PageRenderTime 51ms CodeModel.GetById 18ms RepoModel.GetById 0ms app.codeStats 1ms

/epan/dissectors/packet-ieee802154.c

https://github.com/labx-technologies-llc/wireshark
C | 2806 lines | 1635 code | 326 blank | 845 comment | 300 complexity | d478e8a8a02678e6e8f8e4e714a3f0ec MD5 | raw file
Possible License(s): GPL-2.0, BSD-3-Clause

Large files files are truncated, but you can click here to view the full file

  1. /* packet-ieee802154.c
  2. *
  3. * $Id$
  4. *
  5. * Auxiliary Security Header support and
  6. * option to force TI CC24xx FCS format
  7. * By Jean-Francois Wauthy <jfw@info.fundp.ac.be>
  8. * Copyright 2009 The University of Namur, Belgium
  9. *
  10. * IEEE 802.15.4 Dissectors for Wireshark
  11. * By Owen Kirby <osk@exegin.com>
  12. * Copyright 2007 Exegin Technologies Limited
  13. *
  14. * Wireshark - Network traffic analyzer
  15. * By Gerald Combs <gerald@wireshark.org>
  16. * Copyright 1998 Gerald Combs
  17. *
  18. * This program is free software; you can redistribute it and/or
  19. * modify it under the terms of the GNU General Public License
  20. * as published by the Free Software Foundation; either version 2
  21. * of the License, or (at your option) any later version.
  22. *
  23. * This program is distributed in the hope that it will be useful,
  24. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  25. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  26. * GNU General Public License for more details.
  27. *
  28. * You should have received a copy of the GNU General Public License
  29. * along with this program; if not, write to the Free Software
  30. * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  31. *------------------------------------------------------------
  32. *
  33. * In IEEE 802.15.4 packets, all fields are little endian. And
  34. * Each byte is transmitted least significant bit first (reflected
  35. * bit ordering).
  36. *------------------------------------------------------------
  37. *
  38. * IEEE 802.15.4 Packets have the following format:
  39. * | FCF |Seq No| Addressing | Data | FCS |
  40. * |2 bytes|1 byte|0 to 20 bytes|Length-(Overhead) bytes|2 Bytes|
  41. *------------------------------------------------------------
  42. *
  43. * CRC16 is calculated using the x^16 + x^12 + x^5 + 1 polynomial
  44. * as specified by ITU-T, and is calculated over the IEEE 802.15.4
  45. * packet (excluding the FCS) as transmitted over the air. Note,
  46. * that because the least significan bits are transmitted first, this
  47. * will require reversing the bit-order in each byte. Also, unlike
  48. * most CRC algorithms, IEEE 802.15.4 uses an initial and final value
  49. * of 0x0000, instead of 0xffff (which is used by the CCITT).
  50. *------------------------------------------------------------
  51. *
  52. * This dissector supports both link-layer IEEE 802.15.4 captures
  53. * and IEEE 802.15.4 packets encapsulated within other layers.
  54. * Additionally, support has been provided for various formats
  55. * of the frame check sequence:
  56. * - IEEE 802.15.4 compliant FCS.
  57. * - ChipCon/Texas Instruments CC24xx style FCS.
  58. *------------------------------------------------------------
  59. */
  60. /* Include files */
  61. #include "config.h"
  62. #include <string.h>
  63. #include <sys/stat.h>
  64. #include <glib.h>
  65. #include <epan/wmem/wmem.h>
  66. #include <epan/packet.h>
  67. #include <epan/crc16-tvb.h>
  68. #include <epan/expert.h>
  69. #include <epan/addr_resolv.h>
  70. #include <epan/prefs.h>
  71. #include <epan/uat.h>
  72. #include <epan/strutil.h>
  73. #include <epan/show_exception.h>
  74. /* Use libgcrypt for cipher libraries. */
  75. #ifdef HAVE_LIBGCRYPT
  76. #include <wsutil/wsgcrypt.h>
  77. #endif /* HAVE_LIBGCRYPT */
  78. #include "packet-ieee802154.h"
  79. #include "packet-sll.h"
  80. /* Dissection Options for dissect_ieee802154_common */
  81. #define DISSECT_IEEE802154_OPTION_CC24xx 0x00000001 /* FCS field contains a TI CC24xx style FCS. */
  82. #define DISSECT_IEEE802154_OPTION_LINUX 0x00000002 /* Addressing fields are padded DLT_IEEE802_15_4_LINUX, not implemented. */
  83. /* ethertype for 802.15.4 tag - encapsulating an Ethernet packet */
  84. static unsigned int ieee802154_ethertype = 0x809A;
  85. /* boolean value set if the FCS field is using the TI CC24xx format */
  86. static gboolean ieee802154_cc24xx = FALSE;
  87. /* boolean value set if the FCS must be ok before payload is dissected */
  88. static gboolean ieee802154_fcs_ok = TRUE;
  89. /* User string with the decryption key. */
  90. static const gchar *ieee802154_key_str = NULL;
  91. static gboolean ieee802154_key_valid;
  92. static guint8 ieee802154_key[IEEE802154_CIPHER_SIZE];
  93. static const char *ieee802154_user = "User";
  94. /*-------------------------------------
  95. * Address Hash Tables
  96. *-------------------------------------
  97. */
  98. static ieee802154_map_tab_t ieee802154_map = { NULL, NULL };
  99. /*-------------------------------------
  100. * Static Address Mapping UAT
  101. *-------------------------------------
  102. */
  103. /* UAT entry structure. */
  104. typedef struct {
  105. guchar *eui64;
  106. guint eui64_len;
  107. guint addr16;
  108. guint pan;
  109. } static_addr_t;
  110. /* UAT variables */
  111. static uat_t *static_addr_uat = NULL;
  112. static static_addr_t *static_addrs = NULL;
  113. static guint num_static_addrs = 0;
  114. /* Sanity-checks a UAT record. */
  115. static void
  116. addr_uat_update_cb(void *r, const char **err)
  117. {
  118. static_addr_t *map = (static_addr_t *)r;
  119. /* Ensure a valid short address */
  120. if (map->addr16 >= IEEE802154_NO_ADDR16) {
  121. *err = "Invalid short address";
  122. }
  123. /* Ensure a valid PAN identifier. */
  124. if (map->pan >= IEEE802154_BCAST_PAN) {
  125. *err = "Invalid PAN identifier";
  126. }
  127. /* Ensure a valid EUI-64 length */
