packet-l2tp.c

   1 /* packet-l2tp.c
   2  * Routines for Layer Two Tunnelling Protocol (L2TP) (RFC 2661) packet
   3  * disassembly
   4  * John Thomes <john@ensemblecom.com>
   5  *
   6  * Minor changes by: (2000-01-10)
   7  * Laurent Cazalet <laurent.cazalet@mailclub.net>
   8  * Thomas Parvais <thomas.parvais@advalvas.be>
   9  *
  10  * $Id: packet-l2tp.c,v 1.26 2001/10/19 09:12:53 guy Exp $
  11  *
  12  * Ethereal - Network traffic analyzer
  13  * By Gerald Combs <gerald@ethereal.com>
  14  * Copyright 1998 Gerald Combs
  15  *
  16  * This program is free software; you can redistribute it and/or
  17  * modify it under the terms of the GNU General Public License
  18  * as published by the Free Software Foundation; either version 2
  19  * of the License, or (at your option) any later version.
  20  *
  21  * This program is distributed in the hope that it will be useful,
  22  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  23  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  24  * GNU General Public License for more details.
  25  *
  26  * You should have received a copy of the GNU General Public License
  27  * along with this program; if not, write to the Free Software
  28  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  29  */
  30
  31
  32 static int proto_l2tp = -1;
  33 static int hf_l2tp_type = -1;
  34 static int hf_l2tp_length_bit = -1;
  35 static int hf_l2tp_seq_bit = -1;
  36 static int hf_l2tp_offset_bit = -1;
  37 static int hf_l2tp_priority = -1;
  38 static int hf_l2tp_version = -1;
  39 static int hf_l2tp_length = -1;
  40 static int hf_l2tp_tunnel = -1;
  41 static int hf_l2tp_session = -1;
  42 static int hf_l2tp_Ns = -1;
  43 static int hf_l2tp_Nr = -1;
  44 static int hf_l2tp_offset = -1;
  45 static int hf_l2tp_avp_mandatory = -1;
  46 static int hf_l2tp_avp_hidden = -1;
  47 static int hf_l2tp_avp_length = -1;
  48 static int hf_l2tp_avp_vendor_id = -1;
  49 static int hf_l2tp_avp_type = -1;
  50
  51 #ifdef HAVE_CONFIG_H
  52 #include "config.h"
  53 #endif
  54
  55 #ifdef HAVE_SYS_TYPES_H
  56 # include <sys/types.h>
  57 #endif
  58
  59 #ifdef HAVE_NETINET_IN_H
  60 #include <netinet/in.h>
  61 #endif
  62
  63 #include <stdio.h>
  64 #include <stdlib.h>
  65 #include <string.h>
  66 #include <ctype.h>
  67 #include <glib.h>
  68 #include "packet.h"
  69 #include "resolv.h"
  70
  71 #define UDP_PORT_L2TP   1701
  72
  73 #define CONTROL_BIT(msg_info) (msg_info & 0x8000)   /* Type bit control = 1 data = 0 */
  74 #define LENGTH_BIT(msg_info) (msg_info & 0x4000)    /* Length bit = 1  */
  75 #define RESERVE_BITS(msg_info) (msg_info &0x37F8)   /* Reserved bit - usused */
  76 #define SEQUENCE_BIT(msg_info) (msg_info & 0x0800)  /* SEQUENCE bit = 1 Ns and Nr fields */
  77 #define OFFSET_BIT(msg_info) (msg_info & 0x0200)    /* Offset */
  78 #define PRIORITY_BIT(msg_info) (msg_info & 0x0100)  /* Priority */
  79 #define L2TP_VERSION(msg_info) (msg_info & 0x000f)  /* Version of l2tp */
  80 #define MANDATORY_BIT(msg_info) (msg_info & 0x8000) /* Mandatory = 1 */
  81 #define HIDDEN_BIT(msg_info) (msg_info & 0x4000)    /* Hidden = 1 */
  82 #define AVP_LENGTH(msg_info) (msg_info & 0x03ff)    /* AVP Length */
  83 #define FRAMING_SYNC(msg_info)  (msg_info & 0x0001) /* SYNC Framing Type */
  84 #define FRAMING_ASYNC(msg_info) (msg_info & 0x0002) /* ASYNC Framing Type */
  85 #define BEARER_DIGITAL(msg_info) (msg_info & 0x0001) /* Digital Bearer Type */
  86 #define BEARER_ANALOG(msg_info) (msg_info & 0x0002) /* Analog Bearer Type */
  87
  88 static gint ett_l2tp = -1;
  89 static gint ett_l2tp_ctrl = -1;
  90 static gint ett_l2tp_avp = -1;
  91
  92 #define AVP_SCCRQ      1
  93 #define AVP_SCCRP      2
  94 #define AVP_SCCCN      3
  95 #define AVP_StopCCN    4
  96 #define AVP_Reserved   5
  97 #define AVP_HELLO      6
  98 #define AVP_OCRQ       7
  99 #define AVP_OCRP       8
 100 #define AVP_ORCRP      9
 101 #define AVP_ICRQ      10
 102 #define AVP_ICRP      11
 103 #define AVP_ICCN      12
 104 #define AVP_Reserved1 13
 105 #define AVP_CDN       14
 106
 107
 108 #define NUM_CONTROL_CALL_TYPES  16
 109 static const char *calltypestr[NUM_CONTROL_CALL_TYPES+1] = {
 110   "Unknown Call Type           ",
 111   "Start_Control_Request       ",
 112   "Start_Control_Reply         ",
 113   "Start_Control_Connected     ",
 114   "Stop_Control_Notification   ",
 115   "Reserved                    ",
 116   "Hello                       ",
 117   "Outgoing_Call_Request       ",
 118   "Outgoing_Call_Reply         ",
 119   "Outgoing_Call_Connected     ",
 120   "Incoming_Call_Request       ",
 121   "Incoming_Call_Reply         ",
 122   "Incoming_Call_Connected     ",
 123   "Reserved                    ",
 124   "Call_Disconnect_Notification",
