?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Revert "TODO epan/dissectors/asn1/kerberos/packet-kerberos-template.c new GSS flags"
[wireshark-sm.git] / epan / dissectors / packet-docsis.c
blobf4e7f31b1d57ea3cb89f3a3d130e441d61649e7b
1 /* packet-docsis.c
2 * Routines for docsis dissection
3 * Copyright 2002, Anand V. Narwani <anand[AT]narwani.org>
4 *
5 * Wireshark - Network traffic analyzer
6 * By Gerald Combs <gerald@wireshark.org>
7 * Copyright 1998 Gerald Combs
8 *
9 * SPDX-License-Identifier: GPL-2.0-or-later
10 */
11
12
13 /* This code is based on the DOCSIS 1.1 specification available at:
14 * http://www.cablelabs.com/wp-content/uploads/specdocs/CM-SP-RFIv1.1-C01-050907.pdf
15 *
16 * This code was updated to include DOCSIS 3.1 specification details available at:
17 * http://www.cablelabs.com/wp-content/uploads/specdocs/CM-SP-MULPIv3.1-I09-160602.pdf
18 *
19 * Updates are backward compatible with previous DOCSIS spcifications.
20 *
21 * DOCSIS Captures can be facilitated using the Cable Monitor Feature
22 * available on Cisco Cable Modem Termination Systems:
23 * https://www.cisco.com/c/en/us/td/docs/cable/cmts/config_guide/b_cmts_security_and_cable_monitoring_features/b_cmts_security_and_cable_monitoring_features_chapter_010.html
24 *
25 * This dissector depends on the presence of a DOCSIS enapsulation type.
26 * There is no simple way to distinguish DOCSIS Frames from Ethernet frames,
27 * since the frames are copied from the RF interface on the CMTS to
28 * a Fast Ethernet interface; thus a preference was needed to enable
29 * the DOCSIS encapsulation type.
30 *
31 * Libpcap 0.7 and later allow a link-layer header type to be specified for
32 * some interfaces on some platforms; for Ethernet interfaces, they allow
33 * DOCSIS to be specified. If an Ethernet capture is done with a link-layer
34 * type of DOCSIS, the file will have a link-layer header type of DLT_DOCSIS;
35 * Wireshark will treat the frames in that capture as DOCSIS frames, even
36 * if the preference mentioned above isn't enabled.
37 */
38
39 #include "config.h"
40
41 #include <epan/etypes.h>
42 #include <epan/expert.h>
43 #include <epan/packet.h>
44 #include <epan/prefs.h>
45 #include <epan/reassemble.h>
46 #include <epan/addr_resolv.h>
47 #include <epan/tfs.h>
48 #include <epan/crc16-tvb.h>
49 #include <epan/crc32-tvb.h>
50
51 void proto_register_docsis(void);
52 void proto_reg_handoff_docsis(void);
53
54 /* Assume all packets have an FCS */
55 static bool docsis_check_fcs = true;
56 static bool docsis_dissect_encrypted_frames;
57
58 #define DOCSIS_MIN_HEADER_LEN 6
59
60 #define FCTYPE_PACKET 0x00
61 #define FCTYPE_SPECIAL 0x01
62 #define FCTYPE_ISOLAT 0x02
63 #define FCTYPE_MACSPC 0x03
64
65 #define FCPARM_TIMING_HDR 0x00
66 #define FCPARM_MAC_MGMT_HDR 0x01
67 #define FCPARM_RQST_FRM 0x02
68 #define FCPARM_FRAG_HDR 0x03
69 #define FCPARM_QUEUE_DEPTH_REQ_FRM 0x04
70 #define FCPARM_CONCAT_HDR 0x1C
71
72 #define EXT_HDR_OFF 0x00
73 #define EXT_HDR_ON 0x01
74
75 #define FRAG_FCS_LEN 4
76 #define FRAG_FIRST 0x20
77 #define FRAG_MIDDLE 0x00
78 #define FRAG_LAST 0x10
79
80 #define EH_NULL_CONFIG 0
81 #define EH_REQUEST 1
82 #define EH_ACK_REQ 2
83 #define EH_BP_UP 3
84 #define EH_BP_DOWN 4
85 #define EH_SFLOW_HDR_DOWN 5
86 #define EH_SFLOW_HDR_UP 6
87 #define EH_BP_UP2 7
88 #define EH_DS_SERVICE 8
89 #define EH_PATH_VERIFY 9
90 #define EH_RESERVED_10 10
91 #define EH_RESERVED_11 11
92 #define EH_RESERVED_12 12
93 #define EH_RESERVED_13 13
94 #define EH_RESERVED_14 14
95 #define EH_EXTENDED 15
96
97 /* Initialize the protocol and registered fields */
98 static int proto_docsis;
99 static int hf_docsis_fctype;
100 static int hf_docsis_machdr_fcparm;
101 static int hf_docsis_fcparm;
102 static int hf_docsis_exthdr;