  128. if (map->eui64_len != sizeof(guint64)) {
  129. *err = "Invalid EUI-64 length";
  130. }
  131. } /* ieee802154_addr_uat_update_cb */
  132. /* Field callbacks. */
  133. UAT_HEX_CB_DEF(addr_uat, addr16, static_addr_t)
  134. UAT_HEX_CB_DEF(addr_uat, pan, static_addr_t)
  135. UAT_BUFFER_CB_DEF(addr_uat, eui64, static_addr_t, eui64, eui64_len)
  136. /*-------------------------------------
  137. * Dissector Function Prototypes
  138. *-------------------------------------
  139. */
  140. /* Register Functions. Loads the dissector into Wireshark. */
  141. void proto_reg_handoff_ieee802154 (void);
  142. /* Dissection Routines. */
  143. static void dissect_ieee802154_nonask_phy (tvbuff_t *, packet_info *, proto_tree *);
  144. static void dissect_ieee802154 (tvbuff_t *, packet_info *, proto_tree *);
  145. static void dissect_ieee802154_nofcs (tvbuff_t *, packet_info *, proto_tree *);
  146. static void dissect_ieee802154_cc24xx (tvbuff_t *, packet_info *, proto_tree *);
  147. /*static void dissect_ieee802154_linux (tvbuff_t *, packet_info *, proto_tree *); TODO: Implement Me. */
  148. static void dissect_ieee802154_common (tvbuff_t *, packet_info *, proto_tree *, guint);
  149. /* Sub-dissector helpers. */
  150. static void dissect_ieee802154_fcf (tvbuff_t *, packet_info *, proto_tree *, ieee802154_packet *, guint *);
  151. static void dissect_ieee802154_superframe (tvbuff_t *, packet_info *, proto_tree *, guint *);
  152. static void dissect_ieee802154_gtsinfo (tvbuff_t *, packet_info *, proto_tree *, guint *);
  153. static void dissect_ieee802154_pendaddr (tvbuff_t *, packet_info *, proto_tree *, guint *);
  154. static void dissect_ieee802154_assoc_req (tvbuff_t *, packet_info *, proto_tree *, ieee802154_packet *);
  155. static void dissect_ieee802154_assoc_rsp (tvbuff_t *, packet_info *, proto_tree *, ieee802154_packet *);
  156. static void dissect_ieee802154_disassoc (tvbuff_t *, packet_info *, proto_tree *, ieee802154_packet *);
  157. static void dissect_ieee802154_realign (tvbuff_t *, packet_info *, proto_tree *, ieee802154_packet *);
  158. static void dissect_ieee802154_gtsreq (tvbuff_t *, packet_info *, proto_tree *, ieee802154_packet *);
  159. /* Decryption helpers. */
  160. typedef enum {
  161. DECRYPT_PACKET_SUCCEEDED,
  162. DECRYPT_NOT_ENCRYPTED,
  163. DECRYPT_VERSION_UNSUPPORTED,
  164. DECRYPT_PACKET_TOO_SMALL,
  165. DECRYPT_PACKET_NO_EXT_SRC_ADDR,
  166. DECRYPT_PACKET_NO_KEY,
  167. DECRYPT_PACKET_DECRYPT_FAILED,
  168. DECRYPT_PACKET_MIC_CHECK_FAILED
  169. } ws_decrypt_status;
  170. static tvbuff_t * dissect_ieee802154_decrypt(tvbuff_t *, guint, packet_info *, ieee802154_packet *,
  171. ws_decrypt_status *);
  172. static void ccm_init_block (gchar *, gboolean, gint, guint64, ieee802154_packet *, gint);
  173. static gboolean ccm_ctr_encrypt (const gchar *, const gchar *, gchar *, gchar *, gint);
  174. static gboolean ccm_cbc_mac (const gchar *, const gchar *, const gchar *, gint, const gchar *, gint, gchar *);
  175. /* Initialize Protocol and Registered fields */
  176. static int proto_ieee802154_nonask_phy = -1;
  177. static int hf_ieee802154_nonask_phy_preamble = -1;
  178. static int hf_ieee802154_nonask_phy_sfd = -1;
  179. static int hf_ieee802154_nonask_phy_length = -1;
  180. static int proto_ieee802154 = -1;
  181. static int hf_ieee802154_frame_length = -1;
  182. static int hf_ieee802154_frame_type = -1;
  183. static int hf_ieee802154_security = -1;
  184. static int hf_ieee802154_pending = -1;
  185. static int hf_ieee802154_ack_request = -1;
  186. static int hf_ieee802154_intra_pan = -1;
  187. static int hf_ieee802154_seqno = -1;
  188. static int hf_ieee802154_src_addr_mode = -1;
  189. static int hf_ieee802154_dst_addr_mode = -1;
  190. static int hf_ieee802154_version = -1;
  191. static int hf_ieee802154_dst_panID = -1;
  192. static int hf_ieee802154_dst16 = -1;
  193. static int hf_ieee802154_dst64 = -1;
  194. static int hf_ieee802154_src_panID = -1;
  195. static int hf_ieee802154_src16 = -1;
  196. static int hf_ieee802154_src64 = -1;
  197. static int hf_ieee802154_src64_origin = -1;
  198. static int hf_ieee802154_fcs = -1;
  199. static int hf_ieee802154_rssi = -1;
  200. static int hf_ieee802154_fcs_ok = -1;
  201. static int hf_ieee802154_correlation = -1;
  202. /* Registered fields for Command Packets */
  203. static int hf_ieee802154_cmd_id = -1;
  204. static int hf_ieee802154_cinfo_alt_coord = -1;
  205. static int hf_ieee802154_cinfo_device_type = -1;
  206. static int hf_ieee802154_cinfo_power_src = -1;
  207. static int hf_ieee802154_cinfo_idle_rx = -1;
  208. static int hf_ieee802154_cinfo_sec_capable = -1;
  209. static int hf_ieee802154_cinfo_alloc_addr = -1;
  210. static int hf_ieee802154_assoc_addr = -1;
  211. static int hf_ieee802154_assoc_status = -1;
  212. static int hf_ieee802154_disassoc_reason = -1;
  213. static int hf_ieee802154_realign_pan = -1;
  214. static int hf_ieee802154_realign_caddr = -1;
  215. static int hf_ieee802154_realign_channel = -1;
  216. static int hf_ieee802154_realign_addr = -1;
  217. static int hf_ieee802154_realign_channel_page = -1;
  218. static int hf_ieee802154_gtsreq_len = -1;
  219. static int hf_ieee802154_gtsreq_dir = -1;
  220. static int hf_ieee802154_gtsreq_type = -1;
  221. /* Registered fields for Beacon Packets */
  222. static int hf_ieee802154_beacon_order = -1;
  223. static int hf_ieee802154_superframe_order = -1;
  224. static int hf_ieee802154_cap = -1;
  225. static int hf_ieee802154_superframe_battery_ext = -1;
  226. static int hf_ieee802154_superframe_coord = -1;
  227. static int hf_ieee802154_assoc_permit = -1;
  228. static int hf_ieee802154_gts_count = -1;
  229. static int hf_ieee802154_gts_permit = -1;
  230. static int hf_ieee802154_gts_direction = -1;
  231. static int hf_ieee802154_pending16 = -1;
  232. static int hf_ieee802154_pending64 = -1;
  233. /* Registered fields for Auxiliary Security Header */