 125   "WAN_Error_Notify            ",
 126   "Set_Link_Info               ",
 127 };
 128
 129 static const char *calltype_short_str[NUM_CONTROL_CALL_TYPES+1] = {
 130   "Unknown ",
 131   "SCCRQ   ",
 132   "SCCRP   ",
 133   "SCCCN   ",
 134   "StopCCN ",
 135   "Reserved",
 136   "Hello   ",
 137   "OCRQ    ",
 138   "OCRP    ",
 139   "OCCN    ",
 140   "ICRQ    ",
 141   "ICRP    ",
 142   "ICCN    ",
 143   "Reserved",
 144   "CDN     ",
 145   "WEN     ",
 146   "SLI     ",
 147 };
 148
 149
 150 static const char *control_msg  = "Control Message";
 151 static const char *data_msg     = "Data    Message";
 152 static const value_string l2tp_type_vals[] = {
 153         { 0, "Data Message" },
 154         { 1, "Control Message" },
 155         { 0, NULL },
 156 };
 157
 158 static const value_string cause_code_direction_vals[] = {
 159         { 0, "global error" },
 160         { 1, "at peer" },
 161         { 2, "at local" },
 162         { 0, NULL },
 163 };
 164
 165 static const true_false_string l2tp_length_bit_truth =
 166         { "Length field is present", "Length field is not present" };
 167
 168 static const true_false_string l2tp_seq_bit_truth =
 169         { "Ns and Nr fields are present", "Ns and Nr fields are not present" };
 170
 171 static const true_false_string l2tp_offset_bit_truth =
 172         { "Offset Size field is present", "Offset size field is not present" };
 173
 174 static const true_false_string l2tp_priority_truth =
 175         { "This data message has priority", "No priority" };
 176
 177 static const value_string authen_type_vals[] = {
 178   { 0, "Reserved" },
 179   { 1, "Textual username and password" },
 180   { 2, "PPP CHAP" },
 181   { 3, "PPP PAP" },
 182   { 4, "No Authentication" },
 183   { 5, "Microsoft CHAP Version 1" },
 184   { 0, NULL }
 185 };
 186
 187 #define  CONTROL_MESSAGE  0
 188 #define  RESULT_ERROR_CODE 1
 189 #define  PROTOCOL_VERSION  2
 190 #define  FRAMING_CAPABILITIES 3
 191 #define  BEARER_CAPABILITIES 4
 192 #define  TIE_BREAKER 5
 193 #define  FIRMWARE_REVISION 6
 194 #define  HOST_NAME 7
 195 #define  VENDOR_NAME 8
 196 #define  ASSIGNED_TUNNEL_ID 9
 197 #define  RECEIVE_WINDOW_SIZE 10
 198 #define  CHALLENGE 11
 199 #define  CAUSE_CODE 12
 200 #define  CHALLENGE_RESPONSE 13
 201 #define  ASSIGNED_SESSION 14
 202 #define  CALL_SERIAL_NUMBER 15
 203 #define  MINIMUM_BPS 16
 204 #define  MAXIMUM_BPS 17
 205 #define  BEARER_TYPE 18
 206 #define  FRAMING_TYPE 19
 207 #define  CALLED_NUMBER 21
 208 #define  CALLING_NUMBER 22
 209 #define  SUB_ADDRESS 23
 210 #define  TX_CONNECT_SPEED 24
 211 #define  PHYSICAL_CHANNEL 25
 212 #define  INITIAL_RECEIVED_LCP 26
 213 #define  LAST_SEND_LCP_CONFREQ 27
 214 #define  LAST_RECEIVED_LCP_CONFREQ 28
 215 #define  PROXY_AUTHEN_TYPE 29
 216 #define  PROXY_AUTHEN_NAME 30
 217 #define  PROXY_AUTHEN_CHALLENGE 31
 218 #define  PROXY_AUTHEN_ID 32
 219 #define  PROXY_AUTHEN_RESPONSE 33
 220 #define  CALL_STATUS_AVPS 34
 221 #define  ACCM 35
 222 #define  RANDOM_VECTOR 36
 223 #define  PRIVATE_GROUP_ID 37
 224 #define  RX_CONNECT_SPEED 38
 225 #define  SEQUENCING_REQUIRED 39
 226 #define  PPP_DISCONNECT_CAUSE_CODE 46   /* RFC 3145 */
 227
 228 #define NUM_AVP_TYPES  40
 229 static const value_string avp_type_vals[] = {
 230   { CONTROL_MESSAGE,           "Control Message" },
 231   { RESULT_ERROR_CODE,         "Result-Error Code" },
 232   { PROTOCOL_VERSION,          "Protocol Version" },
 233   { FRAMING_CAPABILITIES,      "Framing Capabilities" },
 234   { BEARER_CAPABILITIES,       "Bearer Capabilities" },
 235   { TIE_BREAKER,               "Tie Breaker" },
 236   { FIRMWARE_REVISION,         "Firmware Revision" },
 237   { HOST_NAME,                 "Host Name" },
 238   { VENDOR_NAME,               "Vendor Name" },
 239   { ASSIGNED_TUNNEL_ID,        "Assigned Tunnel ID" },
 240   { RECEIVE_WINDOW_SIZE,       "Receive Window Size" },
 241   { CHALLENGE,                 "Challenge" },
 242   { CAUSE_CODE,                "Cause Code" },
 243   { CHALLENGE_RESPONSE,        "Challenge Response" },
 244   { ASSIGNED_SESSION,          "Assigned Session" },
 245   { CALL_SERIAL_NUMBER,        "Call Serial Number" },
 246   { MINIMUM_BPS,               "Minimum BPS" },
 247   { MAXIMUM_BPS,               "Maximum BPS" },
 248   { BEARER_TYPE,               "Bearer Type" },
 249   { FRAMING_TYPE,              "Framing Type" },
 250   { CALLED_NUMBER,             "Called Number" },
 251   { CALLING_NUMBER,            "Calling Number" },
 252   { SUB_ADDRESS,               "Sub-Address" },
 253   { TX_CONNECT_SPEED,          "Connect Speed" },
 254   { PHYSICAL_CHANNEL,          "Physical Channel" },
 255   { INITIAL_RECEIVED_LCP,      "Initial Received LCP" },
 256   { LAST_SEND_LCP_CONFREQ,     "Last Send LCP CONFREQ" },
