == 0)
 576                                 break;
 577                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 578                           "Error Message: %.*s", avp_len,
 579                           tvb_get_ptr(tvb, index, avp_len));
 580                         break;
 581
 582                 case PROTOCOL_VERSION:
 583                         if (avp_len < 1)
 584                                 break;
 585                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 1,
 586                           "Version: %u", tvb_get_guint8(tvb, index));
 587                         index += 1;
 588                         avp_len -= 1;
 589
 590                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 1,
 591                           "Revision: %u", tvb_get_guint8(tvb, index));
 592                         break;
 593
 594                 case FRAMING_CAPABILITIES:
 595                         bits = tvb_get_ntohl(tvb, index);
 596                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 597                           "Async Framing Supported: %s",
 598                           (FRAMING_ASYNC(bits)) ? "True" : "False");
 599                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 600                           "Sync Framing Supported: %s",
 601                           (FRAMING_SYNC(bits)) ? "True" : "False");
 602                         break;
 603
 604                 case BEARER_CAPABILITIES:
 605                         bits = tvb_get_ntohl(tvb, index);
 606                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 607                           "Analog Access Supported: %s",
 608                           (BEARER_ANALOG(bits)) ? "True" : "False");
 609                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 610                           "Digital Access Supported: %s",
 611                           (BEARER_DIGITAL(bits)) ? "True" : "False");
 612                         break;
 613
 614                 case TIE_BREAKER:
 615                         proto_tree_add_item(l2tp_avp_tree, hf_l2tp_tie_breaker, tvb, index, 8, FALSE);
 616                         break;
 617
 618                 case FIRMWARE_REVISION:
 619                         firmware_rev = tvb_get_ntohs(tvb, index);
 620                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 2,
 621                           "Firmware Revision: %d 0x%x", firmware_rev,firmware_rev );
 622                         break;
 623
 624                 case HOST_NAME:
 625                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 626                           "Host Name: %.*s", avp_len,
 627                           tvb_get_ptr(tvb, index, avp_len));
 628                         break;
 629
 630                 case VENDOR_NAME:
 631                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 632                           "Vendor Name: %.*s", avp_len,
 633                           tvb_get_ptr(tvb, index, avp_len));
 634                         break;
 635
 636                 case ASSIGNED_TUNNEL_ID:
 637                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 2,
 638                           "Tunnel ID: %u", tvb_get_ntohs(tvb, index));
 639                         break;
 640
 641                 case RECEIVE_WINDOW_SIZE:
 642                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 2,
 643                           "Receive Window Size: %u",
 644                           tvb_get_ntohs(tvb, index));
 645                         break;
 646
 647                 case CHALLENGE:
 648                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 649                           "CHAP Challenge: %s",
 650                           tvb_bytes_to_str(tvb, index, avp_len));
 651                         break;
 652
 653                 case CAUSE_CODE:
 654                         /*
 655                          * XXX - export stuff from the Q.931 dissector
 656                          * to dissect the cause code and cause message,
 657                          * and use it.
 658                          */
 659                         if (avp_len < 2)
 660                                 break;
 661                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 2,
 662                           "Cause Code: %u",
 663                           tvb_get_ntohs(tvb, index));
 664                         index += 2;
 665                         avp_len -= 2;
 666
 667                         if (avp_len < 1)
 668                                 break;
 669                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 1,
 670                           "Cause Msg: %u",
 671                           tvb_get_guint8(tvb, index));
 672                         index += 1;
 673                         avp_len -= 1;
 674
 675                         if (avp_len == 0)
 676                                 break;
 677                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 678                           "Advisory Msg: %.*s", avp_len,
 679                           tvb_get_ptr(tvb, index, avp_len));
 680                         break;
 681
 682                 case CHALLENGE_RESPONSE:
 683                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 16,
 684                           "CHAP Challenge Response: %s",
 685                           tvb_bytes_to_str(tvb, index, 16));
 686                         break;
 687
 688                 case ASSIGNED_SESSION:
 689                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 2,
 690                           "Assigned Session: %u",
 691                           tvb_get_ntohs(tvb, index));
 692                         break;