  234. static int hf_ieee802154_security_level = -1;
  235. static int hf_ieee802154_key_id_mode = -1;
  236. static int hf_ieee802154_aux_sec_reserved = -1;
  237. static int hf_ieee802154_aux_sec_frame_counter = -1;
  238. static int hf_ieee802154_aux_sec_key_source = -1;
  239. static int hf_ieee802154_aux_sec_key_index = -1;
  240. /* 802.15.4-2003 security */
  241. static int hf_ieee802154_sec_frame_counter = -1;
  242. static int hf_ieee802154_sec_key_sequence_counter = -1;
  243. /* Initialize Subtree Pointers */
  244. static gint ett_ieee802154_nonask_phy = -1;
  245. static gint ett_ieee802154_nonask_phy_phr = -1;
  246. static gint ett_ieee802154 = -1;
  247. static gint ett_ieee802154_fcf = -1;
  248. static gint ett_ieee802154_auxiliary_security = -1;
  249. static gint ett_ieee802154_aux_sec_control = -1;
  250. static gint ett_ieee802154_aux_sec_key_id = -1;
  251. static gint ett_ieee802154_fcs = -1;
  252. static gint ett_ieee802154_cmd = -1;
  253. static gint ett_ieee802154_superframe = -1;
  254. static gint ett_ieee802154_gts = -1;
  255. static gint ett_ieee802154_gts_direction = -1;
  256. static gint ett_ieee802154_gts_descriptors = -1;
  257. static gint ett_ieee802154_pendaddr = -1;
  258. /* Dissector handles */
  259. static dissector_handle_t data_handle;
  260. static heur_dissector_list_t ieee802154_heur_subdissector_list;
  261. /* Name Strings */
  262. static const value_string ieee802154_frame_types[] = {
  263. { IEEE802154_FCF_BEACON, "Beacon" },
  264. { IEEE802154_FCF_DATA, "Data" },
  265. { IEEE802154_FCF_ACK, "Ack" },
  266. { IEEE802154_FCF_CMD, "Command" },
  267. { 0, NULL }
  268. };
  269. static const value_string ieee802154_addr_modes[] = {
  270. { IEEE802154_FCF_ADDR_NONE, "None" },
  271. { IEEE802154_FCF_ADDR_SHORT,"Short/16-bit" },
  272. { IEEE802154_FCF_ADDR_EXT, "Long/64-bit" },
  273. { 0, NULL }
  274. };
  275. static const value_string ieee802154_cmd_names[] = {
  276. { IEEE802154_CMD_ASRQ, "Association Request" },
  277. { IEEE802154_CMD_ASRSP, "Association Response" },
  278. { IEEE802154_CMD_DISAS, "Disassociation Notification" },
  279. { IEEE802154_CMD_DATA_RQ, "Data Request" },
  280. { IEEE802154_CMD_PANID_ERR, "PAN ID Conflict" },
  281. { IEEE802154_CMD_ORPH_NOTIF,"Orphan Notification" },
  282. { IEEE802154_CMD_BCN_RQ, "Beacon Request" },
  283. { IEEE802154_CMD_COORD_REAL,"Coordinator Realignment" },
  284. { IEEE802154_CMD_GTS_REQ, "GTS Request" },
  285. { 0, NULL }
  286. };
  287. static const value_string ieee802154_sec_level_names[] = {
  288. { SECURITY_LEVEL_NONE, "No Security" },
  289. { SECURITY_LEVEL_MIC_32, "32-bit Message Integrity Code" },
  290. { SECURITY_LEVEL_MIC_64, "64-bit Message Integrity Code" },
  291. { SECURITY_LEVEL_MIC_128, "128-bit Message Integrity Code" },
  292. { SECURITY_LEVEL_ENC, "Encryption" },
  293. { SECURITY_LEVEL_ENC_MIC_32, "Encryption with 32-bit Message Integrity Code" },
  294. { SECURITY_LEVEL_ENC_MIC_64, "Encryption with 64-bit Message Integrity Code" },
  295. { SECURITY_LEVEL_ENC_MIC_128, "Encryption with 128-bit Message Integrity Code" },
  296. { 0, NULL }
  297. };
  298. static const value_string ieee802154_key_id_mode_names[] = {
  299. { KEY_ID_MODE_IMPLICIT, "Implicit Key" },
  300. { KEY_ID_MODE_KEY_INDEX, "Indexed Key using the Default Key Source" },
  301. { KEY_ID_MODE_KEY_EXPLICIT_4, "Explicit Key with 4-octet Key Source" },
  302. { KEY_ID_MODE_KEY_EXPLICIT_8, "Explicit Key with 8-octet Key Source" },
  303. { 0, NULL }
  304. };
  305. static const true_false_string ieee802154_gts_direction_tfs = {
  306. "Receive Only",
  307. "Transmit Only"
  308. };
  309. /* The 802.15.4-2003 security suites for the security preferences (only AES-CCM suites are supported). */
  310. /* NOTE: The equivalent 2006 security level identifer enumerations are used to simplify 2003 & 2006 integration! */
  311. static const enum_val_t ieee802154_2003_sec_suite_enums[] = {
  312. { "AES-CCM-128", "AES-128 Encryption, 128-bit Integrity Protection", SECURITY_LEVEL_ENC_MIC_128 },
  313. { "AES-CCM-64", "AES-128 Encryption, 64-bit Integrity Protection", SECURITY_LEVEL_ENC_MIC_64 },
  314. { "AES-CCM-32", "AES-128 Encryption, 32-bit Integrity Protection", SECURITY_LEVEL_ENC_MIC_32 },
  315. { NULL, NULL, 0 }
  316. };
  317. /* Preferences for 2003 security */
  318. static gint ieee802154_sec_suite = SECURITY_LEVEL_ENC_MIC_64;
  319. static gboolean ieee802154_extend_auth = TRUE;
  320. /* Macro to check addressing, and throw a warning flag if incorrect. */
  321. #define IEEE802154_CMD_ADDR_CHECK(_pinfo_, _item_, _cmdid_, _x_) \
  322. if (!(_x_)) \
  323. expert_add_info_format(_pinfo_, _item_, PI_MALFORMED, PI_WARN, \
  324. "Invalid Addressing for %s", \
  325. val_to_str_const(_cmdid_, ieee802154_cmd_names, "Unknown Command"))
  326. /* CRC definitions. IEEE 802.15.4 CRCs vary from CCITT by using an initial value of
  327. * 0x0000, and no XOR out. IEEE802154_CRC_XOR is defined as 0xFFFF in order to un-XOR
  328. * the output from the CCITT CRC routines in Wireshark.
  329. */
  330. #define IEEE802154_CRC_SEED 0x0000
  331. #define IEEE802154_CRC_XOROUT 0xFFFF
  332. #define ieee802154_crc_tvb(tvb, offset) (crc16_ccitt_tvb_seed(tvb, offset, IEEE802154_CRC_SEED) ^ IEEE802154_CRC_XOROUT)
  333. /*FUNCTION:------------------------------------------------------
  334. * NAME
  335. * dissect_ieee802154_fcf
  336. * DESCRIPTION
  337. * Dissector helper, parses and displays the frame control
  338. * field.
  339. *
  340. * PARAMETERS
  341. * ieee802154_packet *packet - Packet info structure.
  342. * tvbuff_t *tvb - pointer to buffer containing raw packet.
  343. * packet_info *pinfo - pointer to packet information fields
  344. * proto_tree *tree - pointer to data tree wireshark uses to display packet.
  345. * ieee802154_packet *packet - IEEE 802.15.4 packet information.
  346. * guint offset - offset into the tvb to find the FCF.