 257   { LAST_RECEIVED_LCP_CONFREQ, "Last Received LCP CONFREQ" },
 258   { PROXY_AUTHEN_TYPE,         "Proxy Authen Type" },
 259   { PROXY_AUTHEN_NAME,         "Proxy Authen Name" },
 260   { PROXY_AUTHEN_CHALLENGE,    "Proxy Authen Challenge" },
 261   { PROXY_AUTHEN_ID,           "Proxy Authen ID" },
 262   { PROXY_AUTHEN_RESPONSE,     "Proxy Authen Response" },
 263   { CALL_STATUS_AVPS,          "Call status AVPs" },
 264   { ACCM,                      "ACCM" },
 265   { RANDOM_VECTOR,             "Random Vector" },
 266   { PRIVATE_GROUP_ID,          "Private group ID" },
 267   { RX_CONNECT_SPEED,          "RxConnect Speed" },
 268   { SEQUENCING_REQUIRED,       "Sequencing Required" },
 269   { PPP_DISCONNECT_CAUSE_CODE, "PPP Disconnect Cause Code" },
 270   { 0,                         NULL }
 271 };
 272
 273 /*
 274  * These are SMI Network Management Private Enterprise Codes for
 275  * organizations; see
 276  *
 277  *      http://www.isi.edu/in-notes/iana/assignments/enterprise-numbers
 278  *
 279  * for a list.
 280  */
 281 #define VENDOR_IETF 0
 282 #define VENDOR_ACC 5
 283 #define VENDOR_CISCO 9
 284 #define VENDOR_SHIVA 166
 285 #define VENDOR_LIVINGSTON 307
 286 #define VENDOR_3COM 429
 287 #define VENDOR_ASCEND 529
 288 #define VENDOR_BAY 1584
 289 #define VENDOR_JUNIPER 2636
 290 #define VENDOR_COSINE 3085
 291 #define VENDOR_UNISPHERE 4874
 292
 293 static const value_string avp_vendor_id_vals[] =
 294 {{VENDOR_IETF,"IETF"},
 295 {VENDOR_ACC,"ACC"},
 296 {VENDOR_CISCO,"Cisco"},
 297 {VENDOR_SHIVA,"Shiva"},
 298 {VENDOR_LIVINGSTON,"Livingston"},
 299 {VENDOR_3COM,"3Com"},
 300 {VENDOR_ASCEND,"Ascend"},
 301 {VENDOR_BAY,"Bay Networks"},
 302 {VENDOR_JUNIPER,"Juniper Networks"},
 303 {VENDOR_COSINE,"CoSine Communications"},
 304 {VENDOR_UNISPHERE,"Unisphere Networks"},
 305 {0,NULL}};
 306
 307 static gchar textbuffer[200];
 308
 309 static dissector_handle_t ppp_hdlc_handle;
 310
 311 static void
 312 dissect_l2tp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 313 {
 314   proto_tree *l2tp_tree=NULL, *l2tp_avp_tree, *ctrl_tree;
 315   proto_item *ti, *tf;
 316   int rhcode;
 317   int index = 0;
 318   int tmp_index;
 319   int proto_length = 0;
 320   guint16 length = 0;           /* Length field */
 321   guint16 tid;                  /* Tunnel ID */
 322   guint16 cid;                  /* Call ID */
 323   guint16 offset_size;          /* Offset size */
 324   guint16 ver_len_hidden;
 325   guint16 avp_vendor_id;
 326   guint16 avp_type;
 327   guint16 msg_type;
 328   guint16 avp_len;
 329   guint16 result_code;
 330   guint16 error_code;
 331   guint32 bits;
 332   guint16 firmware_rev;
 333   guint16       control;
 334   tvbuff_t      *next_tvb;
 335
 336   if (check_col(pinfo->fd, COL_PROTOCOL))       /* build output for closed L2tp frame displayed  */
 337         col_set_str(pinfo->fd, COL_PROTOCOL, "L2TP");
 338   if (check_col(pinfo->fd, COL_INFO))
 339         col_clear(pinfo->fd, COL_INFO);
 340
 341   control = tvb_get_ntohs(tvb, 0);
 342
 343   if (L2TP_VERSION(control) != 2) {
 344           if (check_col(pinfo->fd, COL_INFO)) {
 345                 col_add_fstr(pinfo->fd, COL_INFO, "L2TP Version %u", L2TP_VERSION(control) );
 346           }
 347           return;
 348   }
 349
 350   rhcode= 10;
 351
 352   if (LENGTH_BIT(control)) {            /* length field included ? */
 353       index += 2;                       /* skip ahead */
 354       length = tvb_get_ntohs(tvb, index);
 355   }
 356
 357   /* collect the tunnel id & call id */
 358   index += 2;
 359   tid = tvb_get_ntohs(tvb, index);
 360   index += 2;
 361   cid = tvb_get_ntohs(tvb, index);
 362
 363   if (check_col(pinfo->fd, COL_INFO)) {
 364         if (CONTROL_BIT(control)) {
 365             /* CONTROL MESSAGE */
 366             tmp_index = index;
 367
 368               if ((LENGTH_BIT(control))&&(length==12))                  /* ZLB Message */
 369                   sprintf(textbuffer,"%s - ZLB      (tunnel id=%d, session id=%d)",
 370                           control_msg , tid ,cid);
 371               else
 372               {
 373                 if (SEQUENCE_BIT(control)) {
 374                     tmp_index += 4;
 375                 }
 376
 377                 tmp_index+=4;
 378
 379                 avp_type = tvb_get_ntohs(tvb, (tmp_index+=2));
 380
 381                 if (avp_type == CONTROL_MESSAGE)
 382                 {
 383                     /* We print message type */
 384                     msg_type = tvb_get_ntohs(tvb, (tmp_index+=2));
 385                     sprintf(textbuffer,"%s - %s (tunnel id=%d, session id=%d)",
 386                             control_msg ,
 387                             ((NUM_CONTROL_CALL_TYPES + 1 ) > msg_type) ?
