/* packet-ppp.c * Routines for ppp packet disassembly * * $Id: packet-ppp.c,v 1.80 2001/12/08 06:41:42 guy Exp $ * * Ethereal - Network traffic analyzer * By Gerald Combs * * This file created and by Mike Hall * Copyright 1998 * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. */ #ifdef HAVE_CONFIG_H # include "config.h" #endif #ifdef HAVE_SYS_TYPES_H # include #endif #include #include "prefs.h" #include "packet.h" #include "packet-ppp.h" #include "ppptypes.h" #include "etypes.h" #include "atalk-utils.h" #include "packet-chdlc.h" #include "packet-ip.h" #include "packet-ipx.h" #include "packet-vines.h" #include "nlpid.h" #define ppp_min(a, b) ((a> 8) & 0x00ff) ^ fcstab_16[((guint16)(fcs ^ (guint16)((val) & 0x00ff)) & 0x00ff)]; } return (fcs ^ 0xffff); } /* ******************************************************************************* * DETAILS : Calculate a new FCS-32 given the current FCS-32 and the new data. ******************************************************************************* */ guint32 fcs32(guint32 fcs, tvbuff_t * tvbuff, guint32 offset, guint32 len) { guint8 val; /* Check for invalid Length */ if (len == 0) return (0x00000000); while (len--) { val = tvb_get_guint8(tvbuff, offset++); fcs = (((fcs) >> 8) ^ fcstab_32[((fcs) ^ (val)) & 0xff]); } return (fcs ^ 0xffffffff); } void capture_ppp_hdlc( const u_char *pd, int offset, int len, packet_counts *ld ) { if (!BYTES_ARE_IN_FRAME(offset, len, 2)) { ld->other++; return; } if (pd[0] == CHDLC_ADDR_UNICAST || pd[0] == CHDLC_ADDR_MULTICAST) { capture_chdlc(pd, offset, len, ld); return; } if (!BYTES_ARE_IN_FRAME(offset, len, 4)) { ld->other++; return; } switch (pntohs(&pd[offset + 2])) { case PPP_IP: capture_ip(pd, offset + 4, len, ld); break; case PPP_IPX: capture_ipx(pd, offset + 4, len, ld); break; case PPP_VINES: capture_vines(pd, offset + 4, len, ld); break; default: ld->other++; break; } } static void dissect_lcp_mru_opt(const ip_tcp_opt *optp, tvbuff_t *tvb, int offset, guint length, frame_data *fd, proto_tree *tree) { proto_tree_add_text(tree, tvb, offset, length, "MRU: %u", tvb_get_ntohs(tvb, offset + 2)); } static void dissect_lcp_async_map_opt(const ip_tcp_opt *optp, tvbuff_t *tvb, int offset, guint length, frame_data *fd, proto_tree *tree) { proto_tree_add_text(tree, tvb, offset, length, "Async characters to map: 0x%08x", tvb_get_ntohl(tvb, offset + 2)); } static void dissect_lcp_protocol_opt(const ip_tcp_opt *optp, tvbuff_t *tvb, int offset, guint length, frame_data *fd, proto_tree *tree) { guint16 protocol; proto_item *tf; proto_tree *field_tree = NULL; tf = proto_tree_add_text(tree, tvb, offset, length, "%s: %u byte%s", optp->name, length, plurality(length, "", "s")); field_tree = proto_item_add_subtree(tf, *optp->subtree_index); offset += 2; length -= 2; protocol = tvb_get_ntohs(tvb, offset); proto_tree_add_text(field_tree, tvb, offset, 2, "%s: %s (0x%02x)", optp->name, val_to_str(protocol, ppp_vals, "Unknown"), protocol); offset += 2; length -= 2; if (length > 0) proto_tree_add_text(field_tree, tvb, offset, length, "Data (%d byte%s)", length, plurality(length, "", "s")); } static void dissect_lcp_authprot_opt(const ip_tcp_opt *optp, tvbuff_t *tvb, int offset, guint length, frame_data *fd, proto_tree *tree) { guint16 protocol; guint8 algorithm; proto_item *tf; proto_tree *field_tree = NULL; tf = proto_tree_add_text(tree, tvb, offset, length, "%s: %u byte%s", optp->name, length, plurality(length, "", "s")); field_tree = proto_item_add_subtree(tf, *optp->subtree_index); offset += 2; length -= 2; protocol = tvb_get_ntohs(tvb, offset); proto_tree_add_text(field_tree, tvb, offset, 2, "%s: %s (0x%02x)", optp->name, val_to_str(protocol, ppp_vals, "Unknown"), protocol); offset += 2; length -= 2; if (length > 0) { if (protocol == PPP_CHAP) { algorithm = tvb_get_guint8(tvb, offset); proto_tree_add_text(field_tree, tvb, offset, length, "Algorithm: %s (0x%02x)", val_to_str(algorithm, chap_alg_vals, "Unknown"), algorithm); offset++; } else { proto_tree_add_text(field_tree, tvb, offset, length, "Data (%d byte%s)", length, plurality(length, "", "s")); } } } static void dissect_lcp_magicnumber_opt(const ip_tcp_opt *optp, tvbuff_t *tvb, int offset, guint length, frame_data *fd, proto_tree *tree) { proto_tree_add_text(tree, tvb, offset, length, "Magic number: 0x%08x", tvb_get_ntohl(tvb, offset + 2)); } static void dissect_lcp_fcs_alternatives_opt(const ip_tcp_opt *optp, tvbuff_t *tvb, int offset, guint length, frame_data *fd, proto_tree *tree) { proto_item *tf; proto_tree *field_tree = NULL; guint8 alternatives; alternatives = tvb_get_guint8(tvb, offset + 2); tf = proto_tree_add_text(tree, tvb, offset, length, "%s: 0x%02x", optp->name, alternatives); field_tree = proto_item_add_subtree(tf, *optp->subtree_index); offset += 2; if (alternatives & 0x1) proto_tree_add_text(field_tree, tvb, offset + 2, 1, "%s", decode_boolean_bitfield(alternatives, 0x1, 8, "Null FCS", NULL)); if (alternatives & 0x2) proto_tree_add_text(field_tree, tvb, offset + 2, 1, "%s", decode_boolean_bitfield(alternatives, 0x2, 8, "CCITT 16-bit FCS", NULL)); if (alternatives & 0x4) proto_tree_add_text(field_tree, tvb, offset + 2, 1, "%s", decode_boolean_bitfield(alternatives, 0x4, 8, "CCITT 32-bit FCS", NULL)); } static void dissect_lcp_self_describing_pad_opt(const ip_tcp_opt *optp, tvbuff_t *tvb, int offset, guint length, frame_data *fd, proto_tree *tree) { proto_tree_add_text(tree, tvb, offset, length, "Maximum octets of self-describing padding: %u", tvb_get_guint8(tvb, offset + 2)); } static void dissect_lcp_numbered_mode_opt(const ip_tcp_opt *optp, tvbuff_t *tvb, int offset, guint length, frame_data *fd, proto_tree *tree) { proto_item *tf; proto_tree *field_tree = NULL; tf = proto_tree_add_text(tree, tvb, offset, length, "%s: %u byte%s", optp->name, length, plurality(length, "", "s")); field_tree = proto_item_add_subtree(tf, *optp->subtree_index); offset += 2; length -= 2; proto_tree_add_text(field_tree, tvb, offset, 