  347. * RETURNS
  348. * void
  349. *---------------------------------------------------------------
  350. */
  351. static void
  352. dissect_ieee802154_fcf(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, ieee802154_packet *packet, guint *offset)
  353. {
  354. guint16 fcf;
  355. proto_tree *field_tree;
  356. proto_item *ti;
  357. /* Get the FCF field. */
  358. fcf = tvb_get_letohs(tvb, *offset);
  359. /* Parse FCF Flags. */
  360. packet->frame_type = fcf & IEEE802154_FCF_TYPE_MASK;
  361. packet->security_enable = fcf & IEEE802154_FCF_SEC_EN;
  362. packet->frame_pending = fcf & IEEE802154_FCF_FRAME_PND;
  363. packet->ack_request = fcf & IEEE802154_FCF_ACK_REQ;
  364. packet->intra_pan = fcf & IEEE802154_FCF_INTRA_PAN;
  365. packet->version = (fcf & IEEE802154_FCF_VERSION) >> 12;
  366. packet->dst_addr_mode = (fcf & IEEE802154_FCF_DADDR_MASK) >> 10;
  367. packet->src_addr_mode = (fcf & IEEE802154_FCF_SADDR_MASK) >> 14;
  368. /* Display the frame type. */
  369. proto_item_append_text(tree, " %s", val_to_str_const(packet->frame_type, ieee802154_frame_types, "Reserved"));
  370. col_set_str(pinfo->cinfo, COL_INFO, val_to_str_const(packet->frame_type, ieee802154_frame_types, "Reserved"));
  371. /* Add the FCF to the protocol tree. */
  372. if (tree) {
  373. /* Create the FCF subtree. */
  374. ti = proto_tree_add_text(tree, tvb, *offset, 2, "Frame Control Field: %s (0x%04x)",
  375. val_to_str_const(packet->frame_type, ieee802154_frame_types, "Unknown"), fcf);
  376. field_tree = proto_item_add_subtree(ti, ett_ieee802154_fcf);
  377. /* FCF Fields. */
  378. proto_tree_add_uint(field_tree, hf_ieee802154_frame_type, tvb, *offset, 1, fcf & IEEE802154_FCF_TYPE_MASK);
  379. proto_tree_add_boolean(field_tree, hf_ieee802154_security, tvb, *offset, 1, fcf & IEEE802154_FCF_SEC_EN);
  380. proto_tree_add_boolean(field_tree, hf_ieee802154_pending, tvb, *offset, 1, fcf & IEEE802154_FCF_FRAME_PND);
  381. proto_tree_add_boolean(field_tree, hf_ieee802154_ack_request, tvb, *offset, 1, fcf & IEEE802154_FCF_ACK_REQ);
  382. proto_tree_add_boolean(field_tree, hf_ieee802154_intra_pan, tvb, *offset, 1, fcf & IEEE802154_FCF_INTRA_PAN);
  383. proto_tree_add_uint(field_tree, hf_ieee802154_dst_addr_mode, tvb, (*offset)+1, 1, fcf & IEEE802154_FCF_DADDR_MASK);
  384. proto_tree_add_uint(field_tree, hf_ieee802154_version, tvb, (*offset)+1, 1, fcf & IEEE802154_FCF_VERSION);
  385. proto_tree_add_uint(field_tree, hf_ieee802154_src_addr_mode, tvb, (*offset)+1, 1, fcf & IEEE802154_FCF_SADDR_MASK);
  386. }
  387. *offset += 2;
  388. } /* dissect_ieee802154_fcf */
  389. /*FUNCTION:------------------------------------------------------
  390. * NAME
  391. * dissect_ieee802154_nonask_phy
  392. * DESCRIPTION
  393. * Dissector for IEEE 802.15.4 non-ASK PHY packet with an FCS containing
  394. * a 16-bit CRC value.
  395. *
  396. * PARAMETERS
  397. * tvbuff_t *tvb - pointer to buffer containing raw packet.
  398. * packet_info *pinfo - pointer to packet information fields
  399. * proto_tree *tree - pointer to data tree wireshark uses to display packet.
  400. * RETURNS
  401. * void
  402. *---------------------------------------------------------------
  403. */
  404. static void
  405. dissect_ieee802154_nonask_phy(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
  406. {
  407. proto_tree *ieee802154_tree = NULL;
  408. proto_item *proto_root = NULL;
  409. guint offset = 0;
  410. guint32 preamble;
  411. guint8 sfd,phr;
  412. tvbuff_t* mac;
  413. /* Create the protocol tree. */
  414. if (tree) {
  415. proto_root = proto_tree_add_protocol_format(tree, proto_ieee802154_nonask_phy, tvb, 0, tvb_length(tvb), "IEEE 802.15.4 non-ASK PHY");
  416. ieee802154_tree = proto_item_add_subtree(proto_root, ett_ieee802154_nonask_phy);
  417. }
  418. /* Add the protocol name. */
  419. col_set_str(pinfo->cinfo, COL_PROTOCOL, "IEEE 802.15.4 non-ASK PHY");
  420. /* Add the packet length. */
  421. col_clear(pinfo->cinfo, COL_PACKET_LENGTH);
  422. col_add_fstr(pinfo->cinfo, COL_PACKET_LENGTH, "%i", tvb_length(tvb));
  423. preamble=tvb_get_letohl(tvb,offset);
  424. sfd=tvb_get_guint8(tvb,offset+4);
  425. phr=tvb_get_guint8(tvb,offset+4+1);
  426. if(tree) {
  427. proto_tree *phr_tree;
  428. proto_item *pi;
  429. guint loffset=offset;
  430. proto_tree_add_uint(ieee802154_tree, hf_ieee802154_nonask_phy_preamble, tvb, loffset, 4, preamble);
  431. loffset+=4;
  432. proto_tree_add_uint(ieee802154_tree, hf_ieee802154_nonask_phy_sfd, tvb, loffset, 1, sfd);
  433. loffset+=1;
  434. pi = proto_tree_add_text(ieee802154_tree, tvb, loffset, 1, "PHR: 0x%02x", phr);
  435. phr_tree = proto_item_add_subtree(pi, ett_ieee802154_nonask_phy_phr);
  436. proto_tree_add_uint(phr_tree, hf_ieee802154_nonask_phy_length, tvb, loffset, 1, phr);
  437. }
  438. offset+=4+2*1;
  439. mac=tvb_new_subset(tvb,offset,-1, phr & IEEE802154_PHY_LENGTH_MASK);
  440. /* Call the common dissector. */
  441. dissect_ieee802154(mac, pinfo, ieee802154_tree);
  442. } /* dissect_ieee802154_nonask_phy */
  443. /*FUNCTION:------------------------------------------------------
  444. * NAME
  445. * dissect_ieee802154
  446. * DESCRIPTION
  447. * Dissector for IEEE 802.15.4 packet with an FCS containing
  448. * a 16-bit CRC value.
  449. *
  450. * PARAMETERS
  451. * tvbuff_t *tvb - pointer to buffer containing raw packet.
  452. * packet_info *pinfo - pointer to packet information fields
  453. * proto_tree *tree - pointer to data tree wireshark uses to display packet.
  454. * RETURNS
  455. * void
  456. *---------------------------------------------------------------
  457. */
  458. static void
  459. dissect_ieee802154(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
  460. {
  461. /* Call the common dissector. */
  462. dissect_ieee802154_common(tvb, pinfo, tree, (ieee802154_cc24xx ? DISSECT_IEEE802154_OPTION_CC24xx : 0));
  463. } /* dissect_ieee802154 */
  464. /*FUNCTION:------------------------------------------------------
  465. * NAME
  466. * dissect_ieee802154_nofcs
  467. * DESCRIPTION
  468. * Dissector for IEEE 802.15.4 packet with no FCS present.
  469. *
  470. * PARAMETERS
  471. * tvbuff_t *tvb - pointer to buffer containing raw packet.
  472. * packet_info *pinfo - pointer to packet information fields
  473. * proto_tree *tree - pointer to data tree wireshark uses to display packet.
  474. * RETURNS
  475. * void
  476. *---------------------------------------------------------------
  477. */
  478. static void
  479. dissect_ieee802154_nofcs(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
  480. {
  481. tvbuff_t *new_tvb;
  482. /* If there is no FCS present in the reported packet, then the length of
  483. * the true IEEE 802.15.4 packet is actually 2 bytes longer. Re-create
  484. * the buffer with an extended reported length so that the packet will
  485. * be handled as though the FCS were truncated.
  486. *
  487. * Note, we can't just call tvb_set_reported_length(), because it includes
  488. * checks to ensure that the new reported length is not longer than the old
  489. * reported length (why?), and will throw an exception.
  490. */
  491. new_tvb = tvb_new_subset(tvb, 0, -1, tvb_reported_length(tvb)+IEEE802154_FCS_LEN);
  492. /* Call the common dissector. */
  493. dissect_ieee802154_common(new_tvb, pinfo, tree, 0);
  494. } /* dissect_ieee802154_nofcs */
  495. /*FUNCTION:------------------------------------------------------
  496. * NAME
  497. * dissect_ieee802154_cc24xx
  498. * DESCRIPTION
  499. * Dissector for IEEE 802.15.4 packet with a ChipCon/Texas
  500. * Instruments compatible FCS. This is typically called by
  501. * layers encapsulating an IEEE 802.15.4 packet.
  502. *
  503. * PARAMETERS
  504. * tvbuff_t *tvb - pointer to buffer containing raw packet.