103 static int hf_docsis_concat_cnt;
104 static int hf_docsis_macparm;
105 static int hf_docsis_ehdrlen;
106 static int hf_docsis_len;
107 static int hf_docsis_eh_type;
108 static int hf_docsis_eh_len;
109 static int hf_docsis_eh_val;
110 static int hf_docsis_ehx_type;
111 static int hf_docsis_ehx_len;
112 static int hf_docsis_frag_rsvd;
113 static int hf_docsis_frag_first;
114 static int hf_docsis_frag_last;
115 static int hf_docsis_frag_seq;
116 static int hf_docsis_sid;
117 static int hf_docsis_mini_slots;
118 static int hf_docsis_requested_size;
119 static int hf_docsis_hcs;
120 static int hf_docsis_hcs_status;
121 static int hf_docsis_bpi_en;
122 static int hf_docsis_toggle_bit;
123 static int hf_docsis_key_seq;
124 static int hf_docsis_ehdr_ver;
125 static int hf_docsis_said;
126 static int hf_docsis_ehdr_phsi;
127 static int hf_docsis_ehdr_qind;
128 static int hf_docsis_ehdr_grants;
129 static int hf_docsis_reserved;
130 static int hf_docsis_ehdr_ds_traffic_pri;
131 static int hf_docsis_ehdr_ds_seq_chg_cnt;
132 static int hf_docsis_ehdr_ds_dsid;
133 static int hf_docsis_ehdr_ds_pkt_seq_num;
134 static int hf_docsis_ehdr_bpup2_bpi_en;
135 static int hf_docsis_ehdr_bpup2_toggle_bit;
136 static int hf_docsis_ehdr_bpup2_key_seq;
137 static int hf_docsis_ehdr_bpup2_ver;
138 static int hf_docsis_ehdr_bpup2_sid;
139 static int hf_docsis_ehdr_pv_st_refpt;
140 static int hf_docsis_ehdr_pv_timestamp;
141
142 static int hf_docsis_fragments;
143 static int hf_docsis_fragment;
144 static int hf_docsis_fragment_overlap;
145 static int hf_docsis_fragment_overlap_conflict;
146 static int hf_docsis_fragment_multiple_tails;
147 static int hf_docsis_fragment_too_long_fragment;
148 static int hf_docsis_fragment_error;
149 static int hf_docsis_fragment_count;
150 static int hf_docsis_reassembled_in;
151 static int hf_docsis_reassembled_length;
152 static int hf_docsis_reassembled_data;
153 static int hf_docsis_frag_fcs;
154 static int hf_docsis_frag_fcs_status;
155
156 static int hf_docsis_dst;
157 static int hf_docsis_dst_resolved;
158 static int hf_docsis_src;
159 static int hf_docsis_src_resolved;
160 static int hf_docsis_lg;
161 static int hf_docsis_ig;
162 static int hf_docsis_encrypted_payload;
163
164 static dissector_handle_t docsis_handle;
165 static dissector_handle_t eth_withoutfcs_handle;
166 static dissector_handle_t docsis_mgmt_handle;
167 #if 0
168 static dissector_table_t docsis_dissector_table;
169 #endif
170
171 static expert_field ei_docsis_hcs_bad;
172 static expert_field ei_docsis_len;
173 static expert_field ei_docsis_frag_fcs_bad;
174 static expert_field ei_docsis_eh_len;
175
176 /* Initialize the subtree pointers */
177 static int ett_docsis;
178 static int ett_ehdr;
179 static int ett_docsis_fragments;
180 static int ett_docsis_fragment;
181 static int ett_addr;
182
183 static const value_string fctype_vals[] = {
184 {FCTYPE_PACKET, "Packet PDU"},
185 {FCTYPE_SPECIAL, "Special Use"},
186 {FCTYPE_ISOLAT, "Isolation PDU"},
187 {FCTYPE_MACSPC, "MAC Specific"},
188 {0, NULL}
189 };
190
191 static const value_string eh_type_vals[] = {
192 {0, "NULL Configuration Parameter"},
193 {EH_REQUEST, "Request"},
194 {EH_ACK_REQ, "Acknowledgement Requested"},
195 {EH_BP_UP, "Upstream Privacy Element"},
196 {EH_BP_DOWN, "Downstream Privacy Element"},
197 {EH_SFLOW_HDR_UP, "Service Flow EH; PHS Header Upstream"},
198 {EH_SFLOW_HDR_DOWN, "Service Flow EH; PHS Header Downstream"},
199 {EH_BP_UP2, "Upstream Privacy with Multi Channel"},
200 {EH_DS_SERVICE, "Downstream Service"},
201 {EH_PATH_VERIFY, "Path Verify"},
202 {EH_RESERVED_10, "Reserved"},
203 {EH_RESERVED_11, "Reserved"},
204 {EH_RESERVED_12, "Reserved"},
205 {EH_RESERVED_13, "Reserved"},
206 {EH_RESERVED_14, "Reserved"},
207 {EH_EXTENDED, "Extended"},
208 {0, NULL}