 388                             calltype_short_str[msg_type] : "Unknown",
 389                             tid ,cid);
 390                 }
 391                 else
 392                 {
 393                     /*
 394                      * This is not a control message.
 395                      * We never pass here except in case of bad l2tp packet!
 396                      */
 397                     sprintf(textbuffer,"%s (tunnel id=%d, session id=%d)",
 398                             control_msg ,  tid ,cid);
 399
 400                 }
 401               }
 402         }
 403         else {
 404             /* DATA Message */
 405                sprintf(textbuffer,"%s            (tunnel id=%d, session id=%d)",
 406                        data_msg, tid ,cid);
 407         }
 408         col_add_fstr(pinfo->fd,COL_INFO,textbuffer);
 409   }
 410
 411   if (LENGTH_BIT(control)) {
 412         proto_length = length;
 413   }
 414   else {
 415         proto_length = tvb_length(tvb);
 416   }
 417
 418   if (tree) {
 419         ti = proto_tree_add_item(tree,proto_l2tp, tvb, 0, proto_length, FALSE);
 420         l2tp_tree = proto_item_add_subtree(ti, ett_l2tp);
 421
 422         ti = proto_tree_add_text(l2tp_tree, tvb, 0, 2,
 423                         "Packet Type: %s Tunnel Id=%d Session Id=%d",
 424                         (CONTROL_BIT(control) ? control_msg : data_msg), tid, cid);
 425
 426         ctrl_tree = proto_item_add_subtree(ti, ett_l2tp_ctrl);
 427         proto_tree_add_uint(ctrl_tree, hf_l2tp_type, tvb, 0, 2, control);
 428         proto_tree_add_boolean(ctrl_tree, hf_l2tp_length_bit, tvb, 0, 2, control);
 429         proto_tree_add_boolean(ctrl_tree, hf_l2tp_seq_bit, tvb, 0, 2, control);
 430         proto_tree_add_boolean(ctrl_tree, hf_l2tp_offset_bit, tvb, 0, 2, control);
 431         proto_tree_add_boolean(ctrl_tree, hf_l2tp_priority, tvb, 0, 2, control);
 432         proto_tree_add_uint(ctrl_tree, hf_l2tp_version, tvb, 0, 2, control);
 433   }
 434   index = 2;
 435   if (LENGTH_BIT(control)) {
 436           if (tree) {
 437                 proto_tree_add_item(l2tp_tree, hf_l2tp_length, tvb, index, 2, FALSE);
 438           }
 439         index += 2;
 440   }
 441
 442   if (tree) {
 443         proto_tree_add_item(l2tp_tree, hf_l2tp_tunnel, tvb, index, 2, FALSE);
 444   }
 445   index += 2;
 446   if (tree) {
 447         proto_tree_add_item(l2tp_tree, hf_l2tp_session, tvb, index, 2, FALSE);
 448   }
 449   index += 2;
 450
 451   if (SEQUENCE_BIT(control)) {
 452           if (tree) {
 453                 proto_tree_add_item(l2tp_tree, hf_l2tp_Ns, tvb, index, 2, FALSE);
 454           }
 455           index += 2;
 456           if (tree) {
 457                 proto_tree_add_item(l2tp_tree, hf_l2tp_Nr, tvb, index, 2, FALSE);
 458           }
 459           index += 2;
 460   }
 461   if (OFFSET_BIT(control)) {
 462         offset_size = tvb_get_ntohs(tvb, index);
 463         if (tree) {
 464                 proto_tree_add_uint(l2tp_tree, hf_l2tp_offset, tvb, index, 2, FALSE);
 465         }
 466         index += 2;
 467         if (tree) {
 468                 proto_tree_add_text(l2tp_tree, tvb, index, offset_size, "Offset Padding");
 469         }
 470         index += offset_size;
 471   }
 472   if (tree && (LENGTH_BIT(control))&&(length==12)) {
 473             proto_tree_add_text(l2tp_tree, tvb, 0, 0, "Zero Length Bit message");
 474   }
 475
 476   if (!CONTROL_BIT(control)) {  /* Data Messages so we are done */
 477         /* If we have data, signified by having a length bit, dissect it */
 478         if (tvb_offset_exists(tvb, index)) {
 479                 next_tvb = tvb_new_subset(tvb, index, -1, proto_length - index);
 480                 call_dissector(ppp_hdlc_handle, next_tvb, pinfo, tree);
 481         }
 482         return;
 483   }
 484
 485   if (tree) {
 486         if (!LENGTH_BIT(control)) {
 487                 return;
 488         }
 489         while (index < length ) {    /* Process AVP's */
 490                 ver_len_hidden  = tvb_get_ntohs(tvb, index);
 491                 avp_len         = AVP_LENGTH(ver_len_hidden);
 492                 avp_vendor_id   = tvb_get_ntohs(tvb, index + 2);
 493                 avp_type        = tvb_get_ntohs(tvb, index + 4);
 494
 495                 if (avp_vendor_id == VENDOR_IETF) {
 496                         tf =  proto_tree_add_text(l2tp_tree, tvb, index,
 497                         avp_len, "%s AVP",
 498                         val_to_str(avp_type, avp_type_vals, "Unknown (%u)"));
 499                 } else {         /* Vendor-Specific AVP */
 500                         tf =  proto_tree_add_text(l2tp_tree, tvb, index,
 501                         avp_len, "Vendor %s AVP",
 502                         val_to_str(avp_vendor_id, avp_vendor_id_vals, "Unknown (%u)"));
 503                 }
 504
 505                 l2tp_avp_tree = proto_item_add_subtree(tf,  ett_l2tp_avp);
 506
 507                 proto_tree_add_boolean_format(l2tp_avp_tree,hf_l2tp_avp_mandatory, tvb, index, 1,
 508                                            rhcode, "Mandatory: %s",
 509                                            (MANDATORY_BIT(ver_len_hidden)) ? "True" : "False" );
 510                 proto_tree_add_boolean_format(l2tp_avp_tree,hf_l2tp_avp_hidden, tvb, index, 1,
 511                                            rhcode, "Hidden: %s",
 512                                            (HIDDEN_BIT(ver_len_hidden)) ? "True" : "False" );
 513                 proto_tree_add_uint_format(l2tp_avp_tree,hf_l2tp_avp_length, tvb, index, 2,