1, "Window: %u", tvb_get_guint8(tvb, offset)); offset += 1; length -= 1; if (length > 0) proto_tree_add_text(field_tree, tvb, offset, length, "Address (%d byte%s)", length, plurality(length, "", "s")); } static const value_string callback_op_vals[] = { {0, "Location is determined by user authentication" }, {1, "Message is dialing string" }, {2, "Message is location identifier" }, {3, "Message is E.164" }, {4, "Message is distinguished name" }, {5, "unassigned"}, {6, "Location is determined during CBCP negotiation" }, {0, NULL } }; static void dissect_lcp_callback_opt(const ip_tcp_opt *optp, tvbuff_t *tvb, int offset, guint length, frame_data *fd, proto_tree *tree) { proto_item *tf; proto_tree *field_tree = NULL; guint8 operation; tf = proto_tree_add_text(tree, tvb, offset, length, "%s: %u byte%s", optp->name, length, plurality(length, "", "s")); field_tree = proto_item_add_subtree(tf, *optp->subtree_index); offset += 2; length -= 2; operation = tvb_get_guint8(tvb, offset); proto_tree_add_text(field_tree, tvb, offset, 1, "Operation: %s (0x%02x)", val_to_str(operation, callback_op_vals, "Unknown"), operation); offset += 1; length -= 1; if (length > 0) proto_tree_add_text(field_tree, tvb, offset, length, "Message (%d byte%s)", length, plurality(length, "", "s")); } static void dissect_lcp_multilink_mrru_opt(const ip_tcp_opt *optp, tvbuff_t *tvb, int offset, guint length, frame_data *fd, proto_tree *tree) { proto_tree_add_text(tree, tvb, offset, length, "Multilink MRRU: %u", tvb_get_ntohs(tvb, offset + 2)); } #define CLASS_NULL 0 #define CLASS_LOCAL 1 #define CLASS_IP 2 #define CLASS_IEEE_802_1 3 #define CLASS_PPP_MAGIC_NUMBER 4 #define CLASS_PSDN_DIRECTORY_NUMBER 5 static const value_string multilink_ep_disc_class_vals[] = { {CLASS_NULL, "Null" }, {CLASS_LOCAL, "Locally assigned address" }, {CLASS_IP, "IP address" }, {CLASS_IEEE_802_1, "IEEE 802.1 globally assigned MAC address" }, {CLASS_PPP_MAGIC_NUMBER, "PPP magic-number block" }, {CLASS_PSDN_DIRECTORY_NUMBER, "Public switched network directory number" }, {0, NULL } }; static void dissect_lcp_multilink_ep_disc_opt(const ip_tcp_opt *optp, tvbuff_t *tvb, int offset, guint length, frame_data *fd, proto_tree *tree) { proto_item *tf; proto_tree *field_tree = NULL; guint8 ep_disc_class; tf = proto_tree_add_text(tree, tvb, offset, length, "%s: %u byte%s", optp->name, length, plurality(length, "", "s")); field_tree = proto_item_add_subtree(tf, *optp->subtree_index); offset += 2; length -= 2; ep_disc_class = tvb_get_guint8(tvb, offset); proto_tree_add_text(field_tree, tvb, offset, 1, "Class: %s (%u)", val_to_str(ep_disc_class, multilink_ep_disc_class_vals, "Unknown"), ep_disc_class); offset += 1; length -= 1; if (length > 0) { switch (ep_disc_class) { case CLASS_NULL: proto_tree_add_text(field_tree, tvb, offset, length, "Address (%d byte%s), should have been empty", length, plurality(length, "", "s")); break; case CLASS_LOCAL: if (length > 20) { proto_tree_add_text(field_tree, tvb, offset, length, "Address (%d byte%s), should have been <20", length, plurality(length, "", "s")); } else { proto_tree_add_text(field_tree, tvb, offset, length, "Address (%d byte%s)", length, plurality(length, "", "s")); } break; case CLASS_IP: if (length != 4) { proto_tree_add_text(field_tree, tvb, offset, length, "Address (%d byte%s), should have been 4", length, plurality(length, "", "s")); } else { proto_tree_add_text(field_tree, tvb, offset, length, "Address: %s", ip_to_str(tvb_get_ptr(tvb, offset, 4))); } break; case CLASS_IEEE_802_1: if (length != 6) { proto_tree_add_text(field_tree, tvb, offset, length, "Address (%d byte%s), should have been 6", length, plurality(length, "", "s")); } else { proto_tree_add_text(field_tree, tvb, offset, length, "Address: %s", ether_to_str(tvb_get_ptr(tvb, offset, 6))); } break; case CLASS_PPP_MAGIC_NUMBER: /* XXX - dissect as 32-bit magic numbers */ if (length > 20) { proto_tree_add_text(field_tree, tvb, offset, length, "Address (%d byte%s), should have been <20", length, plurality(length, "", "s")); } else { proto_tree_add_text(field_tree, tvb, offset, length, "Address (%d byte%s)", length, plurality(length, "", "s")); } break; case CLASS_PSDN_DIRECTORY_NUMBER: if (length > 15) { proto_tree_add_text(field_tree, tvb, offset, length, "Address (%d byte%s), should have been <20", length, plurality(length, "", "s")); } else { proto_tree_add_text(field_tree, tvb, offset, length, "Address (%d byte%s)", length, plurality(length, "", "s")); } break; default: proto_tree_add_text(field_tree, tvb, offset, length, "Address (%d byte%s)", length, plurality(length, "", "s")); break; } } } static void dissect_lcp_bap_link_discriminator_opt(const ip_tcp_opt *optp, tvbuff_t *tvb, int offset, guint length, frame_data *fd, proto_tree *tree) { proto_tree_add_text(tree, tvb, offset, length, "Link discriminator for BAP: 0x%04x", tvb_get_ntohs(tvb, offset + 2)); } /* Character set numbers from the IANA charset registry. */ static const value_string charset_num_vals[] = { {105, "UTF-8" }, {0, NULL } }; static void dissect_lcp_internationalization_opt(const ip_tcp_opt *optp, tvbuff_t *tvb, int offset, guint length, frame_data *fd, proto_tree *tree) { proto_item *tf; proto_tree *field_tree = NULL; guint32 charset; tf = proto_tree_add_text(tree, tvb, offset, length, "%s: %u byte%s", optp->name, length, plurality(length, "", "s")); field_tree = proto_item_add_subtree(tf, *optp->subtree_index); offset += 2; length -= 2; charset = tvb_get_ntohl(tvb, offset); proto_tree_add_text(field_tree, tvb, offset, 4, "Character set: %s (0x%04x)", val_to_str(charset, charset_num_vals, "Unknown"), charset); offset += 4; length -= 4; if (length > 0) { /* XXX - should be displayed as an ASCII string */ proto_tree_add_text(field_tree, tvb, offset, length, "Language tag (%d byte%s)", length, plurality(length, "", "s")); } } static void dissect_ipcp_addrs_opt(const ip_tcp_opt *optp, tvbuff_t *tvb, int offset, guint length, frame_data *fd, proto_tree *tree) { proto_item *tf; proto_tree *field_tree = NULL; tf = proto_tree_add_text(tree, tvb, offset, length, "%s: %u byte%s", optp->name, length, plurality(length, "", "s")); field_tree = proto_item_add_subtree(tf, *optp->subtree_index); offset += 2; length -= 2; proto_tree_add_text(field_tree, tvb, offset, 4, "Source IP address: %s", ip_to_str(tvb_get_ptr(tvb, offset, 4))); offset += 4; length -= 4; proto_tree_add_text(field_tree, tvb, offset, 4, "Destination IP address: %s", ip_to_str(tvb_get_ptr(tvb, offset, 4))); } static void dissect_ipcp_addr_opt(const ip_tcp_opt *optp, tvbuff_t *tvb, int offset, guint length, frame_data *fd, proto_tree *tree) { proto_tree_add_text(tree, tvb, offset, length, "%s: %s", optp->name, ip_to_str(tvb_get_ptr(tvb, offset + 2, 4))); } static void dissect_ccp_stac_opt(const ip_tcp_opt *optp, tvbuff_t *tvb, int offset, guint length, frame_data *fd, proto_tree *tree) { proto_item *tf; guint8 check_mode; if (length == 6) { proto_tree_add_text(tree, tvb, offset, length, "%s (Ascend Proprietary version)", optp->name); /* We don't know how to decode the following 4 octets, since there's no public document that describe their usage. */ return; } else { tf = proto_tree_add_text(tree, tvb, offset, length, "%s", optp->name); } proto_tree_add_text(tf, tvb, offset + 2, 2, "History Count: %u", tvb_get_ntohs(tvb, offset + 2)); check_mode = tvb_get_guint8(tvb, offset + 4); proto_tree_add_text(tf, tvb, offset + 4, 1, "Check Mode: %s (0x%02X)", val_to_str(check_mode, stac_checkmode_vals, "Unknown"), check_mode); } static void dissect_ccp_mppc_opt(const ip_tcp_opt *optp, tvbuff_t *tvb, int offset, guint length, frame_data *fd, proto_tree *tree) { proto_item *tf; proto_tree *flags_tree; guint32 supported_bits; supported_bits = tvb_get_ntohl(tvb, offset + 2); tf = proto_tree_add_text(tree, tvb, offset, length, "%s: Supported Bits: 0x%08X", optp->name, supported_bits); flags_tree = proto_item_add_subtree(tf, ett_ccp_mppc_opt); proto_tree_add_text(flags_tree, tvb, offset + 2, 4, "%s", decode_boolean_bitfield(supported_bits, MPPC_SUPPORTED_BITS_C, 8*4, "Desire to negotiate MPPC", "NOT Desire to negotiate MPPC")); proto_tree_add_text(flags_tree, tvb, offset + 2, 4, "%s", decode_boolean_bitfield(supported_bits, MPPE_SUPPORTED_BITS_D, 8*4, "Obsolete (should NOT be 1)", "Obsolete (should ALWAYS be 0)")); proto_tree_add_text(flags_tree, tvb, offset + 2, 4, "%s", decode_boolean_bitfield(supported_bits, MPPE_SUPPORTED_BITS_L, 8*4, "40-bit encryption ON", "40-bit encryption OFF")); proto_tree_add_text(flags_tree, tvb, offset + 2, 4, "%s", decode_boolean_bitfield(supported_bits, MPPE_SUPPORTED_BITS_S, 8*4, "128-bit encryption ON", "128-bit encryption OFF")); proto_tree_add_text(flags_tree, tvb, offset + 2, 4, "%s", decode_boolean_bitfield(supported_bits, MPPE_SUPPORTED_BITS_M, 8*4, "56-bit encryption ON", "56-bit encryption OFF")); proto_tree_add_text(flags_tree, tvb, offset + 2, 4, "%s", decode_boolean_bitfield(supported_bits, MPPE_SUPPORTED_BITS_H, 8*4, "Stateless mode ON", "Stateless mode OFF")); } static void dissect_ccp_lzsdcp_opt(const ip_tcp_opt *optp, tvbuff_t *tvb, int offset, guint length, frame_data *fd, proto_tree *tree) { proto_item *tf; guint8 check_mode; guint8 process_mode; tf = proto_tree_add_text(tree, tvb, offset, length, "%s", optp->name); proto_tree_add_text(tf, tvb, offset + 2, 2, "History Count: %u", tvb_get_ntohs(tvb, offset + 2)); check_mode = tvb_get_guint8(tvb, offset + 4); proto_tree_add_text(tf, tvb, offset + 4, 1, "Check Mode: %s (0x%02X)", val_to_str(check_mode, lzsdcp_checkmode_vals, "Unknown"), check_mode); process_mode = tvb_get_guint8(tvb, offset + 5); proto_tree_add_text(tf, tvb, offset + 5, 1, "Process Mode: %s (0x%02X)", val_to_str(process_mode, lzsdcp_processmode_vals, "Unkown"), process_mode); } static void dissect_cbcp_no_callback_opt(const ip_tcp_opt *optp, tvbuff_t *tvb, int offset, guint length, frame_data *fd, proto_tree *tree) { proto_tree_add_text(tree, tvb, offset, length, "%s", optp->name); } static void dissect_cbcp_callback_opt(const ip_tcp_opt *optp, tvbuff_t *tvb, int offset, guint length, frame_data *fd, proto_tree *tree) { proto_item *tf; proto_item *ta; guint8 addr_type; gint addr_len; guint8 buf[256]; /* Since length field in Callback Conf Option is 8 bits, 256-octet buf is large enough. */ tf = proto_tree_add_text(tree, tvb, offset, length, "%s", optp->name); proto_tree_add_text(tf, tvb, offset + 2, 1, "Callback delay: %u", tvb_get_guint8(tvb, offset + 2)); offset += 3; length -= 3; while (length > 0) { ta = proto_tree_add_text(tf, tvb, offset, length, "Callback Address"); addr_type = tvb_get_guint8(tvb, offset); proto_tree_add_text(ta, tvb, offset, 1, "Address Type: %s (%u)", ((addr_type == 1) ? "PSTN/ISDN" : "Other"), addr_type); offset++; length--; addr_len = tvb_get_nstringz0(tvb, offset, sizeof(buf), buf); proto_tree_add_text(ta, tvb, offset, addr_len + 1, "Address: %s", buf); offset += (addr_len + 1); length -= (addr_len + 1); } } static void dissect_bacp_favored_peer_opt(const ip_tcp_opt *optp, tvbuff_t *tvb, int offset, guint length, frame_data *fd, proto_tree *tree) { proto_item *tf; tf = proto_tree_add_text(tree, tvb, offset, length, "%s", optp->name); proto_tree_add_text(tf, tvb, offset + 2, 4, "Magic number: 0x%08x", tvb_get_ntohl(tvb, offset + 2)); } static void dissect_bap_link_type_opt(const ip_tcp_opt *optp, tvbuff_t *tvb, int offset, guint length, frame_data *fd, proto_tree *tree) { proto_item *tf; guint8 link_type; tf = proto_tree_add_text(tree, tvb, offset, length, "%s", optp->name); proto_tree_add_text(tf, tvb, offset + 2, 2, "Link Speed : %u kbps", tvb_get_ntohs(tvb, offset + 2)); link_type = tvb_get_guint8(tvb, offset + 4); proto_tree_add_text(tf, tvb, offset + 4, 1, "Link Type : %s (%u)", val_to_str(link_type, bap_link_type_vals, "Unknown"), link_type); } static void dissect_bap_phone_delta_opt(const ip_tcp_opt *optp, tvbuff_t *tvb, int offset, guint length, frame_data *fd, proto_tree *tree) { proto_item *ti; proto_item *tf; guint8 link_type; guint8 subopt_type; guint8 subopt_len; guint8 buf[256]; /* Since Sub-Option length field in BAP Phone-Delta Option is 8 bits, 256-octets buf is large enough */ ti = proto_tree_add_text(tree, tvb, offset, length, "%s", optp->name); offset += 2; length -= 2; while (length > 0) { subopt_type = tvb_get_guint8(tvb, offset); subopt_len = tvb_get_guint8(tvb, offset + 1); tf = proto_tree_add_text(ti, tvb, offset, subopt_len, "Sub-Option (%d byte%s)", subopt_len, plurality(subopt_len, "", "s")); proto_tree_add_text(tf, tvb, offset, 1, "Sub-Option Type : %s (%u)", val_to_str(subopt_type, bap_phone_delta_subopt_vals, "Unknown"), subopt_type); proto_tree_add_text(tf, tvb, offset + 1, 1, "Sub-Option Length : %u", subopt_len); switch (subopt_type) { case BAP_PHONE_DELTA_SUBOPT_UNIQ_DIGIT: proto_tree_add_text(tf, tvb, offset + 2, 1, "Uniq Digit: %u", tvb_get_guint8(tvb, offset + 2)); break; case BAP_PHONE_DELTA_SUBOPT_SUBSC_NUM: tvb_get_nstringz0(tvb, offset + 2, subopt_len - 2, buf); proto_tree_add_text(tf, tvb, offset + 2, subopt_len - 2, "Subscriber Number: %s", buf); break; case BAP_PHONE_DELTA_SUBOPT_PHONENUM_SUBADDR: tvb_get_nstringz0(tvb, offset + 2, subopt_len - 2, buf); proto_tree_add_text(tf, tvb, offset + 2, subopt_len - 2, "Phone Number Sub Address: %s", buf); break; default: proto_tree_add_text(tf, tvb, offset + 2, subopt_len - 2, "Unknown"); break; } offset += subopt_len; length -= subopt_len; } } static void dissect_bap_reason_opt(const ip_tcp_opt *optp, tvbuff_t *tvb, int offset, guint length, frame_data *fd, proto_tree *tree) { guint8 link_type; guint8 buf[256]; /* Since length field in BAP Reason Option is 8 bits, 256-octets buf is large enough */ tvb_get_nstringz0(tvb, offset + 2, length - 2, buf); proto_tree_add_text(tree, tvb, offset, length, "%s : %s", optp->name, buf); } static void dissect_bap_link_disc_opt(const ip_tcp_opt *optp, tvbuff_t *tvb, int offset, guint length, frame_data *fd, proto_tree *tree) { guint8 link_type; proto_tree_add_text(tree, tvb, offset, length, "%s : 0x%04x", optp->name, tvb_get_ntohs(tvb, offset + 2)); } static void dissect_bap_call_status_opt(const ip_tcp_opt *optp, tvbuff_t *tvb, int offset, guint length, frame_data *fd, proto_tree *tree) { proto_item *tf; guint8 link_type; guint8 status, action; tf = proto_tree_add_text(tree, tvb, offset, length, "%s", optp->name); status = tvb_get_guint8(tvb, offset + 2); proto_tree_add_text(tf, tvb, offset + 2, 1, "Status : %s (0x%02x)", val_to_str(status, q931_cause_code_vals, "Unknown"), status); action = tvb_get_guint8(tvb, offset + 3); proto_tree_add_text(tf, tvb, offset + 3, 1, "Action : %s (0x%02x)", val_to_str(action, bap_call_status_opt_action_vals, "Unknown"), action); } static void dissect_cp( tvbuff_t *tvb, int proto_id, int proto_subtree_index, const value_string *proto_vals, int options_subtree_index, const ip_tcp_opt *opts, int nopts, packet_info *pinfo, proto_tree *tree ) { proto_item *ti; proto_tree *fh_tree = NULL; proto_item *tf; proto_tree *field_tree; guint8 code; guint8 id; int length, offset; guint16 protocol; code = tvb_get_guint8(tvb, 0); id = tvb_get_guint8(tvb, 1); length = tvb_get_ntohs(tvb, 2); if(check_col(pinfo->fd, COL_PROTOCOL)) col_set_str(pinfo->fd, COL_PROTOCOL, proto_get_protocol_short_name(proto_id)); if(check_col(pinfo->fd, COL_INFO)) col_add_fstr(pinfo->fd, COL_INFO, "%s %s", proto_get_protocol_short_name(proto_id), val_to_str(code, proto_vals, "Unknown")); if(tree) { ti = proto_tree_add_item(tree, proto_id, tvb, 0, length, FALSE); fh_tree = proto_item_add_subtree(ti, proto_subtree_index); proto_tree_add_text(fh_tree, tvb, 0, 1, "Code: %s (0x%02x)", val_to_str(code, proto_vals, "Unknown"), code); proto_tree_add_text(fh_tree, tvb, 1, 1, "Identifier: 0x%02x", id); proto_tree_add_text(fh_tree, tvb, 2, 2, "Length: %u", length); } offset = 4; length -= 4; switch (code) { case CONFREQ: case CONFACK: case CONFNAK: case CONFREJ: if(tree) { if (length > 0) { tf = proto_tree_add_text(fh_tree, tvb, offset, length, "Options: (%d byte%s)", length, plurality(length, "", "s")); field_tree = proto_item_add_subtree(tf, options_subtree_index); dissect_ip_tcp_options(tvb, offset, length, opts, nopts, -1, pinfo->fd, field_tree); } } break; case ECHOREQ: case ECHOREP: case DISCREQ: case IDENT: if(tree) { proto_tree_add_text(fh_tree, tvb, offset, 4, "Magic number: 0x%08x", tvb_get_ntohl(tvb, offset)); offset += 4; length -= 4; if (length > 0) proto_tree_add_text(fh_tree, tvb, offset, length, "Message (%d byte%s)", length, plurality(length, "", "s")); } break; case TIMEREMAIN: if(tree) { proto_tree_add_text(fh_tree, tvb, offset, 4, "Magic number: 0x%08x", tvb_get_ntohl(tvb, offset)); offset += 4; length -= 4; proto_tree_add_text(fh_tree, tvb, offset, 4, "Seconds remaining: %u", tvb_get_ntohl(tvb, offset)); offset += 4; length -= 4; if (length > 0) proto_tree_add_text(fh_tree, tvb, offset, length, "Message (%d byte%s)", length, plurality(length, "", "s")); } break; case PROTREJ: if(tree) { protocol = tvb_get_ntohs(tvb, offset); proto_tree_add_text(fh_tree, tvb, offset, 2, "Rejected protocol: %s (0x%04x)", val_to_str(protocol, ppp_vals, "Unknown"), protocol); offset += 2; length -= 2; if (length > 0) proto_tree_add_text(fh_tree, tvb, offset, length, "Rejected packet (%d byte%s)", length, plurality(length, "", "s")); /* XXX - should be dissected as a PPP packet */ } break; case CODEREJ: /* decode the rejected LCP packet here. */ if (length > 0) proto_tree_add_text(fh_tree, tvb, offset, length, "Rejected packet (%d byte%s)", length, plurality(length, "", "s")); break; case TERMREQ: case TERMACK: if (length > 0) proto_tree_add_text(fh_tree, tvb, offset, length, "Data (%d byte%s)", length, plurality(length, "", "s")); break; default: if (length > 0) proto_tree_add_text(fh_tree, tvb, offset, length, "Stuff (%d byte%s)", length, plurality(length, "", "s")); break; } } /* Protocol field