209 };
210
211 static const value_string ms_fcparm_vals[] = {
212 {FCPARM_TIMING_HDR, "Timing Header"},
213 {FCPARM_MAC_MGMT_HDR, "MAC Management Message"},
214 {FCPARM_RQST_FRM, "Request Frame"},
215 {FCPARM_FRAG_HDR, "Fragmentation Header"},
216 {FCPARM_QUEUE_DEPTH_REQ_FRM, "Queue Depth-based Request Frame"},
217 {FCPARM_CONCAT_HDR, "Concatenation Header"},
218 {0, NULL}
219 };
220
221 static const value_string pkt_fcparm_vals[] = {
222 {0x00, "PDU MAC"},
223 {0x01, "DELAY/DUPLICATE/MULTICAST/BROADCAST"},
224 {0, NULL}
225 };
226
227 static const true_false_string exthdr_tfs = {
228 "Extended Header Present",
229 "Extended Header Absent"
230 };
231
232
233 static const value_string local_proto_checksum_vals[] = {
234 { PROTO_CHECKSUM_E_BAD, "Bad" },
235 { PROTO_CHECKSUM_E_GOOD, "Good" },
236 { PROTO_CHECKSUM_E_UNVERIFIED, "Unverified" },
237 { PROTO_CHECKSUM_E_NOT_PRESENT, "Not present" },
238
239 { 0, NULL }
240 };
241
242 static const true_false_string qind_tfs = {
243 "Rate overrun",
244 "Rate non-overrun"
245 };
246
247 static const true_false_string odd_even_tfs = {
248 "Odd Key",
249 "Even Key",
250 };
251
252 static const value_string unique_no_phs[] = {
253 { 0, "No PHS on current packet" },
254 { 0, NULL }
255 };
256
257 /* Fragmentation Flags / Sequence */
258 static uint8_t frag_flags;
259 static uint8_t frag_seq;
260 static uint16_t frag_sid;
261
262 /*
263 * Defragmentation of DOCSIS
264 */
265 static reassembly_table docsis_reassembly_table;
266
267
268 static const fragment_items docsis_frag_items = {
269 &ett_docsis_fragment,
270 &ett_docsis_fragments,
271 &hf_docsis_fragments,
272 &hf_docsis_fragment,
273 &hf_docsis_fragment_overlap,
274 &hf_docsis_fragment_overlap_conflict,
275 &hf_docsis_fragment_multiple_tails,
276 &hf_docsis_fragment_too_long_fragment,
277 &hf_docsis_fragment_error,
278 &hf_docsis_fragment_count,
279 &hf_docsis_reassembled_in,
280 &hf_docsis_reassembled_length,
281 &hf_docsis_reassembled_data,
282 "DOCSIS fragments"
283 };
284
285 /* Dissection */
286 /* Code to Dissect the extended header; TLV Formatted headers */
287 static void
288 dissect_ehdr (tvbuff_t * tvb, proto_tree * tree, packet_info * pinfo, bool *is_encrypted)
289 {
290 proto_tree *ehdr_tree;
291 proto_item *eh_length_item;
292 int ehdrlen;
293 int pos;
294 uint8_t type;
295 uint8_t len;
296
297 ehdrlen = tvb_get_uint8 (tvb, 1);
298 pos = 4;
299
300 ehdr_tree = proto_tree_add_subtree(tree, tvb, pos, ehdrlen, ett_ehdr, NULL, "Extended Header");
301
302 while (pos < ehdrlen + 4)
303 {
304 type = (tvb_get_uint8 (tvb, pos) & 0xF0);
305 len = (tvb_get_uint8 (tvb, pos) & 0x0F);
306 if ((((type >> 4) & 0x0F)== 6) && (len == 2))
307 {
308 proto_tree_add_uint_format_value(ehdr_tree, hf_docsis_eh_type, tvb, pos, 1, 0x60, "Unsolicited Grant Sync EHDR Sub-Element");
309 }
310 else
311 {
312 proto_tree_add_item (ehdr_tree, hf_docsis_eh_type, tvb, pos, 1, ENC_BIG_ENDIAN);
313 }
314
315 eh_length_item = proto_tree_add_item (ehdr_tree, hf_docsis_eh_len, tvb, pos, 1, ENC_BIG_ENDIAN);
316 pos++;
317
318 switch ((type >> 4) & 0x0F)
319 {
320 case EH_REQUEST:
321 /* Request: Minislots Requested */
322 if (len == 3)
323 {
324 proto_tree_add_item(ehdr_tree, hf_docsis_mini_slots, tvb, pos, 1, ENC_NA);
325 proto_tree_add_item(ehdr_tree, hf_docsis_sid, tvb, pos + 1, 2, ENC_BIG_ENDIAN);
326 }
327 else
328 {
329 expert_add_info(pinfo, eh_length_item, &ei_docsis_eh_len);
330 return;
331 }
332 break;
333 case EH_ACK_REQ:
334 /* Deprecated in DOCSIS 3.1 */
335 if (len == 2)
336 {
337 proto_tree_add_item(ehdr_tree, hf_docsis_sid, tvb, pos, 2, ENC_BIG_ENDIAN);
338 }
339 else
340 {
341 expert_add_info(pinfo, eh_length_item, &ei_docsis_eh_len);
342 return;
343 }
344 break;
345 case EH_BP_UP:
346 /* Upstream Privacy EH Element or Upstream Privacy with fragmentation */