 514                                            rhcode, "Length: %u", avp_len);
 515                 if (HIDDEN_BIT(ver_len_hidden)) { /* don't try do display hidden */
 516                         index += avp_len;
 517                         continue;
 518                 }
 519
 520                 if (avp_len == 0) {
 521                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 0,
 522                           "AVP length must not be zero");
 523                         return;
 524                 }
 525                 index += 2;
 526                 avp_len -= 2;
 527
 528                 proto_tree_add_item(l2tp_avp_tree, hf_l2tp_avp_vendor_id,
 529                     tvb, index, 2, FALSE);
 530                 index += 2;
 531                 avp_len -= 2;
 532
 533                 if (avp_vendor_id != VENDOR_IETF) {
 534                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 2,
 535                                             "Type: %u", avp_type);
 536                         index += 2;
 537                         avp_len -= 2;
 538
 539                         /* For the time being, we don't decode any Vendor-
 540                            specific AVP. */
 541                         proto_tree_add_text(l2tp_avp_tree, tvb, index,
 542                                             avp_len, "Vendor-Specific AVP");
 543
 544                         index += avp_len;
 545                         continue;
 546                 }
 547
 548                 proto_tree_add_uint(l2tp_avp_tree, hf_l2tp_avp_type,
 549                     tvb, index, 2, avp_type);
 550                 index += 2;
 551                 avp_len -= 2;
 552
 553                 switch (avp_type) {
 554
 555                 case CONTROL_MESSAGE:
 556                         msg_type = tvb_get_ntohs(tvb, index);
 557                         proto_tree_add_text(l2tp_avp_tree,tvb, index, 2,
 558                           "Control Message Type: (%u) %s", msg_type,
 559                           ((NUM_CONTROL_CALL_TYPES + 1 ) > msg_type) ?
 560                           calltypestr[msg_type] : "Unknown");
 561                         break;
 562
 563                 case RESULT_ERROR_CODE:
 564                         if (avp_len < 2)
 565                                 break;
 566                         result_code = tvb_get_ntohs(tvb, index);
 567                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 2,
 568                           "Result code: %u",  result_code);
 569                         index += 2;
 570                         avp_len -= 2;
 571
 572                         if (avp_len < 2)
 573                                 break;
 574                         error_code = tvb_get_ntohs(tvb, index);
 575                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 2,
 576                           "Error code: %u", error_code);
 577                         index += 2;
 578                         avp_len -= 2;
 579
 580                         if (avp_len == 0)
 581                                 break;
 582                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 583                           "Error Message: %.*s", avp_len,
 584                           tvb_get_ptr(tvb, index, avp_len));
 585                         break;
 586
 587                 case PROTOCOL_VERSION:
 588                         if (avp_len < 1)
 589                                 break;
 590                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 1,
 591                           "Version: %u", tvb_get_guint8(tvb, index));
 592                         index += 1;
 593                         avp_len -= 1;
 594
 595                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 1,
 596                           "Revision: %u", tvb_get_guint8(tvb, index));
 597                         break;
 598
 599                 case FRAMING_CAPABILITIES:
 600                         bits = tvb_get_ntohl(tvb, index);
 601                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 602                           "Async Framing Supported: %s",
 603                           (FRAMING_ASYNC(bits)) ? "True" : "False");
 604                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 605                           "Sync Framing Supported: %s",
 606                           (FRAMING_SYNC(bits)) ? "True" : "False");
 607                         break;
 608
 609                 case BEARER_CAPABILITIES:
 610                         bits = tvb_get_ntohl(tvb, index);
 611                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 612                           "Analog Access Supported: %s",
 613                           (BEARER_ANALOG(bits)) ? "True" : "False");
 614                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 615                           "Digital Access Supported: %s",
 616                           (BEARER_DIGITAL(bits)) ? "True" : "False");
 617                         break;
 618
 619                 case TIE_BREAKER:
 620                         /*
 621                          * XXX - 64-bit values aren't supported on
 622                          * platforms/compilers where "guint64" isn't
 623                          * supported, and, even on those platforms,
 624                          * there's no *printf standard for the format
 625                          * to use when printing those values, so we print it
 626                          * as a string of hex digits.