compression */ #define PFC_BIT 0x01 static void dissect_ppp_common( tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, proto_tree *fh_tree, proto_item *ti ) { guint16 ppp_prot; int proto_len; tvbuff_t *next_tvb; ppp_prot = tvb_get_guint8(tvb, offset); if (ppp_prot & PFC_BIT) { /* Compressed protocol field - just the byte we fetched. */ proto_len = 1; } else { /* Uncompressed protocol field - fetch all of it. */ ppp_prot = tvb_get_ntohs(tvb, offset); proto_len = 2; } /* If "ti" is not null, it refers to the top-level "proto_ppp" item for PPP, and was given a length equal to the length of any stuff in the header preceding the protocol type, e.g. an HDLC header, which is just "offset"; add the length of the protocol type field to it. */ if (ti != NULL) proto_item_set_len(ti, offset + proto_len); if (tree) { proto_tree_add_text(fh_tree, tvb, offset, proto_len, "Protocol: %s (0x%04x)", val_to_str(ppp_prot, ppp_vals, "Unknown"), ppp_prot); } next_tvb = tvb_new_subset(tvb, offset + proto_len, -1, -1); /* do lookup with the subdissector table */ if (!dissector_try_port(subdissector_table, ppp_prot, next_tvb, pinfo, tree)) { if (check_col(pinfo->fd, COL_PROTOCOL)) col_add_fstr(pinfo->fd, COL_PROTOCOL, "0x%04x", ppp_prot); if (check_col(pinfo->fd, COL_INFO)) col_add_fstr(pinfo->fd, COL_INFO, "PPP %s (0x%04x)", val_to_str(ppp_prot, ppp_vals, "Unknown"), ppp_prot); call_dissector(data_handle,next_tvb, pinfo, tree); } } static void dissect_lcp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) { dissect_cp(tvb, proto_lcp, ett_lcp, lcp_vals, ett_lcp_options, lcp_opts, N_LCP_OPTS, pinfo, tree); } static void dissect_ipcp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) { dissect_cp(tvb, proto_ipcp, ett_ipcp, cp_vals, ett_ipcp_options, ipcp_opts, N_IPCP_OPTS, pinfo, tree); } static void dissect_ccp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) { dissect_cp(tvb, proto_ccp, ett_ccp, ccp_vals, ett_ccp_options, ccp_opts, N_CCP_OPTS, pinfo, tree); } static void dissect_cbcp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) { dissect_cp(tvb, proto_cbcp, ett_cbcp, cbcp_vals, ett_cbcp_options, cbcp_opts, N_CBCP_OPTS, pinfo, tree); } static void dissect_bacp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) { dissect_cp(tvb, proto_bacp, ett_bacp, cp_vals, ett_bacp_options, bacp_opts, N_BACP_OPTS, pinfo, tree); } static void dissect_bap(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) { proto_item *ti; proto_tree *fh_tree = NULL; proto_item *tf; proto_tree *field_tree; guint8 type; guint8 id; int length, offset; guint8 resp_code; type = tvb_get_guint8(tvb, 0); id = tvb_get_guint8(tvb, 1); length = tvb_get_ntohs(tvb, 2); if(check_col(pinfo->fd, COL_PROTOCOL)) col_set_str(pinfo->fd, COL_PROTOCOL, proto_get_protocol_short_name(proto_bap)); if(check_col(pinfo->fd, COL_INFO)) col_add_fstr(pinfo->fd, COL_INFO, "%s %s", proto_get_protocol_short_name(proto_bap), val_to_str(type, bap_vals, "Unknown")); if(tree) { ti = proto_tree_add_item(tree, proto_bap, tvb, 0, length, FALSE); fh_tree = proto_item_add_subtree(ti, ett_bap_options); proto_tree_add_text(fh_tree, tvb, 0, 1, "Type: %s (0x%02x)", val_to_str(type, bap_vals, "Unknown"), type); proto_tree_add_text(fh_tree, tvb, 1, 1, "Identifier: 0x%02x", id); proto_tree_add_text(fh_tree, tvb, 2, 2, "Length: %u", length); } offset = 4; length -= 4; if (type == BAP_CRES || type == BAP_CBRES || type == BAP_LDQRES || type == BAP_CSRES) { resp_code = tvb_get_guint8(tvb, offset); proto_tree_add_text(fh_tree, tvb, offset, 1, "Response Code: %s (0x%02x)", val_to_str(resp_code, bap_resp_code_vals, "Unknown"), resp_code); offset++; length--; } if(tree) { if (length > 0) { tf = proto_tree_add_text(fh_tree, tvb, offset, length, "Data (%d byte%s)", length, plurality(length, "", "s")); field_tree = proto_item_add_subtree(tf, ett_bap_options); dissect_ip_tcp_options(tvb, offset, length, bap_opts, N_BAP_OPTS, -1, pinfo->fd, field_tree); } } } static void dissect_comp_data(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) { proto_item *ti; proto_tree *comp_data_tree; if (check_col(pinfo->fd, COL_PROTOCOL)) col_set_str(pinfo->fd, COL_PROTOCOL, proto_get_protocol_short_name(proto_comp_data)); if(check_col(pinfo->fd, COL_INFO)) col_add_fstr(pinfo->fd, COL_INFO, "%s %s", proto_get_protocol_short_name(proto_comp_data), val_to_str(PPP_COMP, ppp_vals, "Unknown")); if (tree) { ti = proto_tree_add_item(tree, proto_comp_data, tvb, 0, tvb_length(tvb), FALSE); comp_data_tree = proto_item_add_subtree(ti, ett_comp_data); } } #define MP_FRAG_MASK 0xC0 #define MP_FRAG(bits) ((bits) & MP_FRAG_MASK) #define MP_FRAG_FIRST 0x80 #define MP_FRAG_LAST 0x40 #define MP_FRAG_RESERVED 0x3f static const true_false_string frag_truth = { "Yes", "No" }; /* According to RFC 1717, the length the MP header isn't indicated anywhere in the header itself. It starts out at four bytes and can be negotiated down to two using LCP. We currently assume that all headers are four bytes. - gcc */ static void dissect_mp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) { proto_tree *mp_tree, *hdr_tree; proto_item *ti = NULL; guint8 flags; gchar *flag_str; tvbuff_t *next_tvb; if (check_col(pinfo->fd, COL_PROTOCOL)) col_set_str(pinfo->fd, COL_PROTOCOL, "PPP MP"); if (check_col(pinfo->fd, COL_INFO)) col_set_str(pinfo->fd, COL_INFO, "PPP Multilink"); flags = tvb_get_guint8(tvb, 0); if (tree) { switch (flags) { case MP_FRAG_FIRST: flag_str = "First"; break; case MP_FRAG_LAST: flag_str = "Last"; break; case MP_FRAG_FIRST|MP_FRAG_LAST: flag_str = "First, Last"; break; default: flag_str = "Unknown"; break; } ti = proto_tree_add_item(tree, proto_mp, tvb, 0, 4, FALSE); mp_tree = proto_item_add_subtree(ti, ett_mp); ti = proto_tree_add_text(mp_tree, tvb, 0, 1, "Fragment: 0x%2X (%s)", flags, flag_str); hdr_tree = proto_item_add_subtree(ti, ett_mp_flags); proto_tree_add_boolean(hdr_tree, hf_mp_frag_first, tvb, 0, 1, flags); proto_tree_add_boolean(hdr_tree, hf_mp_frag_last, tvb, 