 693
 694                 case CALL_SERIAL_NUMBER:
 695                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 696                           "Call Serial Number: %u",
 697                           tvb_get_ntohl(tvb, index));
 698                         break;
 699
 700                 case MINIMUM_BPS:
 701                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 702                           "Minimum BPS: %u",
 703                           tvb_get_ntohl(tvb, index));
 704                         break;
 705
 706                 case MAXIMUM_BPS:
 707                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 708                           "Maximum BPS: %u",
 709                           tvb_get_ntohl(tvb, index));
 710                         break;
 711
 712                 case BEARER_TYPE:
 713                         bits = tvb_get_ntohl(tvb, index);
 714                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 715                           "Analog Bearer Type: %s",
 716                           (BEARER_ANALOG(bits)) ? "True" : "False");
 717                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 718                           "Digital Bearer Type: %s",
 719                           (BEARER_DIGITAL(bits)) ? "True" : "False");
 720                         break;
 721
 722                 case FRAMING_TYPE:
 723                         bits = tvb_get_ntohl(tvb, index);
 724                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 725                           "Async Framing Type: %s",
 726                           (FRAMING_ASYNC(bits)) ? "True" : "False");
 727                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 728                           "Sync Framing Type: %s",
 729                           (FRAMING_SYNC(bits)) ? "True" : "False");
 730                         break;
 731
 732                 case CALLED_NUMBER:
 733                         if (avp_len == 0)
 734                                 break;
 735                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 736                           "Called Number: %.*s", avp_len,
 737                           tvb_get_ptr(tvb, index, avp_len));
 738                         break;
 739
 740                 case CALLING_NUMBER:
 741                         if (avp_len == 0)
 742                                 break;
 743                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 744                           "Calling Number: %.*s", avp_len,
 745                           tvb_get_ptr(tvb, index, avp_len));
 746                         break;
 747
 748                 case SUB_ADDRESS:
 749                         if (avp_len == 0)
 750                                 break;
 751                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 752                           "Sub-Address: %.*s", avp_len,
 753                           tvb_get_ptr(tvb, index, avp_len));
 754                         break;
 755
 756                 case TX_CONNECT_SPEED:
 757                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 758                           "Connect Speed: %u",
 759                           tvb_get_ntohl(tvb, index));
 760                         break;
 761
 762                 case PHYSICAL_CHANNEL:
 763                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 764                           "Physical Channel: %u",
 765                           tvb_get_ntohl(tvb, index));
 766                         break;
 767
 768                 case INITIAL_RECEIVED_LCP:
 769                         /*
 770                          * XXX - can this be dissected by stuff in the
 771                          * LCP dissector?
 772                          */
 773                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 774                           "Initial LCP CONFREQ: %s",
 775                           tvb_bytes_to_str(tvb, index, avp_len));
 776                         break;
 777
 778                 case LAST_SEND_LCP_CONFREQ:
 779                         /*
 780                          * XXX - can this be dissected by stuff in the
 781                          * LCP dissector?
 782                          */
 783                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 784                           "Last Sent LCP CONFREQ: %s",
 785                           tvb_bytes_to_str(tvb, index, avp_len));
 786                         break;
 787
 788                 case LAST_RECEIVED_LCP_CONFREQ:
 789                         /*
 790                          * XXX - can this be dissected by stuff in the
 791                          * LCP dissector?
 792                          */
 793                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 794                           "Last Received LCP CONFREQ: %s",
 795                           tvb_bytes_to_str(tvb, index, avp_len));
 796                         break;
 797
 798                 case PROXY_AUTHEN_TYPE:
 799                         msg_type = tvb_get_ntohs(tvb, index);
 800                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 2,
 801                           "Proxy Authen Type: %s",
 802                           val_to_str(msg_type, authen_type_vals, "Unknown (%u)"));
 803                         break;
 804
 805                 case PROXY_AUTHEN_NAME:
 806                         if (avp_len == 0)
 807                                 break;
 808                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 809                           "Proxy Authen Name: %.*s", avp_len,
 810                           tvb_get_ptr(tvb, index, avp_len));