 627                          */
 628                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 8,
 629                           "Tie Breaker: %s",
 630                           tvb_bytes_to_str(tvb, index, 8));
 631                         break;
 632
 633                 case FIRMWARE_REVISION:
 634                         firmware_rev = tvb_get_ntohs(tvb, index);
 635                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 2,
 636                           "Firmware Revision: %d 0x%x", firmware_rev,firmware_rev );
 637                         break;
 638
 639                 case HOST_NAME:
 640                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 641                           "Host Name: %.*s", avp_len,
 642                           tvb_get_ptr(tvb, index, avp_len));
 643                         break;
 644
 645                 case VENDOR_NAME:
 646                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 647                           "Vendor Name: %.*s", avp_len,
 648                           tvb_get_ptr(tvb, index, avp_len));
 649                         break;
 650
 651                 case ASSIGNED_TUNNEL_ID:
 652                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 2,
 653                           "Tunnel ID: %u", tvb_get_ntohs(tvb, index));
 654                         break;
 655
 656                 case RECEIVE_WINDOW_SIZE:
 657                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 2,
 658                           "Receive Window Size: %u",
 659                           tvb_get_ntohs(tvb, index));
 660                         break;
 661
 662                 case CHALLENGE:
 663                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 664                           "CHAP Challenge: %s",
 665                           tvb_bytes_to_str(tvb, index, avp_len));
 666                         break;
 667
 668                 case CAUSE_CODE:
 669                         /*
 670                          * XXX - export stuff from the Q.931 dissector
 671                          * to dissect the cause code and cause message,
 672                          * and use it.
 673                          */
 674                         if (avp_len < 2)
 675                                 break;
 676                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 2,
 677                           "Cause Code: %u",
 678                           tvb_get_ntohs(tvb, index));
 679                         index += 2;
 680                         avp_len -= 2;
 681
 682                         if (avp_len < 1)
 683                                 break;
 684                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 1,
 685                           "Cause Msg: %u",
 686                           tvb_get_guint8(tvb, index));
 687                         index += 1;
 688                         avp_len -= 1;
 689
 690                         if (avp_len == 0)
 691                                 break;
 692                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 693                           "Advisory Msg: %.*s", avp_len,
 694                           tvb_get_ptr(tvb, index, avp_len));
 695                         break;
 696
 697                 case CHALLENGE_RESPONSE:
 698                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 16,
 699                           "CHAP Challenge Response: %s",
 700                           tvb_bytes_to_str(tvb, index, 16));
 701                         break;
 702
 703                 case ASSIGNED_SESSION:
 704                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 2,
 705                           "Assigned Session: %u",
 706                           tvb_get_ntohs(tvb, index));
 707                         break;
 708
 709                 case CALL_SERIAL_NUMBER:
 710                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 711                           "Call Serial Number: %u",
 712                           tvb_get_ntohl(tvb, index));
 713                         break;
 714
 715                 case MINIMUM_BPS:
 716                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 717                           "Minimum BPS: %u",
 718                           tvb_get_ntohl(tvb, index));
 719                         break;
 720
 721                 case MAXIMUM_BPS:
 722                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 723                           "Maximum BPS: %u",
 724                           tvb_get_ntohl(tvb, index));
 725                         break;
 726
 727                 case BEARER_TYPE:
 728                         bits = tvb_get_ntohl(tvb, index);
 729                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 730                           "Analog Bearer Type: %s",
 731                           (BEARER_ANALOG(bits)) ? "True" : "False");
 732                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 733                           "Digital Bearer Type: %s",
 734                           (BEARER_DIGITAL(bits)) ? "True" : "False");
 735                         break;
 736
 737                 case FRAMING_TYPE:
 738                         bits = tvb_get_ntohl(tvb, index);
 739                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 740                           "Async Framing Type: %s",
 741                           (FRAMING_ASYNC(bits)) ? "True" : "False");
 742                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 743                           "Sync Framing Type: %s",
 744                           (FRAMING_SYNC(bits)) ? "True" : "False");
 745                         break;
 746
 747                 case CALLED_NUMBER:
 748                         if (avp_len == 0)
 749                                 break;
 750                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 751                           "Called Number: %.*s", avp_len,
 752                           tvb_get_ptr(tvb, index, avp_len));
 753                         break;
 754
 755                 case CALLING_NUMBER:
 756                         if (avp_len == 0)
 757                                 break;
 758                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 759                           "Calling Number: %.*s", avp_len,
 760                           tvb_get_ptr(tvb, index, avp_len));
 761                         break;
 762
 763                 case SUB_ADDRESS:
 764                         if (avp_len == 0)
 765                                 break;
 766                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 767                           "Sub-Address: %.*s", avp_len,
 768                           tvb_get_ptr(tvb, index, avp_len));
 769                         break;
 770
 771                 case TX_CONNECT_SPEED:
 772                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 773                           "Connect Speed: %u",
 774                           tvb_get_ntohl(tvb, index));
 775                         break;
 776
 777                 case PHYSICAL_CHANNEL:
 778                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 779                           "Physical Channel: %u",
 780                           tvb_get_ntohl(tvb, index));
 781                         break;
 782
 783                 case INITIAL_RECEIVED_LCP:
 784                         /*
 785                          * XXX - can this be dissected by stuff in the
 786                          * LCP dissector?