0, 1, flags), proto_tree_add_text(hdr_tree, tvb, 0, 1, "%s", decode_boolean_bitfield(flags, MP_FRAG_RESERVED, sizeof(flags) * 8, "reserved", "reserved")); proto_tree_add_item(mp_tree, hf_mp_sequence_num, tvb, 1, 3, FALSE); } if (tvb_reported_length_remaining(tvb, 4) > 0) { next_tvb = tvb_new_subset(tvb, 4, -1, -1); dissect_ppp(next_tvb, pinfo, tree); } } /* * Handles PPP without HDLC framing, just a protocol field (RFC 1661). */ static void dissect_ppp( tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree ) { proto_item *ti = NULL; proto_tree *fh_tree = NULL; if(tree) { ti = proto_tree_add_item(tree, proto_ppp, tvb, 0, 0, FALSE); fh_tree = proto_item_add_subtree(ti, ett_ppp); } dissect_ppp_common(tvb, 0, pinfo, tree, fh_tree, ti); } /* * Handles link-layer encapsulations where the frame might be * a PPP in HDLC-like Framing frame (RFC 1662) or a Cisco HDLC frame. */ static void dissect_ppp_hdlc( tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree ) { proto_item *ti = NULL; proto_tree *fh_tree = NULL; guint8 byte0; int proto_offset; int rx_fcs_offset; guint32 rx_fcs_exp; guint32 rx_fcs_got; byte0 = tvb_get_guint8(tvb, 0); if (byte0 == CHDLC_ADDR_UNICAST || byte0 == CHDLC_ADDR_MULTICAST) { /* Cisco HDLC encapsulation */ call_dissector(chdlc_handle, tvb, pinfo, tree); } /* * XXX - should we have a routine that always dissects PPP, for use * when we know the packets are PPP, not CHDLC? */ /* PPP HDLC encapsulation */ if (byte0 == 0xff) proto_offset = 2; else { /* address and control are compressed (NULL) */ proto_offset = 0; } /* load the top pane info. This should be overwritten by the next protocol in the stack */ if(check_col(pinfo->fd, COL_RES_DL_SRC)) col_set_str(pinfo->fd, COL_RES_DL_SRC, "N/A" ); if(check_col(pinfo->fd, COL_RES_DL_DST)) col_set_str(pinfo->fd, COL_RES_DL_DST, "N/A" ); if(check_col(pinfo->fd, COL_PROTOCOL)) col_set_str(pinfo->fd, COL_PROTOCOL, "PPP" ); if(tree) { ti = proto_tree_add_item(tree, proto_ppp, tvb, 0, proto_offset, FALSE); fh_tree = proto_item_add_subtree(ti, ett_ppp); if (byte0 == 0xff) { proto_tree_add_text(fh_tree, tvb, 0, 1, "Address: %02x", tvb_get_guint8(tvb, 0)); proto_tree_add_text(fh_tree, tvb, 1, 1, "Control: %02x", tvb_get_guint8(tvb, 1)); } } dissect_ppp_common(tvb, proto_offset, pinfo, tree, fh_tree, ti); /* Calculate the FCS check */ /* XXX - deal with packets cut off by the snapshot length */ if (ppp_fcs_decode == FCS_16) { rx_fcs_offset = tvb_length(tvb) - 2; rx_fcs_exp = fcs16(0xFFFF, tvb, 0, rx_fcs_offset); rx_fcs_got = tvb_get_letohs(tvb, rx_fcs_offset); if (rx_fcs_got != rx_fcs_exp) { proto_tree_add_text(fh_tree, tvb, rx_fcs_offset, 2, "FCS 16: %04x (incorrect, should be %04x)", rx_fcs_got, rx_fcs_exp); } else { proto_tree_add_text(fh_tree, tvb, rx_fcs_offset, 2, "FCS 16: %04x (correct)", rx_fcs_got); } } else if (ppp_fcs_decode == FCS_32) { rx_fcs_offset = tvb_length(tvb) - 4; rx_fcs_exp = fcs32(0xFFFFFFFF, tvb, 0, rx_fcs_offset); rx_fcs_got = tvb_get_letohl(tvb, rx_fcs_offset); if (rx_fcs_got != rx_fcs_exp) { proto_tree_add_text(fh_tree, tvb, rx_fcs_offset, 4, "FCS 32: %08x (incorrect, should be %08x) ", rx_fcs_got, rx_fcs_exp); } else { proto_tree_add_text(fh_tree, tvb, rx_fcs_offset, 4, "FCS 32: %08x (correct)", rx_fcs_got); } } } /* * Handles PAP just as a protocol field */ static void dissect_pap( tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree ) { proto_item *ti; proto_tree *fh_tree = NULL; proto_item *tf; proto_tree *field_tree; proto_item *tm; proto_tree *message_tree; proto_item *tp; proto_tree *peer_id_tree; proto_item *tpw; proto_tree *passwd_tree; guint8 code; guint8 id, peer_id_length, password_length, msg_length; int length, offset; code = tvb_get_guint8(tvb, 0); id = tvb_get_guint8(tvb, 1); length = tvb_get_ntohs(tvb, 2); if(check_col(pinfo->fd, COL_PROTOCOL)) col_set_str(pinfo->fd, COL_PROTOCOL, proto_get_protocol_short_name(proto_pap)); if(check_col(pinfo->fd, COL_INFO)) col_add_fstr(pinfo->fd, COL_INFO, "%s %s", proto_get_protocol_short_name(proto_pap), val_to_str(code, pap_vals, "Unknown")); if(tree) { ti = proto_tree_add_item(tree, proto_pap, tvb, 0, length, FALSE); fh_tree = proto_item_add_subtree(ti, ett_pap); proto_tree_add_text(fh_tree, tvb, 0, 1, "Code: %s (0x%02x)", val_to_str(code, pap_vals, "Unknown"), code); proto_tree_add_text(fh_tree, tvb, 1, 1, "Identifier: 0x%02x", id); proto_tree_add_text(fh_tree, tvb, 2, 2, "Length: %u", length); } offset = 4; length -= 4; switch (code) { case CONFREQ: if(tree) { if (length > 0) { tf = proto_tree_add_text(fh_tree, tvb, offset, length, "Data (%d byte%s)", length, plurality(length, "", "s")); field_tree = proto_item_add_subtree(tf, ett_pap_data); peer_id_length = tvb_get_guint8(tvb, offset); tp = proto_tree_add_text(field_tree, tvb, offset, 1, "Peer ID length: %d byte%s", peer_id_length, plurality(peer_id_length, "", "s")); if (--length > 0) { peer_id_tree = proto_item_add_subtree(tp, ett_pap_peer_id); proto_tree_add_text(peer_id_tree, tvb, ++offset, ppp_min(peer_id_length, length), "Peer-ID (%d byte%s)", peer_id_length, plurality(peer_id_length, "", "s")); offset+=peer_id_length; length-=peer_id_length; if (length > 0) { password_length = tvb_get_guint8(tvb, offset); if (--length > 0) { tpw = proto_tree_add_text(field_tree, tvb, offset, 1, "Password length: %d byte%s", password_length, plurality(password_length, "", "s")); passwd_tree = proto_item_add_subtree(tpw, ett_pap_password); proto_tree_add_text(passwd_tree, tvb, ++offset, ppp_min(password_length, length), "Password (%d byte%s)", password_length, plurality(password_length, "", "s")); } } } } } break; case CONFACK: case CONFNAK: if(tree) { if (length > 0) { tf = proto_tree_add_text(fh_tree, tvb, offset, length, "Data (%d byte%s)", length, plurality(length, "", "s")); field_tree = proto_item_add_subtree(tf, ett_pap_data); msg_length = tvb_get_guint8(tvb, offset); tm = proto_tree_add_text(field_tree, tvb, offset, 1, "Message length: %d