347 proto_tree_add_item (ehdr_tree, hf_docsis_key_seq, tvb, pos, 1,
348 ENC_BIG_ENDIAN);
349 proto_tree_add_item (ehdr_tree, hf_docsis_ehdr_ver, tvb, pos, 1,
350 ENC_BIG_ENDIAN);
351 proto_tree_add_item_ret_boolean (ehdr_tree, hf_docsis_bpi_en, tvb, pos + 1, 1,
352 ENC_BIG_ENDIAN, is_encrypted);
353 proto_tree_add_item (ehdr_tree, hf_docsis_toggle_bit, tvb, pos + 1,
354 1, ENC_BIG_ENDIAN);
355 proto_tree_add_item (ehdr_tree, hf_docsis_sid, tvb, pos + 1, 2,
356 ENC_BIG_ENDIAN);
357 frag_sid = tvb_get_uint8 (tvb, pos+1) & 0xCFFF;
358 proto_tree_add_item (ehdr_tree, hf_docsis_mini_slots, tvb, pos + 3,
359 1, ENC_BIG_ENDIAN);
360 if (pinfo->fragmented)
361 {
362 proto_tree_add_item (ehdr_tree, hf_docsis_frag_rsvd, tvb, pos+4,
363 1, ENC_BIG_ENDIAN);
364 frag_flags = tvb_get_uint8 (tvb, pos+4) & 0x30;
365 proto_tree_add_item (ehdr_tree, hf_docsis_frag_first, tvb, pos+4,
366 1, ENC_BIG_ENDIAN);
367 proto_tree_add_item (ehdr_tree, hf_docsis_frag_last, tvb, pos+4,
368 1, ENC_BIG_ENDIAN);
369 frag_seq = tvb_get_uint8 (tvb, pos+4) & 0x0F;
370 proto_tree_add_item (ehdr_tree, hf_docsis_frag_seq, tvb, pos+4,
371 1, ENC_BIG_ENDIAN);
372 }
373 break;
374 case EH_BP_DOWN:
375 /* Downstream Privacy EH Element */
376 proto_tree_add_item (ehdr_tree, hf_docsis_key_seq, tvb, pos, 1,
377 ENC_BIG_ENDIAN);
378 proto_tree_add_item (ehdr_tree, hf_docsis_ehdr_ver, tvb, pos, 1,
379 ENC_BIG_ENDIAN);
380 proto_tree_add_item_ret_boolean (ehdr_tree, hf_docsis_bpi_en, tvb, pos + 1, 1,
381 ENC_BIG_ENDIAN, is_encrypted);
382 proto_tree_add_item (ehdr_tree, hf_docsis_toggle_bit, tvb, pos + 1,
383 1, ENC_BIG_ENDIAN);
384 proto_tree_add_item (ehdr_tree, hf_docsis_said, tvb, pos + 1, 2,
385 ENC_BIG_ENDIAN);
386 proto_tree_add_item (ehdr_tree, hf_docsis_reserved, tvb, pos + 3, 1,
387 ENC_BIG_ENDIAN);
388 break;
389 case EH_SFLOW_HDR_DOWN:
390 /* Deprecated in DOCSIS 3.1, was Downstream Service Flow EH Element in earlier revisions */
391 case EH_SFLOW_HDR_UP:
392 /* Deprecated in DOCSIS 3.1, was Upstream Service Flow EH Element in earlier revisions */
393 proto_tree_add_item(ehdr_tree, hf_docsis_ehdr_phsi, tvb, pos, 1, ENC_BIG_ENDIAN);
394
395 if (len == 2)
396 {
397 proto_tree_add_item (ehdr_tree, hf_docsis_ehdr_qind, tvb, pos+1, 1, ENC_BIG_ENDIAN);
398 proto_tree_add_item (ehdr_tree, hf_docsis_ehdr_grants, tvb, pos+1, 1, ENC_BIG_ENDIAN);
399 }
400 break;
401 case EH_BP_UP2:
402 /* Upstream Privacy EH Element, version 2, with no piggyback request */
403 proto_tree_add_item (ehdr_tree, hf_docsis_ehdr_bpup2_key_seq, tvb, pos, 1,
404 ENC_BIG_ENDIAN);
405 proto_tree_add_item (ehdr_tree, hf_docsis_ehdr_bpup2_ver, tvb, pos, 1,
406 ENC_BIG_ENDIAN);
407 proto_tree_add_item_ret_boolean (ehdr_tree, hf_docsis_ehdr_bpup2_bpi_en, tvb, pos + 1, 1,
408 ENC_BIG_ENDIAN, is_encrypted);
409 proto_tree_add_item (ehdr_tree, hf_docsis_ehdr_bpup2_toggle_bit, tvb, pos + 1,
410 1, ENC_BIG_ENDIAN);
411 proto_tree_add_item (ehdr_tree, hf_docsis_ehdr_bpup2_sid, tvb, pos + 1, 2,
412 ENC_BIG_ENDIAN);
413 break;
414 case EH_DS_SERVICE:
415 /* Downstream Service EH Element */
416 proto_tree_add_item(ehdr_tree, hf_docsis_ehdr_ds_traffic_pri, tvb, pos, 1, ENC_BIG_ENDIAN);
417
418 if (len == 3)
419 {
420 proto_tree_add_item (ehdr_tree, hf_docsis_ehdr_ds_dsid, tvb, pos, 3, ENC_BIG_ENDIAN);
421 }
422
423 if (len == 5)
424 {
425 proto_tree_add_item (ehdr_tree, hf_docsis_ehdr_ds_seq_chg_cnt, tvb, pos, 1, ENC_BIG_ENDIAN);
426 proto_tree_add_item (ehdr_tree, hf_docsis_ehdr_ds_dsid, tvb, pos, 3, ENC_BIG_ENDIAN);
427 proto_tree_add_item (ehdr_tree, hf_docsis_ehdr_ds_pkt_seq_num, tvb, pos+3, 2, ENC_BIG_ENDIAN);
428 }
429 break;
430 case EH_PATH_VERIFY:
431 /* Path Verify EH Element */
432 if (len == 5)
433 {
434 proto_tree_add_item (ehdr_tree, hf_docsis_ehdr_pv_st_refpt, tvb, pos, 1, ENC_BIG_ENDIAN);