  505. * packet_info *pinfo - pointer to packet information fields
  506. * proto_tree *tree - pointer to data tree wireshark uses to display packet.
  507. * RETURNS
  508. * void
  509. *---------------------------------------------------------------
  510. */
  511. static void
  512. dissect_ieee802154_cc24xx(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
  513. {
  514. /* Call the common dissector. */
  515. dissect_ieee802154_common(tvb, pinfo, tree, DISSECT_IEEE802154_OPTION_CC24xx);
  516. } /* dissect_ieee802154_cc24xx */
  517. /*FUNCTION:------------------------------------------------------
  518. * NAME
  519. * dissect_ieee802154_common
  520. * DESCRIPTION
  521. * IEEE 802.15.4 packet dissection routine for Wireshark.
  522. * This function extracts all the information first before displaying.
  523. * If payload exists, that portion will be passed into another dissector
  524. * for further processing.
  525. *
  526. * This is called after the individual dissect_ieee802154* functions
  527. * have been called to determine what sort of FCS is present.
  528. * The dissect_ieee802154* functions will set the parameters
  529. * in the ieee802154_packet structure, and pass it to this one
  530. * through the pinfo->private_data pointer.
  531. *
  532. * PARAMETERS
  533. * tvbuff_t *tvb - pointer to buffer containing raw packet.
  534. * packet_info *pinfo - pointer to packet information fields
  535. * proto_tree *tree - pointer to data tree wireshark uses to display packet.
  536. * guint options - bitwise or of dissector options (see DISSECT_IEEE802154_OPTION_xxx).
  537. * RETURNS
  538. * void
  539. *---------------------------------------------------------------
  540. */
  541. static void
  542. dissect_ieee802154_common(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, guint options)
  543. {
  544. tvbuff_t *volatile payload_tvb;
  545. proto_tree *volatile ieee802154_tree = NULL;
  546. proto_item *volatile proto_root = NULL;
  547. proto_item *hidden_item;
  548. proto_item *ti;
  549. void *pd_save;
  550. guint offset = 0;
  551. volatile gboolean fcs_ok = TRUE;
  552. const char *saved_proto;
  553. ws_decrypt_status status;
  554. ieee802154_packet *packet = wmem_new(wmem_packet_scope(), ieee802154_packet);
  555. ieee802154_short_addr addr16;
  556. ieee802154_hints_t *ieee_hints;
  557. /* Link our packet info structure into the private data field for the
  558. * Network-Layer heuristic subdissectors. */
  559. pd_save = pinfo->private_data;
  560. pinfo->private_data = packet;
  561. packet->short_table = ieee802154_map.short_table;
  562. /* Allocate frame data with hints for upper layers */
  563. if(!pinfo->fd->flags.visited){
  564. ieee_hints = se_new0(ieee802154_hints_t);
  565. p_add_proto_data(pinfo->fd, proto_ieee802154, 0, ieee_hints);
  566. } else {
  567. ieee_hints = (ieee802154_hints_t *)p_get_proto_data(pinfo->fd, proto_ieee802154, 0);
  568. }
  569. /* Create the protocol tree. */
  570. if (tree) {
  571. proto_root = proto_tree_add_protocol_format(tree, proto_ieee802154, tvb, 0, tvb_length(tvb), "IEEE 802.15.4");
  572. ieee802154_tree = proto_item_add_subtree(proto_root, ett_ieee802154);
  573. }
  574. /* Add the protocol name. */
  575. col_set_str(pinfo->cinfo, COL_PROTOCOL, "IEEE 802.15.4");
  576. /* Add the packet length. */
  577. col_clear(pinfo->cinfo, COL_PACKET_LENGTH);
  578. col_add_fstr(pinfo->cinfo, COL_PACKET_LENGTH, "%i", tvb_length(tvb));
  579. /* Add the packet length to the filter field */
  580. hidden_item = proto_tree_add_uint(ieee802154_tree, hf_ieee802154_frame_length, NULL, 0, 0, tvb_reported_length(tvb));
  581. PROTO_ITEM_SET_HIDDEN(hidden_item);
  582. /*=====================================================
  583. * FRAME CONTROL FIELD
  584. *=====================================================
  585. */
  586. dissect_ieee802154_fcf(tvb, pinfo, ieee802154_tree, packet, &offset);
  587. /*=====================================================
  588. * SEQUENCE NUMBER
  589. *=====================================================
  590. */
  591. packet->seqno = tvb_get_guint8(tvb, offset);
  592. if (tree) {
  593. proto_tree_add_uint(ieee802154_tree, hf_ieee802154_seqno, tvb, offset, 1, packet->seqno);
  594. /* For Ack packets display this in the root. */
  595. if (packet->frame_type == IEEE802154_FCF_ACK) {
  596. proto_item_append_text(proto_root, ", Sequence Number: %u", packet->seqno);
  597. }
  598. }
  599. offset += 1;
  600. /*=====================================================
  601. * ADDRESSING FIELDS
  602. *=====================================================
  603. */
  604. /* Clear out the addressing strings. */
  605. SET_ADDRESS(&pinfo->dst, AT_NONE, 0, NULL);
  606. SET_ADDRESS(&pinfo->src, AT_NONE, 0, NULL);
  607. SET_ADDRESS(&pinfo->dl_dst, AT_NONE, 0, NULL);
  608. SET_ADDRESS(&pinfo->dl_src, AT_NONE, 0, NULL);
  609. SET_ADDRESS(&pinfo->net_dst, AT_NONE, 0, NULL);
  610. SET_ADDRESS(&pinfo->net_src, AT_NONE, 0, NULL);
  611. /* Get and display the destination PAN, if present. */
  612. if ( (packet->dst_addr_mode == IEEE802154_FCF_ADDR_SHORT) ||
  613. (packet->dst_addr_mode == IEEE802154_FCF_ADDR_EXT) ) {
  614. packet->dst_pan = tvb_get_letohs(tvb, offset);
  615. if (tree) {
  616. proto_tree_add_uint(ieee802154_tree, hf_ieee802154_dst_panID, tvb, offset, 2, packet->dst_pan);
  617. }
  618. offset += 2;
  619. }
  620. /* Get destination address. */
  621. if (packet->dst_addr_mode == IEEE802154_FCF_ADDR_SHORT) {
  622. char dst_addr[32];
  623. /* Get the address. */
  624. packet->dst16 = tvb_get_letohs(tvb, offset);
  625. /* Display the destination address. */
  626. if ( packet->dst16 == IEEE802154_BCAST_ADDR ) {
  627. g_snprintf(dst_addr, 32, "Broadcast");
  628. }
  629. else {
  630. g_snprintf(dst_addr, 32, "0x%04x", packet->dst16);
  631. }
  632. /* Provide address hints to higher layers that need it. */
  633. if (ieee_hints) {
  634. ieee_hints->dst16 = packet->dst16;
  635. }
  636. TVB_SET_ADDRESS(&pinfo->dl_dst, AT_IEEE_802_15_4_SHORT, tvb, offset, 2);
  637. TVB_SET_ADDRESS(&pinfo->dst, AT_IEEE_802_15_4_SHORT, tvb, offset, 2);
  638. if (tree) {
  639. proto_tree_add_uint(ieee802154_tree, hf_ieee802154_dst16, tvb, offset, 2, packet->dst16);
  640. proto_item_append_text(proto_root, ", Dst: %s", dst_addr);
  641. }
  642. col_append_fstr(pinfo->cinfo, COL_INFO, ", Dst: %s", dst_addr);
  643. offset += 2;
  644. }
  645. else if (packet->dst_addr_mode == IEEE802154_FCF_ADDR_EXT) {
  646. static guint64 addr; /* has to be static due to SET_ADDRESS */
  647. /* Get the address */
  648. packet->dst64 = tvb_get_letoh64(tvb, offset);
  649. /* Copy and convert the address to network byte order. */
  650. addr = pntoh64(&(packet->dst64));
  651. /* Display the destination address. */
  652. /* XXX - OUI resolution doesn't happen when displaying resolved
  653. * EUI64 addresses; that should probably be fixed in
  654. * epan/addr_resolv.c.