 787                          */
 788                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 789                           "Initial LCP CONFREQ: %s",
 790                           tvb_bytes_to_str(tvb, index, avp_len));
 791                         break;
 792
 793                 case LAST_SEND_LCP_CONFREQ:
 794                         /*
 795                          * XXX - can this be dissected by stuff in the
 796                          * LCP dissector?
 797                          */
 798                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 799                           "Last Sent LCP CONFREQ: %s",
 800                           tvb_bytes_to_str(tvb, index, avp_len));
 801                         break;
 802
 803                 case LAST_RECEIVED_LCP_CONFREQ:
 804                         /*
 805                          * XXX - can this be dissected by stuff in the
 806                          * LCP dissector?
 807                          */
 808                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 809                           "Last Received LCP CONFREQ: %s",
 810                           tvb_bytes_to_str(tvb, index, avp_len));
 811                         break;
 812
 813                 case PROXY_AUTHEN_TYPE:
 814                         msg_type = tvb_get_ntohs(tvb, index);
 815                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 2,
 816                           "Proxy Authen Type: %s",
 817                           val_to_str(msg_type, authen_type_vals, "Unknown (%u)"));
 818                         break;
 819
 820                 case PROXY_AUTHEN_NAME:
 821                         if (avp_len == 0)
 822                                 break;
 823                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 824                           "Proxy Authen Name: %.*s", avp_len,
 825                           tvb_get_ptr(tvb, index, avp_len));
 826                         break;
 827
 828                 case PROXY_AUTHEN_CHALLENGE:
 829                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 830                           "Proxy Authen Challenge: %s",
 831                           tvb_bytes_to_str(tvb, index, avp_len));
 832                         break;
 833
 834                 case PROXY_AUTHEN_ID:
 835                         proto_tree_add_text(l2tp_avp_tree, tvb, index + 1, 1,
 836                           "Proxy Authen ID: %u",
 837                           tvb_get_guint8(tvb, index + 1));
 838                         break;
 839
 840                 case PROXY_AUTHEN_RESPONSE:
 841                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 842                           "Proxy Authen Response: %s",
 843                           tvb_bytes_to_str(tvb, index, avp_len));
 844                         break;
 845
 846                 case CALL_STATUS_AVPS:
 847                         if (avp_len < 2)
 848                                 break;
 849                         index += 2;
 850                         avp_len -= 2;
 851
 852                         if (avp_len < 4)
 853                                 break;
 854                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 855                           "CRC Errors: %u", tvb_get_ntohl(tvb, index));
 856                         index += 4;
 857                         avp_len -= 4;
 858
 859                         if (avp_len < 4)
 860                                 break;
 861                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 862                           "Framing Errors: %u", tvb_get_ntohl(tvb, index));
 863                         index += 4;
 864                         avp_len -= 4;
 865
 866                         if (avp_len < 4)
 867                                 break;
 868                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 869                           "Hardware Overruns: %u", tvb_get_ntohl(tvb, index));
 870                         index += 4;
 871                         avp_len -= 4;
 872
 873                         if (avp_len < 4)
 874                                 break;
 875                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 876                           "Buffer Overruns: %u", tvb_get_ntohl(tvb, index));
 877                         index += 4;
 878                         avp_len -= 4;
 879
 880                         if (avp_len < 4)
 881                                 break;
 882                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 883                           "Time-out Errors: %u", tvb_get_ntohl(tvb, index));
 884                         index += 4;
 885                         avp_len -= 4;
 886
 887                         if (avp_len < 4)
 888                                 break;
 889                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 890                           "Alignment Errors: %u", tvb_get_ntohl(tvb, index));
 891                         index += 4;
 892                         avp_len -= 4;
 893                         break;
 894
 895                 case ACCM:
 896                         if (avp_len < 2)
 897                                 break;
 898                         index += 2;
 899                         avp_len -= 2;
 900
 901                         if (avp_len < 4)
 902                                 break;
 903                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 904                           "Send ACCM: %u", tvb_get_ntohl(tvb, index));
 905                         index += 4;
 906                         avp_len -= 4;
 907
 908                         if (avp_len < 4)
 909                                 break;
 910                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 911                           "Receive ACCM: %u", tvb_get_ntohl(tvb, index));
 912                         index += 4;
 913                         avp_len -= 4;
 914                         break;
 915
 916                 case RANDOM_VECTOR:
 917                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 918                           "Random Vector: %s",
 919                           tvb_bytes_to_str(tvb, index, avp_len));
 920                         break;
 921
 922                 case PRIVATE_GROUP_ID:
 923                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 924                           "Private Group ID: %s",
 925                           tvb_bytes_to_str(tvb, index, avp_len));
 926                         break;
 927