435 proto_tree_add_item (ehdr_tree, hf_docsis_ehdr_pv_timestamp, tvb, pos+1, 4, ENC_BIG_ENDIAN);
436 }
437 break;
438 case EH_EXTENDED:
439 /* Extended EH Element, ignore eh_len */
440 proto_tree_add_item(ehdr_tree, hf_docsis_ehx_type, tvb, pos, 1, ENC_NA);
441 pos++;
442 proto_tree_add_item(ehdr_tree, hf_docsis_ehx_len, tvb, pos, 1, ENC_NA);
443 len = tvb_get_uint8(tvb, pos);
444 pos++;
445 /* FALLTHROUGH */
446 default:
447 if (len > 0)
448 proto_tree_add_item (ehdr_tree, hf_docsis_eh_val, tvb, pos,
449 len, ENC_NA);
450 }
451 pos += len;
452 }
453
454 return;
455 }
456
457 /* Code to Dissect the Header Check Sequence field */
458 /* Return false in case FCS validation is enabled, but FCS is incorrect */
459 /* Return true in all other cases */
460 static bool
461 dissect_hcs_field (tvbuff_t * tvb, packet_info * pinfo, proto_tree * docsis_tree, int hdrlen)
462 {
463 /* dissect the header check sequence */
464 if(docsis_check_fcs){
465 /* CRC-CCITT(16+12+5+1) */
466 uint16_t fcs = g_ntohs(crc16_ccitt_tvb(tvb, (hdrlen - 2)));
467 proto_tree_add_checksum(docsis_tree, tvb, (hdrlen - 2), hf_docsis_hcs, hf_docsis_hcs_status, &ei_docsis_hcs_bad, pinfo, fcs, ENC_BIG_ENDIAN, PROTO_CHECKSUM_VERIFY);
468
469 return (tvb_get_ntohs(tvb, (hdrlen - 2)) == fcs) ? true : false;
470 }
471 else
472 {
473 proto_tree_add_checksum(docsis_tree, tvb, (hdrlen - 2), hf_docsis_hcs, hf_docsis_hcs_status, &ei_docsis_hcs_bad, pinfo, 0, ENC_BIG_ENDIAN, PROTO_CHECKSUM_NO_FLAGS);
474 }
475 return true;
476 }
477
478 /* Code to Dissect the extended header length / MAC Param field and Length field */
479 /* The length field may condain a SID, but this logic is not handled here */
480 static void
481 dissect_exthdr_length_field (tvbuff_t * tvb, packet_info * pinfo, proto_tree * docsis_tree,
482 uint8_t exthdr, uint16_t mac_parm, uint16_t len_sid, uint16_t *payload_length, bool *is_encrypted)
483 {
484 proto_item *length_item;
485 if (exthdr == EXT_HDR_ON)
486 {
487 /* Add in Extended Header Length */
488 proto_tree_add_item (docsis_tree, hf_docsis_ehdrlen, tvb, 1, 1, ENC_BIG_ENDIAN);
489 length_item = proto_tree_add_item (docsis_tree, hf_docsis_len, tvb, 2, 2, ENC_BIG_ENDIAN);
490 /* Validate PDU length */
491 if ((len_sid - mac_parm) > *payload_length)
492 {
493 *payload_length = len_sid;
494 expert_add_info(pinfo, length_item, &ei_docsis_len);
495 }
496 /* Pass off to the Extended Header dissection */
497 dissect_ehdr (tvb, docsis_tree, pinfo, is_encrypted);
498 }
499 else
500 {
501 /* Add in MAC Parm field only */
502 proto_tree_add_item (docsis_tree, hf_docsis_macparm, tvb, 1, 1, ENC_BIG_ENDIAN);
503 length_item = proto_tree_add_item (docsis_tree, hf_docsis_len, tvb, 2, 2, ENC_BIG_ENDIAN);
504 /* Validate PDU length */
505 if (len_sid > *payload_length)
506 {
507 *payload_length = len_sid;
508 expert_add_info(pinfo, length_item, &ei_docsis_len);
509 }
510 }
511 return;
512 }
513
514 /* Code to Dissect Encrypted DOCSIS Frames */
515 /* Print DST and SRC MACs and do not dissect the payload */
516 /* Implementation inferred from packet-eth.c */
517 static void
518 dissect_encrypted_frame (tvbuff_t * tvb, packet_info * pinfo, proto_tree * tree, const uint8_t fctype, const uint8_t fcparm)
519 {
520 uint32_t offset, frame_len;
521 const uint8_t *src_addr, *dst_addr;
522 const char *src_addr_name, *dst_addr_name;
523 proto_item *addr_item;
524 proto_tree *addr_tree=NULL;
525 // tvbuff_t *next_tvb;
526
527 /* According to CM-SP-SEC-v3.1, PDU regions of the following
528 * frames must be encrypted when security is enabled:
529 * - Variable-length PDU MAC Frames;
530 * - Fragmentation MAC Frames;
531 * - Registration Request (REG-REQ-MP) MAC Management Message Frames;
532 * - Isolation PDU MAC Frames.