 811                         break;
 812
 813                 case PROXY_AUTHEN_CHALLENGE:
 814                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 815                           "Proxy Authen Challenge: %s",
 816                           tvb_bytes_to_str(tvb, index, avp_len));
 817                         break;
 818
 819                 case PROXY_AUTHEN_ID:
 820                         proto_tree_add_text(l2tp_avp_tree, tvb, index + 1, 1,
 821                           "Proxy Authen ID: %u",
 822                           tvb_get_guint8(tvb, index + 1));
 823                         break;
 824
 825                 case PROXY_AUTHEN_RESPONSE:
 826                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 827                           "Proxy Authen Response: %s",
 828                           tvb_bytes_to_str(tvb, index, avp_len));
 829                         break;
 830
 831                 case CALL_STATUS_AVPS:
 832                         if (avp_len < 2)
 833                                 break;
 834                         index += 2;
 835                         avp_len -= 2;
 836
 837                         if (avp_len < 4)
 838                                 break;
 839                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 840                           "CRC Errors: %u", tvb_get_ntohl(tvb, index));
 841                         index += 4;
 842                         avp_len -= 4;
 843
 844                         if (avp_len < 4)
 845                                 break;
 846                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 847                           "Framing Errors: %u", tvb_get_ntohl(tvb, index));
 848                         index += 4;
 849                         avp_len -= 4;
 850
 851                         if (avp_len < 4)
 852                                 break;
 853                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 854                           "Hardware Overruns: %u", tvb_get_ntohl(tvb, index));
 855                         index += 4;
 856                         avp_len -= 4;
 857
 858                         if (avp_len < 4)
 859                                 break;
 860                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 861                           "Buffer Overruns: %u", tvb_get_ntohl(tvb, index));
 862                         index += 4;
 863                         avp_len -= 4;
 864
 865                         if (avp_len < 4)
 866                                 break;
 867                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 868                           "Time-out Errors: %u", tvb_get_ntohl(tvb, index));
 869                         index += 4;
 870                         avp_len -= 4;
 871
 872                         if (avp_len < 4)
 873                                 break;
 874                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 875                           "Alignment Errors: %u", tvb_get_ntohl(tvb, index));
 876                         index += 4;
 877                         avp_len -= 4;
 878                         break;
 879
 880                 case ACCM:
 881                         if (avp_len < 2)
 882                                 break;
 883                         index += 2;
 884                         avp_len -= 2;
 885
 886                         if (avp_len < 4)
 887                                 break;
 888                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 889                           "Send ACCM: %u", tvb_get_ntohl(tvb, index));
 890                         index += 4;
 891                         avp_len -= 4;
 892
 893                         if (avp_len < 4)
 894                                 break;
 895                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 896                           "Receive ACCM: %u", tvb_get_ntohl(tvb, index));
 897                         index += 4;
 898                         avp_len -= 4;
 899                         break;
 900
 901                 case RANDOM_VECTOR:
 902                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 903                           "Random Vector: %s",
 904                           tvb_bytes_to_str(tvb, index, avp_len));
 905                         break;
 906
 907                 case PRIVATE_GROUP_ID:
 908                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 909                           "Private Group ID: %s",
 910                           tvb_bytes_to_str(tvb, index, avp_len));
 911                         break;
 912
 913                 case RX_CONNECT_SPEED:
 914                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 915                           "Rx Connect Speed: %u",
 916                           tvb_get_ntohl(tvb, index));
 917                         break;
 918
 919                 case PPP_DISCONNECT_CAUSE_CODE:
 920                         if (avp_len < 2)
 921                                 break;
 922                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 2,
 923                           "Disconnect Code: %u",
 924                           tvb_get_ntohs(tvb, index));
 925                         index += 2;
 926                         avp_len -= 2;
 927
 928                         if (avp_len < 2)
 929                                 break;
 930                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 2,
 931                           "Control Protocol Number: %u",
 932                           tvb_get_ntohs(tvb, index));
 933                         index += 2;
 934                         avp_len -= 2;
 935
 936                         if (avp_len < 1)
 937                                 break;