 928                 case RX_CONNECT_SPEED:
 929                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 4,
 930                           "Rx Connect Speed: %u",
 931                           tvb_get_ntohl(tvb, index));
 932                         break;
 933
 934                 case PPP_DISCONNECT_CAUSE_CODE:
 935                         if (avp_len < 2)
 936                                 break;
 937                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 2,
 938                           "Disconnect Code: %u",
 939                           tvb_get_ntohs(tvb, index));
 940                         index += 2;
 941                         avp_len -= 2;
 942
 943                         if (avp_len < 2)
 944                                 break;
 945                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 2,
 946                           "Control Protocol Number: %u",
 947                           tvb_get_ntohs(tvb, index));
 948                         index += 2;
 949                         avp_len -= 2;
 950
 951                         if (avp_len < 1)
 952                                 break;
 953                         proto_tree_add_text(l2tp_avp_tree, tvb, index, 1,
 954                           "Direction: %s",
 955                           val_to_str(tvb_get_guint8(tvb, index),
 956                                      cause_code_direction_vals,
 957                                      "Reserved (%u)"));
 958                         index += 1;
 959                         avp_len -= 1;
 960
 961                         if (avp_len == 0)
 962                                 break;
 963                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 964                           "Message: %.*s", avp_len,
 965                           tvb_get_ptr(tvb, index, avp_len));
 966                         break;
 967
 968                 default:
 969                         proto_tree_add_text(l2tp_avp_tree, tvb, index, avp_len,
 970                           "Unknown AVP");
 971                         break;
 972                 }
 973
 974                 /* printf("Avp Decode avp_len= %d index= %d length= %d %x\n ",avp_len,
 975                    index,length,length); */
 976
 977                 index += avp_len;
 978         }
 979
 980   }
 981 }
 982
 983 /* registration with the filtering engine */
 984 void
 985 proto_register_l2tp(void)
 986 {
 987         static hf_register_info hf[] = {
 988                 { &hf_l2tp_type,
 989                 { "Type", "lt2p.type", FT_UINT16, BASE_DEC, VALS(l2tp_type_vals), 0x8000,
 990                         "Type bit", HFILL }},
 991
 992                 { &hf_l2tp_length_bit,
 993                 { "Length Bit", "lt2p.length_bit", FT_BOOLEAN, 16, TFS(&l2tp_length_bit_truth), 0x4000,
 994                         "Length bit", HFILL }},
 995
 996                 { &hf_l2tp_seq_bit,
 997                 { "Sequence Bit", "lt2p.seq_bit", FT_BOOLEAN, 16, TFS(&l2tp_seq_bit_truth), 0x0800,
 998                         "Sequence bit", HFILL }},
 999
1000                 { &hf_l2tp_offset_bit,
1001                 { "Offset bit", "lt2p.offset_bit", FT_BOOLEAN, 16, TFS(&l2tp_offset_bit_truth), 0x0200,
1002                         "Offset bit", HFILL }},
1003
1004                 { &hf_l2tp_priority,
1005                 { "Priority", "lt2p.priority", FT_BOOLEAN, 16, TFS(&l2tp_priority_truth), 0x0100,
1006                         "Priority bit", HFILL }},
1007
1008                 { &hf_l2tp_version,
1009                 { "Version", "lt2p.version", FT_UINT16, BASE_DEC, NULL, 0x000f,
1010                         "Version", HFILL }},
1011
1012                 { &hf_l2tp_length,
1013                 { "Length","l2tp.length", FT_UINT16, BASE_DEC, NULL, 0x0,
1014                         "", HFILL }},
1015
1016                 { &hf_l2tp_tunnel,
1017                 { "Tunnel ID","l2tp.tunnel", FT_UINT16, BASE_DEC, NULL, 0x0, /* Probably should be FT_BYTES */
1018                         "Tunnel ID", HFILL }},
1019
1020                 { &hf_l2tp_session,
1021                 { "Session ID","l2tp.session", FT_UINT16, BASE_DEC, NULL, 0x0, /* Probably should be FT_BYTES */
1022                         "Session ID", HFILL }},
1023
1024                 { &hf_l2tp_Ns,
1025                 { "Ns","l2tp.Ns", FT_UINT16, BASE_DEC, NULL, 0x0,
1026                         "", HFILL }},
1027
1028                 { &hf_l2tp_Nr,
1029                 { "Nr","l2tp.Nr", FT_UINT16, BASE_DEC, NULL, 0x0,
1030                         "", HFILL }},
1031
1032                 { &hf_l2tp_offset,
1033                 { "Offset","l2tp.offset", FT_UINT16, BASE_DEC, NULL, 0x0,
1034                         "Number of octest past the L2TP header at which the"
1035                                 "payload data starts.", HFILL }},
1036
1037                 { &hf_l2tp_avp_mandatory,
1038                 { "Mandatory", "lt2p.avp.mandatory", FT_BOOLEAN, BASE_NONE, NULL, 0,
1039                         "Mandatory AVP", HFILL }},
1040
1041                 { &hf_l2tp_avp_hidden,
1042                 { "Hidden", "lt2p.avp.hidden", FT_BOOLEAN, BASE_NONE, NULL, 0,
1043                         "Hidden AVP", HFILL }},
1044
1045                 { &hf_l2tp_avp_length,
1046                 { "Length", "lt2p.avp.length", FT_UINT16, BASE_DEC, NULL, 0,
1047                         "AVP Length", HFILL }},
1048
1049                 { &hf_l2tp_avp_vendor_id,
1050                 { "Vendor ID", "lt2p.avp.vendor_id", FT_UINT16, BASE_DEC, VALS(avp_vendor_id_vals), 0,
1051                         "AVP Vendor ID", HFILL }},
1052
1053                 { &hf_l2tp_avp_type,
1054                 { "Type", "lt2p.avp.type", FT_UINT16, BASE_DEC, VALS(avp_type_vals), 0,
1055                         "AVP Type", HFILL }},
1056         };
1057
1058         static gint *ett[] = {
1059                 &ett_l2tp,
1060                 &ett_l2tp_ctrl,
1061                 &ett_l2tp_avp,
1062         };
1063
1064         proto_l2tp = proto_register_protocol(
1065                 "Layer 2 Tunneling Protocol", "L2TP", "l2tp");
1066         proto_register_field_array(proto_l2tp, hf, array_length(hf));
1067         proto_register_subtree_array(ett, array_length(ett));
1068 }
1069
1070 void
1071 proto_reg_handoff_l2tp(void)
1072 {
1073         dissector_add("udp.port", UDP_PORT_L2TP, dissect_l2tp,
1074             proto_l2tp);
1075
1076         /*
1077          * Get a handle for the PPP-in-HDLC-like-framing dissector.
1078          */
1079         ppp_hdlc_handle = find_dissector("ppp_hdlc");
1080 }