533 * There are also other corner cases when MAC Management frames might be encrypted
534 * (e.g. EH_TYPE=7 as described in CM-SP-MULPIv3.1-I15-180509 Table 17 and Table 20)
535 */
536 if (fctype == FCTYPE_MACSPC) {
537 if (fcparm == FCPARM_MAC_MGMT_HDR) {
538 col_append_str (pinfo->cinfo, COL_INFO, " (Encrypted MMM)");
539 } else if (fcparm == FCPARM_FRAG_HDR) {
540 col_append_str (pinfo->cinfo, COL_INFO, " (Encrypted Fragmentation MAC Frame)");
541 } else {
542 col_append_str (pinfo->cinfo, COL_INFO, " (Encrypted)");
543 }
544 } else {
545 col_append_str (pinfo->cinfo, COL_INFO, " (Encrypted)");
546 }
547
548 offset = 0;
549 frame_len = tvb_captured_length_remaining (tvb, offset);
550 switch (fctype)
551 {
552 case FCTYPE_PACKET:
553 case FCTYPE_ISOLAT:
554 case FCTYPE_MACSPC:
555 dst_addr = tvb_get_ptr(tvb, 0, 6);
556 dst_addr_name = get_ether_name(dst_addr);
557 src_addr = tvb_get_ptr(tvb, 6, 6);
558 src_addr_name = get_ether_name(src_addr);
559
560 addr_item = proto_tree_add_ether(tree, hf_docsis_dst, tvb, 0, 6, dst_addr);
561 addr_tree = proto_item_add_subtree(addr_item, ett_addr);
562 addr_item=proto_tree_add_string(addr_tree, hf_docsis_dst_resolved, tvb, 0, 6,
563 dst_addr_name);
564 proto_item_set_generated(addr_item);
565 proto_tree_add_item(addr_tree, hf_docsis_lg, tvb, 0, 3, ENC_BIG_ENDIAN);
566 proto_tree_add_item(addr_tree, hf_docsis_ig, tvb, 0, 3, ENC_BIG_ENDIAN);
567
568 addr_item = proto_tree_add_ether(tree, hf_docsis_src, tvb, 6, 6, src_addr);
569 addr_tree = proto_item_add_subtree(addr_item, ett_addr);
570 addr_item=proto_tree_add_string(addr_tree, hf_docsis_src_resolved, tvb, 6, 6,
571 src_addr_name);
572 proto_item_set_generated(addr_item);
573 proto_tree_add_item(addr_tree, hf_docsis_lg, tvb, 6, 3, ENC_BIG_ENDIAN);
574 proto_tree_add_item(addr_tree, hf_docsis_ig, tvb, 6, 3, ENC_BIG_ENDIAN);
575
576 offset += 12;
577 break;
578 }
579 proto_tree_add_item(tree, hf_docsis_encrypted_payload, tvb, offset, frame_len - offset, ENC_NA);
580
581 return;
582 }
583
584 /* Main DOCSIS Dissection Entry Point */
585 /* Code to Dissect the DOCSIS Frames */
586 static int
587 dissect_docsis (tvbuff_t * tvb, packet_info * pinfo, proto_tree * tree, void* data _U_)
588 {
589 uint8_t fc = 0;
590 uint8_t fctype = 0;
591 uint8_t fcparm = 0;
592 uint8_t exthdr = 0;
593 uint16_t mac_parm = 0;
594 uint8_t hdrlen = DOCSIS_MIN_HEADER_LEN;
595 uint16_t len_sid = 0;
596 tvbuff_t *next_tvb = NULL;
597 tvbuff_t *mgt_tvb = NULL;
598 int pdulen = 0;
599 uint16_t payload_length = 0;
600 /* uint16_t framelen = 0; */
601 bool save_fragmented;
602 bool is_encrypted = false;
603 bool fcs_correct;
604 proto_item *ti;
605 proto_tree *docsis_tree;
606
607 /* Extract Frame Control parts */
608 fc = tvb_get_uint8 (tvb, 0); /* Frame Control Byte */
609 fctype = (fc >> 6) & 0x03; /* Frame Control Type: 2 MSB Bits */
610 fcparm = (fc >> 1) & 0x1F; /* Frame Control Parameter: Next 5 Bits */
611 exthdr = (fc & 0x01); /* Extended Header Bit: LSB */
612
613 /* Extract the MAC Parm; MAC Parm and SID offsets; change for a Queue Depth Request */
614 if (fcparm == FCPARM_QUEUE_DEPTH_REQ_FRM) {
615 mac_parm = tvb_get_ntohs (tvb, 1);
616 len_sid = tvb_get_ntohs (tvb, 3);
617 hdrlen = DOCSIS_MIN_HEADER_LEN + 1; // 7-byte header for this message type
618 } else {
619 mac_parm = tvb_get_uint8 (tvb, 1);
620 len_sid = tvb_get_ntohs (tvb, 2);
621 }
622
623 /* Set Header Length based on presence of Extended header */
624 if (exthdr == EXT_HDR_ON) {
625 hdrlen += mac_parm;
626 }
627
628 /* Captured Payload Length is based on the length of the header */