  655. */
  656. SET_ADDRESS(&pinfo->dl_dst, AT_EUI64, 8, &addr);
  657. SET_ADDRESS(&pinfo->dst, AT_EUI64, 8, &addr);
  658. if (tree) {
  659. proto_tree_add_item(ieee802154_tree, hf_ieee802154_dst64, tvb, offset, 8, ENC_LITTLE_ENDIAN);
  660. proto_item_append_text(proto_root, ", Dst: %s", get_eui64_name(packet->dst64));
  661. }
  662. col_append_fstr(pinfo->cinfo, COL_INFO, ", Dst: %s", get_eui64_name(packet->dst64));
  663. offset += 8;
  664. }
  665. else if (packet->dst_addr_mode != IEEE802154_FCF_ADDR_NONE) {
  666. /* Invalid Destination Address Mode. Abort Dissection. */
  667. expert_add_info_format(pinfo, proto_root, PI_MALFORMED, PI_ERROR, "Invalid Destination Address Mode");
  668. pinfo->private_data = pd_save;
  669. return;
  670. }
  671. /* Get the source PAN if it exists. The source address will be present if:
  672. * - The Source addressing exists and
  673. * - The Destination addressing doesn't exist, or the Intra-PAN bit is unset.
  674. */
  675. if ( ((packet->src_addr_mode == IEEE802154_FCF_ADDR_SHORT) || (packet->src_addr_mode == IEEE802154_FCF_ADDR_EXT)) &&
  676. ((packet->dst_addr_mode == IEEE802154_FCF_ADDR_NONE) || (!packet->intra_pan)) ) {
  677. /* Source PAN is present, extract it and add it to the tree. */
  678. packet->src_pan = tvb_get_letohs(tvb, offset);
  679. if (tree) {
  680. proto_tree_add_uint(ieee802154_tree, hf_ieee802154_src_panID, tvb, offset, 2, packet->src_pan);
  681. }
  682. offset += 2;
  683. }
  684. else {
  685. /* Set the panID field in case the intra-pan condition was met. */
  686. packet->src_pan = packet->dst_pan;
  687. }
  688. if (ieee_hints) {
  689. ieee_hints->src_pan = packet->src_pan;
  690. }
  691. /* Get short source address if present. */
  692. if (packet->src_addr_mode == IEEE802154_FCF_ADDR_SHORT) {
  693. char src_addr[32];
  694. /* Get the address. */
  695. packet->src16 = tvb_get_letohs(tvb, offset);
  696. /* Update the Address fields. */
  697. if (packet->src16==IEEE802154_BCAST_ADDR) {
  698. g_snprintf(src_addr, 32, "Broadcast");
  699. }
  700. else {
  701. g_snprintf(src_addr, 32, "0x%04x", packet->src16);
  702. if (!pinfo->fd->flags.visited) {
  703. /* If we know our extended source address from previous packets,
  704. * provide a pointer to it in a hint for upper layers */
  705. addr16.addr = packet->src16;
  706. addr16.pan = packet->src_pan;
  707. if (ieee_hints) {
  708. ieee_hints->src16 = packet->src16;
  709. ieee_hints->map_rec = (ieee802154_map_rec *)
  710. g_hash_table_lookup(ieee802154_map.short_table, &addr16);
  711. }
  712. }
  713. }
  714. TVB_SET_ADDRESS(&pinfo->dl_src, AT_IEEE_802_15_4_SHORT, tvb, offset, 2);
  715. TVB_SET_ADDRESS(&pinfo->src, AT_IEEE_802_15_4_SHORT, tvb, offset, 2);
  716. /* Add the addressing info to the tree. */
  717. if (tree) {
  718. proto_tree_add_uint(ieee802154_tree, hf_ieee802154_src16, tvb, offset, 2, packet->src16);
  719. proto_item_append_text(proto_root, ", Src: %s", src_addr);
  720. if (ieee_hints && ieee_hints->map_rec) {
  721. /* Display inferred source address info */
  722. ti = proto_tree_add_eui64(ieee802154_tree, hf_ieee802154_src64, tvb, offset, 0,
  723. ieee_hints->map_rec->addr64);
  724. PROTO_ITEM_SET_GENERATED(ti);
  725. if ( ieee_hints->map_rec->start_fnum ) {
  726. ti = proto_tree_add_uint(ieee802154_tree, hf_ieee802154_src64_origin, tvb, 0, 0,
  727. ieee_hints->map_rec->start_fnum);
  728. }
  729. else {
  730. ti = proto_tree_add_text(ieee802154_tree, tvb, 0, 0, "Origin: Pre-configured");
  731. }
  732. PROTO_ITEM_SET_GENERATED(ti);
  733. }
  734. }
  735. col_append_fstr(pinfo->cinfo, COL_INFO, ", Src: %s", src_addr);
  736. offset += 2;
  737. }
  738. else if (packet->src_addr_mode == IEEE802154_FCF_ADDR_EXT) {
  739. static guint64 addr; /* has to be static due to SET_ADDRESS */
  740. /* Get the address. */
  741. packet->src64 = tvb_get_letoh64(tvb, offset);
  742. /* Copy and convert the address to network byte order. */
  743. addr = pntoh64(&(packet->src64));
  744. /* Display the source address. */
  745. /* XXX - OUI resolution doesn't happen when displaying resolved
  746. * EUI64 addresses; that should probably be fixed in
  747. * epan/addr_resolv.c.
  748. */
  749. SET_ADDRESS(&pinfo->dl_src, AT_EUI64, 8, &addr);
  750. SET_ADDRESS(&pinfo->src, AT_EUI64, 8, &addr);
  751. if (tree) {
  752. proto_tree_add_item(ieee802154_tree, hf_ieee802154_src64, tvb, offset, 8, ENC_LITTLE_ENDIAN);
  753. proto_item_append_text(proto_root, ", Src: %s", get_eui64_name(packet->src64));
  754. }
  755. col_append_fstr(pinfo->cinfo, COL_INFO, ", Src: %s", get_eui64_name(packet->src64));
  756. offset += 8;
  757. }
  758. else if (packet->src_addr_mode != IEEE802154_FCF_ADDR_NONE) {
  759. /* Invalid Destination Address Mode. Abort Dissection. */
  760. expert_add_info_format(pinfo, proto_root, PI_MALFORMED, PI_ERROR, "Invalid Source Address Mode");
  761. pinfo->private_data = pd_save;
  762. return;
  763. }
  764. /*=====================================================
  765. * VERIFY FRAME CHECK SEQUENCE
  766. *=====================================================
  767. */
  768. /* Check, but don't display the FCS yet, otherwise the payload dissection
  769. * may be out of place in the tree. But we want to know if the FCS is OK in
  770. * case the CRC is bad (don't want to continue dissection to the NWK layer).