byte%s", msg_length, plurality(msg_length, "", "s")); if (--length > 0) { message_tree = proto_item_add_subtree(tm, ett_pap_message); proto_tree_add_text(message_tree, tvb, ++offset, ppp_min(msg_length, length), "Message (%d byte%s)", msg_length, plurality(msg_length, "", "s")); } } } break; default: if (length > 0) proto_tree_add_text(fh_tree, tvb, offset, length, "Stuff (%d byte%s)", length, plurality(length, "", "s")); break; } } /* * Handles CHAP just as a protocol field */ static void dissect_chap( tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree ) { proto_item *ti; proto_tree *fh_tree = NULL; proto_item *tf; proto_tree *field_tree; proto_item *tv; proto_tree *value_tree; guint8 code, id, value_size; guint16 length; int offset; int name_length; code = tvb_get_guint8(tvb, 0); id = tvb_get_guint8(tvb, 1); length = tvb_get_ntohs(tvb, 2); if(check_col(pinfo->fd, COL_PROTOCOL)) col_set_str(pinfo->fd, COL_PROTOCOL, proto_get_protocol_short_name(proto_chap)); if(check_col(pinfo->fd, COL_INFO)) col_add_fstr(pinfo->fd, COL_INFO, "%s %s", proto_get_protocol_short_name(proto_chap), val_to_str(code, chap_vals, "Unknown")); if(tree) { ti = proto_tree_add_item(tree, proto_chap, tvb, 0, length, FALSE); fh_tree = proto_item_add_subtree(ti, ett_chap); proto_tree_add_text(fh_tree, tvb, 0, 1, "Code: %s (0x%02x)", val_to_str(code, chap_vals, "Unknown"), code); proto_tree_add_text(fh_tree, tvb, 1, 1, "Identifier: 0x%02x", id); proto_tree_add_text(fh_tree, tvb, 2, 2, "Length: %u", length); } offset = 4; length -= 4; switch (code) { case CHAP_CHAL: case CHAP_RESP: if(tree) { if (length > 0) { tf = proto_tree_add_text(fh_tree, tvb, offset, length, "Data (%d byte%s)", length, plurality(length, "", "s")); field_tree = proto_item_add_subtree(tf, ett_chap_data); value_size = tvb_get_guint8(tvb, offset); name_length = length - value_size - 1; tv = proto_tree_add_text(field_tree, tvb, offset, 1, "Value Size: %d byte%s", value_size, plurality(value_size, "", "s")); if (--length > 0) { value_tree = proto_item_add_subtree(tv, ett_chap_value); proto_tree_add_text(value_tree, tvb, ++offset, ppp_min(value_size, length), "Value (%d byte%s)", value_size, plurality(value_size, "", "s")); offset+=value_size; length-=value_size; if (length > 0) { proto_tree_add_text(field_tree, tvb, offset, ppp_min(name_length, length), "Name (%d byte%s)", name_length, plurality(name_length, "", "s")); } } } } break; case CHAP_SUCC: case CHAP_FAIL: if(tree) { if (length > 0) { tf = proto_tree_add_text(fh_tree, tvb, offset, length, "Data (%d byte%s)", length, plurality(length, "", "s")); field_tree = proto_item_add_subtree(tf, ett_chap_data); tv = proto_tree_add_text(field_tree, tvb, offset, length, "Message: %d byte%s", length, plurality(length, "", "s")); } } break; default: if (length > 0) proto_tree_add_text(fh_tree, tvb, offset, length, "Stuff (%d byte%s)", length, plurality(length, "", "s")); break; } } void proto_register_ppp(void) { /* static hf_register_info hf[] = { { &variable, { "Name", "ppp.abbreviation", TYPE, VALS_POINTER }}, };*/ static gint *ett[] = { &ett_ppp, }; static enum_val_t ppp_options[] = { {"None", 0}, {"16-Bit", 1}, {"32-Bit", 2}, {NULL, -1} }; module_t *ppp_module; proto_ppp = proto_register_protocol("Point-to-Point Protocol", "PPP", "ppp"); /* proto_register_field_array(proto_ppp, hf, array_length(hf));*/ proto_register_subtree_array(ett, array_length(ett)); /* subdissector code */ subdissector_table = register_dissector_table("ppp.protocol", "PPP protocol", FT_UINT16, BASE_HEX); register_dissector("ppp_hdlc", dissect_ppp_hdlc, proto_ppp); register_dissector("ppp", dissect_ppp, proto_ppp); /* Register the preferences for the ppp protocol */ ppp_module = prefs_register_protocol(proto_ppp, NULL); prefs_register_enum_preference(ppp_module, "ppp_fcs", "PPP Frame Checksum", "PPP Frame Checksum", &ppp_fcs_decode, ppp_options, FALSE); } void proto_reg_handoff_ppp(void) { dissector_handle_t ppp_hdlc_handle, ppp_handle; /* * Get a handle for the CHDLC dissector. */ chdlc_handle = find_dissector("chdlc"); data_handle = find_dissector("data"); ppp_hdlc_handle = find_dissector("ppp_hdlc"); ppp_handle = find_dissector("ppp"); dissector_add("wtap_encap", WTAP_ENCAP_PPP, ppp_hdlc_handle); dissector_add("wtap_encap", WTAP_ENCAP_PPP_WITH_PHDR, ppp_hdlc_handle); dissector_add("fr.ietf", NLPID_PPP, ppp_handle); dissector_add("gre.proto", ETHERTYPE_PPP, ppp_hdlc_handle); } void proto_register_mp(void) { static hf_register_info hf[] = { { &hf_mp_frag_first, { "First fragment", "mp.first", FT_BOOLEAN, 8, TFS(&frag_truth), MP_FRAG_FIRST, "", HFILL }}, { &hf_mp_frag_last, { "Last fragment", "mp.last", FT_BOOLEAN, 8, TFS(&frag_truth), MP_FRAG_LAST, "", HFILL }}, { &hf_mp_sequence_num, { "Sequence number", "mp.seq", FT_UINT24, BASE_DEC, NULL, 0x0, "", HFILL }} }; static gint *ett[] = { &ett_mp, &ett_mp_flags, }; proto_mp = proto_register_protocol("PPP Multilink Protocol", "PPP MP", "mp"); proto_register_field_array(proto_mp, hf, array_length(hf)); proto_register_subtree_array(ett, array_length(ett)); } void proto_reg_handoff_mp(void) { dissector_handle_t mp_handle; mp_handle = create_dissector_handle(dissect_mp, proto_mp); dissector_add("ppp.protocol", PPP_MP, mp_handle); } void proto_register_lcp(void) { static gint *ett[] = { &ett_lcp, &ett_lcp_options, &ett_lcp_mru_opt, &ett_lcp_async_map_opt, &ett_lcp_authprot_opt, &ett_lcp_qualprot_opt, &ett_lcp_magicnum_opt, &ett_lcp_fcs_alternatives_opt, &ett_lcp_numbered_mode_opt, &ett_lcp_callback_opt, &ett_lcp_multilink_ep_disc_opt, &ett_lcp_internationalization_opt, }; proto_lcp = proto_register_protocol("PPP Link Control Protocol", "PPP LCP", "lcp"); proto_register_subtree_array(ett, array_length(ett)); } void proto_reg_handoff_lcp(void) { dissector_handle_t lcp_handle; lcp_handle = create_dissector_handle(dissect_lcp, proto_lcp); dissector_add("ppp.protocol", PPP_LCP, lcp_handle); /* * NDISWAN on Windows translates Ethernet frames from higher-level * protocols into PPP frames to hand to the PPP driver, and translates * PPP frames from the PPP driver to hand to the higher-level protocols. * * Apparently the PPP driver, on at least some versions of Windows, * passes frames for internal-to-PPP protocols up through NDISWAN; * the protocol type field appears to be passed through unchanged * (unlike what's done with, for example, the protocol type field * for IP, which is mapped from its PPP value to its Ethernet value). * * This means that we may see, on Ethernet captures, frames for * protocols internal to PPP, so we register PPP_LCP with the * "ethertype" dissector table as well as the PPP protocol dissector * table. */ dissector_add("ethertype", PPP_LCP, lcp_handle); } void proto_register_ipcp(void) { static gint *ett[] = { &ett_ipcp, &ett_ipcp_options, &ett_ipcp_ipaddrs_opt, &ett_ipcp_compressprot_opt, }; proto_ipcp = proto_register_protocol("PPP IP Control Protocol", "PPP IPCP", "ipcp"); proto_register_subtree_array(ett, array_length(ett)); } void proto_reg_handoff_ipcp(void) { dissector_handle_t ipcp_handle; ipcp_handle = create_dissector_handle(dissect_ipcp, proto_ipcp); dissector_add("ppp.protocol", PPP_IPCP, ipcp_handle); /* * See above comment about NDISWAN for an explanation of why we're * registering with the "ethertype" dissector table. */ dissector_add("ethertype", PPP_IPCP, ipcp_handle); } void proto_register_ccp(void) { static gint *ett[] = { &ett_ccp, &ett_ccp_options, &ett_ccp_stac_opt, &ett_ccp_mppc_opt, &ett_ccp_lzsdcp_opt }; proto_ccp = proto_register_protocol("PPP Compression Control Protocol", "PPP CCP", "ccp"); proto_register_subtree_array(ett, array_length(ett)); } void proto_reg_handoff_ccp(void) { dissector_handle_t ccp_handle; ccp_handle = create_dissector_handle(dissect_ccp, proto_ccp); dissector_add("ppp.protocol", PPP_CCP, ccp_handle); /* * See above comment about NDISWAN for an explanation of why we're * registering with the "ethertype" dissector table. */ dissector_add("ethertype", PPP_CCP, ccp_handle); } void proto_register_cbcp(void) { static gint *ett[] = { &ett_cbcp, &ett_cbcp_options, &ett_cbcp_no_callback_opt, &ett_cbcp_callback_opt }; proto_cbcp = proto_register_protocol("PPP Callback Control Protocoll", "PPP CBCP", "cbcp"); proto_register_subtree_array(ett, array_length(ett)); } void proto_reg_handoff_cbcp(void) { dissector_handle_t cbcp_handle; cbcp_handle = create_dissector_handle(dissect_cbcp, proto_cbcp); dissector_add("ppp.protocol", PPP_CBCP, cbcp_handle); /* * See above comment about NDISWAN for an explanation of why we're * registering with the "ethertype" dissector table. */ dissector_add("ethertype", PPP_CBCP, cbcp_handle); } void proto_register_bacp(void) { static gint *ett[] = { &ett_bacp, &ett_bacp_options, &ett_bacp_favored_peer_opt }; proto_bacp = proto_register_protocol("PPP Bandwidth Allocation Control Protocol", "PPP BACP", "bacp"); proto_register_subtree_array(ett, array_length(ett)); } void proto_reg_handoff_bacp(void) { dissector_handle_t bacp_handle; bacp_handle = create_dissector_handle(dissect_bacp, proto_bacp); dissector_add("ppp.protocol", PPP_BACP, bacp_handle); /* * See above comment about NDISWAN for an explanation of why we're * registering with the "ethertype" dissector table. */ dissector_add("ethertype", PPP_BACP, bacp_handle); } void proto_register_bap(void) { static gint *ett[] = { &ett_bap, &ett_bap_options, &ett_bap_link_type_opt, &ett_bap_phone_delta_opt, &ett_bap_reason_opt, &ett_bap_link_disc_opt, &ett_bap_call_status_opt }; proto_bap = proto_register_protocol("PPP Bandwidth Allocation Protocol", "PPP BAP", "bap"); proto_register_subtree_array(ett, array_length(ett)); } void proto_reg_handoff_bap(void) { dissector_handle_t bap_handle; bap_handle = create_dissector_handle(dissect_bap, proto_bap); dissector_add("ppp.protocol", PPP_BAP, bap_handle); /* * See above comment about NDISWAN for an explanation of why we're * registering with the "ethertype" dissector table. */ dissector_add("ethertype", PPP_BAP, bap_handle); } void proto_register_comp_data(void) { static gint *ett[] = { &ett_comp_data }; proto_comp_data = proto_register_protocol("PPP Compressed Datagram", "PPP Comp", "comp_data"); proto_register_subtree_array(ett, array_length(ett)); } void proto_reg_handoff_comp_data(void) { dissector_handle_t comp_data_handle; comp_data_handle = create_dissector_handle(dissect_comp_data, proto_comp_data); dissector_add("ppp.protocol", PPP_COMP, comp_data_handle); /* * See above comment about NDISWAN for an explanation of why we're * registering with the "ethertype" dissector table. */ dissector_add("ethertype", PPP_COMP, comp_data_handle); } void proto_register_pap(void) { static gint *ett[] = { &ett_pap, &ett_pap_data, &ett_pap_peer_id, &ett_pap_password, &ett_pap_message, }; proto_pap = proto_register_protocol("PPP Password Authentication Protocol", "PPP PAP", "pap"); proto_register_subtree_array(ett, array_length(ett)); } void proto_reg_handoff_pap(void) { dissector_handle_t pap_handle; pap_handle = create_dissector_handle(dissect_pap, proto_pap); dissector_add("ppp.protocol", PPP_PAP, pap_handle); /* * See above comment about NDISWAN for an explanation of why we're * registering with the "ethertype" dissector table. */ dissector_add("ethertype", PPP_PAP, pap_handle); } void proto_register_chap(void) { static gint *ett[] = { &ett_chap, &ett_chap_data, &ett_chap_value, &ett_chap_name, &ett_chap_message, }; proto_chap = proto_register_protocol("PPP Challenge Handshake Authentication Protocol", "PPP CHAP", "chap"); proto_register_subtree_array(ett, array_length(ett)); } void proto_reg_handoff_chap(void) { dissector_handle_t chap_handle; chap_handle = create_dissector_handle(dissect_chap, proto_chap); dissector_add("ppp.protocol", PPP_CHAP, chap_handle); /* * See above comment about NDISWAN for an explanation of why we're * registering with the "ethertype" dissector table. */ dissector_add("ethertype", PPP_CHAP, chap_handle); }