629 payload_length = tvb_reported_length_remaining (tvb, hdrlen);
630
631 /* If this is a Request Frame, then pdulen is 0 and framelen is 6 */
632 if ((fctype == FCTYPE_MACSPC) && (fcparm == FCPARM_RQST_FRM || fcparm == FCPARM_QUEUE_DEPTH_REQ_FRM))
633 {
634 pdulen = 0;
635 /*
636 if (fcparm == FCPARM_QUEUE_DEPTH_REQ_FRM)
637 framelen = DOCSIS_MIN_HEADER_LEN + 1;
638 else
639 framelen = DOCSIS_MIN_HEADER_LEN;
640 */
641 } else {
642 /* framelen = DOCSIS_MIN_HEADER_LEN + len_sid; */
643 pdulen = len_sid - (mac_parm + 2);
644 }
645
646 /* Make entries in Protocol column and Info column on summary display */
647 col_set_str (pinfo->cinfo, COL_PROTOCOL, "DOCSIS");
648
649 switch (fctype)
650 {
651 case FCTYPE_PACKET:
652 col_set_str (pinfo->cinfo, COL_INFO, "Packet PDU");
653 break;
654 case FCTYPE_SPECIAL:
655 col_set_str (pinfo->cinfo, COL_INFO, "Special Use");
656 break;
657 case FCTYPE_ISOLAT:
658 col_set_str (pinfo->cinfo, COL_INFO, "Isolation PDU");
659 break;
660 case FCTYPE_MACSPC:
661 if (fcparm == FCPARM_RQST_FRM)
662 col_add_fstr (pinfo->cinfo, COL_INFO,
663 "Request Frame SID=%u Mini Slots=%u", len_sid,
664 mac_parm);
665 else if (fcparm == FCPARM_QUEUE_DEPTH_REQ_FRM)
666 col_add_fstr (pinfo->cinfo, COL_INFO,
667 "Request Frame SID=%u, Requested Size=%uxN bytes", len_sid,
668 mac_parm);
669 else if (fcparm == FCPARM_FRAG_HDR)
670 col_set_str (pinfo->cinfo, COL_INFO, "Fragmented Frame");
671 else
672 col_set_str (pinfo->cinfo, COL_INFO, "MAC Specific");
673 break;
674 } /* switch fctype */
675
676 ti = proto_tree_add_item(tree, proto_docsis, tvb, 0, hdrlen, ENC_NA);
677 docsis_tree = proto_item_add_subtree (ti, ett_docsis);
678
679 /* add an item to the subtree, see section 1.6 for more information */
680
681 /* Add in FC Byte fields */
682 proto_tree_add_item (docsis_tree, hf_docsis_fctype, tvb, 0, 1, ENC_BIG_ENDIAN);
683
684 switch (fctype)
685 {
686 case FCTYPE_PACKET:
687 {
688 proto_item_append_text (ti, " Packet PDU");
689 proto_tree_add_item (docsis_tree, hf_docsis_fcparm, tvb, 0, 1, ENC_BIG_ENDIAN);
690 proto_tree_add_item (docsis_tree, hf_docsis_exthdr, tvb, 0, 1, ENC_BIG_ENDIAN);
691 /* Dissect Length field for a PDU */
692 dissect_exthdr_length_field (tvb, pinfo, docsis_tree, exthdr, mac_parm, len_sid, &payload_length, &is_encrypted);
693 /* Dissect Header Check Sequence field for a PDU */
694 fcs_correct = dissect_hcs_field (tvb, pinfo, docsis_tree, hdrlen);
695 if (fcs_correct && pdulen > 0)
696 {
697 next_tvb = tvb_new_subset_remaining(tvb, hdrlen);
698 if(is_encrypted && !docsis_dissect_encrypted_frames)
699 dissect_encrypted_frame (next_tvb, pinfo, docsis_tree, fctype, fcparm);
700 else
701 call_dissector (eth_withoutfcs_handle, next_tvb, pinfo, docsis_tree);
702 }
703 break;
704 }
705 case FCTYPE_SPECIAL:
706 {
707 proto_item_append_text (ti, " Special Use PDU");
708 proto_tree_add_item (docsis_tree, hf_docsis_machdr_fcparm, tvb, 0, 1, ENC_BIG_ENDIAN);
709 proto_tree_add_item (docsis_tree, hf_docsis_exthdr, tvb, 0, 1, ENC_BIG_ENDIAN);
710 /* Dissect Length field for a PDU */
711 dissect_exthdr_length_field (tvb, pinfo, docsis_tree, exthdr, mac_parm, len_sid, &payload_length, &is_encrypted);
712 /* Dissect Header Check Sequence field for a PDU */
713 fcs_correct = dissect_hcs_field (tvb, pinfo, docsis_tree, hdrlen);
714 if (fcs_correct) {
715 if (fcparm == FCPARM_MAC_MGMT_HDR && exthdr == EXT_HDR_OFF) {
716 /* Pass off to the DOCSIS Management dissector/s */
717 mgt_tvb = tvb_new_subset_remaining(tvb, hdrlen);
718 if (is_encrypted && !docsis_dissect_encrypted_frames)