 938                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 1,
 939                           "Direction: %s",
 940                           val_to_str(tvb_get_guint8(tvb, index),
 941                                      cause_code_direction_vals,
 942                                      "Reserved (%u)"));
 943                         index += 1;
 944                         avp_len -= 1;
 945
 946                         if (avp_len == 0)
 947                                 break;
 948                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 949                           "Message: %.*s", avp_len,
 950                           tvb_get_ptr(tvb, index, avp_len));
 951                         break;
 952
 953                 default:
 954                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 955                           "Unknown AVP");
 956                         break;
 957                 }
 958
 959                 /* printf("Avp Decode avp_len= %d index= %d length= %d %x\n ",avp_len,
 960                    index,length,length); */
 961
 962                 index += avp_len;
 963         }
 964
 965   }
 966 }
 967
 968 /* registration with the filtering engine */
 969 void
 970 proto_register_l2tp(void)
 971 {
 972         static hf_register_info hf[] = {
 973                 { &hf_l2tp_type,
 974                 { "Type", "l2tp.type", FT_UINT16, BASE_DEC, VALS(l2tp_type_vals), 0x8000,
 975                         "Type bit", HFILL }},
 976
 977                 { &hf_l2tp_length_bit,
 978                 { "Length Bit", "l2tp.length_bit", FT_BOOLEAN, 16, TFS(&l2tp_length_bit_truth), 0x4000,
 979                         "Length bit", HFILL }},
 980
 981                 { &hf_l2tp_seq_bit,
 982                 { "Sequence Bit", "l2tp.seq_bit", FT_BOOLEAN, 16, TFS(&l2tp_seq_bit_truth), 0x0800,
 983                         "Sequence bit", HFILL }},
 984
 985                 { &hf_l2tp_offset_bit,
 986                 { "Offset bit", "l2tp.offset_bit", FT_BOOLEAN, 16, TFS(&l2tp_offset_bit_truth), 0x0200,
 987                         "Offset bit", HFILL }},
 988
 989                 { &hf_l2tp_priority,
 990                 { "Priority", "l2tp.priority", FT_BOOLEAN, 16, TFS(&l2tp_priority_truth), 0x0100,
 991                         "Priority bit", HFILL }},
 992
 993                 { &hf_l2tp_version,
 994                 { "Version", "l2tp.version", FT_UINT16, BASE_DEC, NULL, 0x000f,
 995                         "Version", HFILL }},
 996
 997                 { &hf_l2tp_length,
 998                 { "Length","l2tp.length", FT_UINT16, BASE_DEC, NULL, 0x0,
 999                         "", HFILL }},
1000
1001                 { &hf_l2tp_tunnel,
1002                 { "Tunnel ID","l2tp.tunnel", FT_UINT16, BASE_DEC, NULL, 0x0, /* Probably should be FT_BYTES */
1003                         "Tunnel ID", HFILL }},
1004
1005                 { &hf_l2tp_session,
1006                 { "Session ID","l2tp.session", FT_UINT16, BASE_DEC, NULL, 0x0, /* Probably should be FT_BYTES */
1007                         "Session ID", HFILL }},
1008
1009                 { &hf_l2tp_Ns,
1010                 { "Ns","l2tp.Ns", FT_UINT16, BASE_DEC, NULL, 0x0,
1011                         "", HFILL }},
1012
1013                 { &hf_l2tp_Nr,
1014                 { "Nr","l2tp.Nr", FT_UINT16, BASE_DEC, NULL, 0x0,
1015                         "", HFILL }},
1016
1017                 { &hf_l2tp_offset,
1018                 { "Offset","l2tp.offset", FT_UINT16, BASE_DEC, NULL, 0x0,
1019                         "Number of octest past the L2TP header at which the"
1020                                 "payload data starts.", HFILL }},
1021
1022                 { &hf_l2tp_avp_mandatory,
1023                 { "Mandatory", "l2tp.avp.mandatory", FT_BOOLEAN, BASE_NONE, NULL, 0,
1024                         "Mandatory AVP", HFILL }},
1025
1026                 { &hf_l2tp_avp_hidden,
1027                 { "Hidden", "l2tp.avp.hidden", FT_BOOLEAN, BASE_NONE, NULL, 0,
1028                         "Hidden AVP", HFILL }},
1029
1030                 { &hf_l2tp_avp_length,
1031                 { "Length", "l2tp.avp.length", FT_UINT16, BASE_DEC, NULL, 0,
1032                         "AVP Length", HFILL }},
1033
1034                 { &hf_l2tp_avp_vendor_id,
1035                 { "Vendor ID", "l2tp.avp.vendor_id", FT_UINT16, BASE_DEC, VALS(avp_vendor_id_vals), 0,
1036                         "AVP Vendor ID", HFILL }},
1037
1038                 { &hf_l2tp_avp_type,
1039                 { "Type", "l2tp.avp.type", FT_UINT16, BASE_DEC, VALS(avp_type_vals), 0,
1040                         "AVP Type", HFILL }},
1041
1042                 { &hf_l2tp_tie_breaker,
1043                 { "Tie Breaker", "l2tp.tie_breaker", FT_UINT64, BASE_HEX, NULL, 0,
1044                         "Tie Breaker", HFILL }},
1045
1046         };
1047
1048         static gint *ett[] = {
1049                 &ett_l2tp,
1050                 &ett_l2tp_ctrl,
1051                 &ett_l2tp_avp,
1052         };
1053
1054         proto_l2tp = proto_register_protocol(
1055                 "Layer 2 Tunneling Protocol", "L2TP", "l2tp");
1056         proto_register_field_array(proto_l2tp, hf, array_length(hf));
1057         proto_register_subtree_array(ett, array_length(ett));
1058 }
1059
1060 void
1061 proto_reg_handoff_l2tp(void)
1062 {
1063         dissector_handle_t l2tp_handle;
1064
1065         l2tp_handle = create_dissector_handle(dissect_l2tp, proto_l2tp);
1066         dissector_add("udp.port", UDP_PORT_L2TP, l2tp_handle);
1067
1068         /*
1069          * Get a handle for the PPP-in-HDLC-like-framing dissector.
1070          */
1071         ppp_hdlc_handle = find_dissector("ppp_hdlc");
1072 }