  771. */
  772. if (tvb_bytes_exist(tvb, tvb_reported_length(tvb)-IEEE802154_FCS_LEN, IEEE802154_FCS_LEN)) {
  773. /* The FCS is in the last two bytes of the packet. */
  774. guint16 fcs = tvb_get_letohs(tvb, tvb_reported_length(tvb)-IEEE802154_FCS_LEN);
  775. /* Check if we are expecting a CC2420-style FCS*/
  776. if (options & DISSECT_IEEE802154_OPTION_CC24xx) {
  777. fcs_ok = (fcs & IEEE802154_CC24xx_CRC_OK);
  778. }
  779. else {
  780. guint16 fcs_calc = ieee802154_crc_tvb(tvb, tvb_reported_length(tvb)-IEEE802154_FCS_LEN);
  781. fcs_ok = (fcs == fcs_calc);
  782. }
  783. }
  784. /*=====================================================
  785. * AUXILIARY SECURITY HEADER
  786. *=====================================================
  787. */
  788. /* The Auxiliary Security Header only exists in IEEE 802.15.4-2006 */
  789. if (packet->security_enable && (packet->version == IEEE802154_VERSION_2006)) {
  790. proto_tree *header_tree, *field_tree;
  791. guint8 security_control;
  792. guint aux_length = 5; /* Minimum length of the auxiliary header. */
  793. /* Parse the security control field. */
  794. security_control = tvb_get_guint8(tvb, offset);
  795. packet->security_level = (ieee802154_security_level)(security_control & IEEE802154_AUX_SEC_LEVEL_MASK);
  796. packet->key_id_mode = (ieee802154_key_id_mode)((security_control & IEEE802154_AUX_KEY_ID_MODE_MASK) >> IEEE802154_AUX_KEY_ID_MODE_SHIFT);
  797. /* Compute the length of the auxiliary header and create a subtree. */
  798. if (packet->key_id_mode != KEY_ID_MODE_IMPLICIT) aux_length++;
  799. if (packet->key_id_mode == KEY_ID_MODE_KEY_EXPLICIT_4) aux_length += 4;
  800. if (packet->key_id_mode == KEY_ID_MODE_KEY_EXPLICIT_8) aux_length += 8;
  801. ti = proto_tree_add_text(ieee802154_tree, tvb, offset, aux_length, "Auxiliary Security Header");
  802. header_tree = proto_item_add_subtree(ti, ett_ieee802154_auxiliary_security);
  803. /* Security Control Field */
  804. ti = proto_tree_add_text(header_tree, tvb, offset, 1, "Security Control Field (0x%02x)", security_control);
  805. field_tree = proto_item_add_subtree(ti, ett_ieee802154_aux_sec_control);
  806. proto_tree_add_uint(field_tree, hf_ieee802154_security_level, tvb, offset, 1, security_control & IEEE802154_AUX_SEC_LEVEL_MASK);
  807. proto_tree_add_uint(field_tree, hf_ieee802154_key_id_mode, tvb, offset, 1, security_control & IEEE802154_AUX_KEY_ID_MODE_MASK);
  808. proto_tree_add_uint(field_tree, hf_ieee802154_aux_sec_reserved, tvb, offset, 1, security_control & IEEE802154_AUX_KEY_RESERVED_MASK);
  809. offset++;
  810. /* Frame Counter Field */
  811. packet->frame_counter = tvb_get_letohl (tvb, offset);
  812. proto_tree_add_uint(header_tree, hf_ieee802154_aux_sec_frame_counter, tvb, offset,4, packet->frame_counter);
  813. offset +=4;
  814. /* Key identifier field(s). */
  815. if (packet->key_id_mode != KEY_ID_MODE_IMPLICIT) {
  816. /* Create a subtree. */
  817. ti = proto_tree_add_text(header_tree, tvb, offset, 1, "Key Identifier Field"); /* Will fix length later. */
  818. field_tree = proto_item_add_subtree(ti, ett_ieee802154_aux_sec_key_id);
  819. /* Add key source, if it exists. */
  820. if (packet->key_id_mode == KEY_ID_MODE_KEY_EXPLICIT_4) {
  821. packet->key_source.addr32 = tvb_get_ntohl(tvb, offset);
  822. proto_tree_add_uint64(field_tree, hf_ieee802154_aux_sec_key_source, tvb, offset, 4, packet->key_source.addr32);
  823. proto_item_set_len(ti, 1 + 4);
  824. offset += (int)sizeof (guint32);
  825. }
  826. if (packet->key_id_mode == KEY_ID_MODE_KEY_EXPLICIT_8) {
  827. packet->key_source.addr64 = tvb_get_ntoh64(tvb, offset);
  828. proto_tree_add_uint64(field_tree, hf_ieee802154_aux_sec_key_source, tvb, offset, 8, packet->key_source.addr64);
  829. proto_item_set_len(ti, 1 + 8);
  830. offset += 8;
  831. }
  832. /* Add key identifier. */
  833. packet->key_index = tvb_get_guint8(tvb, offset);
  834. proto_tree_add_uint(field_tree, hf_ieee802154_aux_sec_key_index, tvb, offset,1, packet->key_index);
  835. offset++;
  836. }
  837. }
  838. /*=====================================================
  839. * NONPAYLOAD FIELDS
  840. *=====================================================
  841. */
  842. /* All of the beacon fields, except the beacon payload are considered nonpayload. */
  843. if (packet->frame_type == IEEE802154_FCF_BEACON) {
  844. /* Parse the superframe spec. */
  845. dissect_ieee802154_superframe(tvb, pinfo, ieee802154_tree, &offset);
  846. /* Parse the GTS information fields. */
  847. dissect_ieee802154_gtsinfo(tvb, pinfo, ieee802154_tree, &offset);
  848. /* Parse the Pending address list. */
  849. dissect_ieee802154_pendaddr(tvb, pinfo, ieee802154_tree, &offset);
  850. }
  851. /* Only the Command ID is considered nonpayload. */
  852. if (packet->frame_type == IEEE802154_FCF_CMD) {
  853. packet->command_id = tvb_get_guint8(tvb, offset);
  854. if (tree) {
  855. proto_tree_add_uint(ieee802154_tree, hf_ieee802154_cmd_id, tvb, offset, 1, packet->command_id);
  856. }
  857. offset++;
  858. /* Display the command identifier in the info column. */
  859. col_set_str(pinfo->cinfo, COL_INFO, val_to_str_const(packet->command_id, ieee802154_cmd_names, "Unknown Command"));
  860. }
  861. /* No other frame types have nonpayload fields. */
  862. /*=====================================================
  863. * PAYLOAD DISSECTION
  864. *=====================================================
  865. */
  866. /* IEEE 802.15.4-2003 may have security information pre-pended to payload */
  867. if (packet->security_enable && (packet->version == IEEE802154_VERSION_2003)) {
  868. /* Store security suite preference in the 2006 security level identifier to simplify 2003 integration! */
  869. packet->security_level = (ieee802154_security_level)ieee802154_sec_suite;
  870. /* Frame Counter and Key Sequence Counter prepended to the payload of an encrypted frame */
  871. if (IEEE802154_IS_ENCRYPTED(packet->security_level)) {
  872. packet->frame_counter = tvb_get_letohl (tvb, offset);
  873. proto_tree_add_uint(ieee802154_tree, hf_ieee802154_sec_frame_counter, tvb, offset, (int)sizeof(guint32), packet->frame_counter);
  874. offset += (int)sizeof(guint32);
  875. packet->key_sequence_counter = tvb_get_guint8 (tvb, offset);
  876. proto_tree_add_uint(ieee802154_tree, hf_ieee802154_sec_key_sequence_counter, tvb, offset, (int)sizeof(guint8), packet->key_sequence_counter);
  877. offset += (int)sizeof(guint8);
  878. }
  879. }
  880. /* Encrypted Payload. */
  881. if (packet->security_enable) {
  882. payload_tvb = dissect_ieee802154_decrypt(tvb, offset, pinfo, packet, &status);
  883. /* Get the unencrypted data if decryption failed. */
  884. if (!payload_tvb) {
  885. /* Deal with possible truncation and the FCS field at the end. */
  886. gint reported_len = tvb_reported_length(tvb)-offset-IEEE802154_FCS_LEN;
  887. gint captured_len = tvb_length(tvb)-offset;
  888. if (reported_len < captured_len) captured_len = reported_len;
  889. payload_tvb = tvb_new_subset(tvb, offset, captured_len, reported_len);
  890. }
  891. /* Display the reason for failure, and abort if the error was fatal. */
  892. switch (status) {
  893. case DECRYPT_PACKET_SUCCEEDED:
  894. case DECRYPT_NOT_ENCRYPTED:
  895. /* No problem. */
  896. break;
  897. case DECRYPT_VERSION_UNSUPPORTED:
  898. /* We don't support decryption with that version of the protocol */
  899. expert_add_info_format(pinfo, proto_root, PI_UNDECODED, PI_WARN, "We don't support decryption with protocol version %u",
  900. packet->version);
  901. call_dissector(data_handle, payload_tvb, pinfo, tree);
  902. goto dissect_ieee802154_fcs;
  903. case DECRYPT_PACKET_TOO_SMALL:
  904. expert_add_info_format(pinfo, proto_root, PI_UNDECODED, PI_WARN, "Packet was too small to include the CRC and MIC");
  905. call_dissector(data_handle, payload_tvb, pinfo, tree);
  906. goto dissect_ieee802154_fcs;
  907. case DECRYPT_PACKET_NO_EXT_SRC_ADDR:
  908. expert_add_info_format(pinfo, proto_root, PI_UNDECODED, PI_WARN, "No extended source address - can't decrypt");
  909. call_dissector(data_handle, payload_tvb, pinfo, tree);
  910. goto dissect_ieee802154_fcs;
  911. case DECRYPT_PACKET_NO_KEY:
  912. expert_add_info_format(pinfo, proto_root, PI_UNDECODED, PI_WARN, "No encryption key set - can't decrypt");
  913. call_dissector(data_handle, payload_tvb, pinfo, tree);
  914. goto dissect_ieee802154_fcs;
  915. case DECRYPT_PACKET_DECRYPT_FAILED:
  916. expert_add_info_format(pinfo, proto_root, PI_UNDECODED, PI_WARN, "Decrypt failed");
  917. call_dissector(data_handle, payload_tvb, pinfo, tree);
  918. goto dissect_ieee802154_fcs;
  919. case DECRYPT_PACKET_MIC_CHECK_FAILED:
  920. expert_add_info_format(pinfo, proto_root, PI_UNDECODED, PI_WARN, "MIC check failed");
  921. /*
  922. * Abort only if the payload was encrypted, in which case we
  923. * probably didn't decrypt the packet right (eg: wrong key).
  924. */
  925. if (IEEE802154_IS_ENCRYPTED(packet->security_level)) {
  926. call_dissector(data_handle, payload_tvb, pinfo, tree);
  927. goto dissect_ieee802154_fcs;
  928. }
  929. break;
  930. }
  931. }
  932. /* Plaintext Payload. */
  933. else {
  934. /* Deal with possible truncation and the FCS field at the end. */
  935. gint reported_len = tvb_reported_length(tvb)-offset-IEEE802154_FCS_LEN;
  936. gint captured_len = tvb_length(tvb)-offset;
  937. if (reported_len < captured_len) captured_len = reported_len;
  938. payload_tvb = tvb_new_subset(tvb, offset, captured_len, reported_len);
  939. }
  940. /*
  941. * Wrap the sub-dissection in a try/catch block in case the payload is
  942. * broken. First we store the current protocol so we can fix it if an
  943. * exception is thrown by the subdissectors.
  944. */
  945. saved_proto = pinfo->current_proto;
  946. /* Try to dissect the payload. */
  947. TRY {
  948. if ((packet->frame_type == IEEE802154_FCF_BEACON) ||
  949. (packet->frame_type == IEEE802154_FCF_DATA)) {
  950. /* Beacon and Data packets contain a payload. */
  951. if ((fcs_ok || !ieee802154_fcs_ok) && (tvb_reported_length(payload_tvb)>0)) {
  952. /* Attempt heuristic subdissection. */
  953. if (!dissector_try_heuristic(ieee802154_heur_subdissector_list, payload_tvb, pinfo, tree, NULL)) {
  954. /* Could not subdissect, call the data dissector instead. */
  955. call_dissector(data_handle, payload_tvb, pinfo, tree);
  956. }
  957. }
  958. else {
  959. /* If no sub-dissector was called, call the data dissector. */
  960. call_dissector(data_handle, payload_tvb, pinfo, tree);
  961. }
  962. }
  963. /* If the packet is a command, try to dissect the payload. */
  964. else if (packet->frame_type == IEEE802154_FCF_CMD) {
  965. switch (packet->command_id) {
  966. case IEEE802154_CMD_ASRQ:
  967. IEEE802154_CMD_ADDR_CHECK(pinfo, proto_root, packet->command_id,
  968. (packet->src_addr_mode == IEEE802154_FCF_ADDR_EXT) &&
  969. (packet->dst_addr_mode != IEEE802154_FCF_ADDR_NONE));
  970. dissect_ieee802154_assoc_req(payload_tvb, pinfo, ieee802154_tree, packet);
  971. break;
  972. case IEEE802154_CMD_ASRSP:
  973. IEEE802154_CMD_ADDR_CHECK(pinfo, proto_root, packet->command_id,
  974. (packet->src_addr_mode == IEEE802154_FCF_ADDR_EXT) &&
  975. (packet->dst_addr_mode == IEEE802154_FCF_ADDR_EXT));
  976. dissect_ieee802154_assoc_rsp(payload_tvb, pinfo, ieee802154_tree, packet);
  977. break;
  978. case IEEE802154_CMD_DISAS:
  979. IEEE802154_CMD_ADDR_CHECK(pinfo, proto_root, packet->command_id,
  980. (packet->src_addr_mode == IEEE802154_FCF_ADDR_EXT) &&
  981. (packet->dst_addr_mode == IEEE802154_FCF_ADDR_EXT));
  982. dissect_ieee802154_disassoc(payload_tvb, pinfo, ieee802154_tree, packet);
  983. break;
  984. case IEEE802154_CMD_DATA_RQ:
  985. IEEE802154_CMD_ADDR_CHECK(pinfo, proto_root, packet->command_id, packet->src_addr_mode != IEEE802154_FCF_ADDR_NONE);
  986. /* No payload expected. */
  987. break;
  988. case IEEE802154_CMD_PANID_ERR:
  989. IEEE802154_CMD_ADDR_CHECK(pinfo, proto_root, packet->command_id,
  990. (packet->src_addr_mode == IEEE802154_FCF_ADDR_EXT) &&
  991. (packet->dst_addr_mode == IEEE802154_FCF_ADDR_EXT));
  992. /* No payload expected. */
  993. break;
  994. case IEEE802154_CMD_ORPH_NOTIF:
  995. IEEE802154_CMD_ADDR_CHECK(pinfo, proto_root, packet->command_id,
  996. (packet->src_addr_mode == IEEE802154_FCF_ADDR_EXT) &&
  997. (packet->dst_addr_mode == IEEE802154_FCF_ADDR_SHORT) &&
  998. (packet->dst16 == IEEE802154_BCAST_ADDR) &&
  999. (packet->src_pan == IEEE802154_BCAST_PAN) &&
  1000. (packet->dst_pan == IEEE802154_BCAST_PAN));
  1001. /* No payload expected. */
  1002. break;
  1003. case IEEE802154_CMD_BCN_RQ:
  1004. IEEE802154_CMD_ADDR_CHECK(pinfo, proto_root, packet->command_id,
  1005. (packet->dst_addr_mode == IEEE802154_FCF_ADDR_SHORT) &&

Large files files are truncated, but you can click here to view the full file