719 dissect_encrypted_frame (mgt_tvb, pinfo, docsis_tree, fctype, fcparm);
720 else
721 call_dissector (docsis_mgmt_handle, mgt_tvb, pinfo, docsis_tree);
722 } else {
723 /* Don't do anything for a Reserved Frame */
724 next_tvb = tvb_new_subset_remaining(tvb, hdrlen);
725 call_data_dissector(next_tvb, pinfo, tree);
726 }
727 }
728 break;
729 }
730 case FCTYPE_ISOLAT:
731 {
732 proto_item_append_text (ti, " Isolation PDU");
733 proto_tree_add_item (docsis_tree, hf_docsis_fcparm, tvb, 0, 1, ENC_BIG_ENDIAN);
734 proto_tree_add_item (docsis_tree, hf_docsis_exthdr, tvb, 0, 1, ENC_BIG_ENDIAN);
735 /* Dissect Length field for a PDU */
736 dissect_exthdr_length_field (tvb, pinfo, docsis_tree, exthdr, mac_parm, len_sid, &payload_length, &is_encrypted);
737 /* Dissect Header Check Sequence field for a PDU */
738 fcs_correct = dissect_hcs_field (tvb, pinfo, docsis_tree, hdrlen);
739 if (fcs_correct && pdulen > 0)
740 {
741 next_tvb = tvb_new_subset_remaining(tvb, hdrlen);
742 if(is_encrypted && !docsis_dissect_encrypted_frames)
743 dissect_encrypted_frame (next_tvb, pinfo, docsis_tree, fctype, fcparm);
744 else
745 call_dissector (eth_withoutfcs_handle, next_tvb, pinfo, docsis_tree);
746 }
747 break;
748 }
749 case FCTYPE_MACSPC:
750 {
751 proto_item_append_text (ti, " MAC-Specific PDU");
752 proto_tree_add_item (docsis_tree, hf_docsis_machdr_fcparm, tvb, 0, 1, ENC_BIG_ENDIAN);
753 proto_tree_add_item (docsis_tree, hf_docsis_exthdr, tvb, 0, 1, ENC_BIG_ENDIAN);
754 switch(fcparm)
755 {
756 case FCPARM_TIMING_HDR:
757 // no break
758 case FCPARM_MAC_MGMT_HDR:
759 {
760 /* Dissect Length field for a PDU */
761 dissect_exthdr_length_field (tvb, pinfo, docsis_tree, exthdr, mac_parm, len_sid, &payload_length, &is_encrypted);
762 /* Dissect Header Check Sequence field for a PDU */
763 fcs_correct = dissect_hcs_field (tvb, pinfo, docsis_tree, hdrlen);
764 if (fcs_correct)
765 {
766 /* Pass off to the DOCSIS Management dissector/s */
767 mgt_tvb = tvb_new_subset_remaining(tvb, hdrlen);
768 if(is_encrypted && !docsis_dissect_encrypted_frames)
769 dissect_encrypted_frame (mgt_tvb, pinfo, docsis_tree, fctype, fcparm);
770 else
771 call_dissector (docsis_mgmt_handle, mgt_tvb, pinfo, docsis_tree);
772 }
773 break;
774 }
775 case FCPARM_RQST_FRM:
776 {
777 /* Decode for a Request Frame. No extended header */
778 proto_tree_add_uint (docsis_tree, hf_docsis_mini_slots, tvb, 1, 1, mac_parm);
779 proto_tree_add_uint (docsis_tree, hf_docsis_sid, tvb, 2, 2, len_sid);
780 /* Dissect Header Check Sequence field for a PDU */
781 fcs_correct = dissect_hcs_field (tvb, pinfo, docsis_tree, hdrlen);
782 if (fcs_correct)
783 {
784 /* Don't do anything for a Request Frame, there is no data following it */
785 }
786 break;
787 }
788 case FCPARM_FRAG_HDR:
789 {
790 /* Check if this is a fragmentation header */
791 save_fragmented = pinfo->fragmented;
792 pinfo->fragmented = true;
793
794 /* Dissect Length field for a PDU */
795 dissect_exthdr_length_field (tvb, pinfo, docsis_tree, exthdr, mac_parm, len_sid, &payload_length, &is_encrypted);
796 /* Dissect Header Check Sequence field for a PDU */
797 fcs_correct = dissect_hcs_field (tvb, pinfo, docsis_tree, hdrlen);
798 if (fcs_correct)
799 {
800 /* Grab the Fragment FCS */
801 uint32_t sent_fcs = tvb_get_ntohl(tvb, (hdrlen + len_sid - 4));
802 uint32_t fcs = crc32_802_tvb(tvb, tvb_captured_length(tvb) - 4);
803
804 /* Only defragment valid frames with a good FCS */
805 if (sent_fcs == fcs)
806 {
807 fragment_head *frag_msg = NULL;
808 frag_msg = fragment_add_seq_check(&docsis_reassembly_table,
809 tvb, hdrlen, pinfo,
810 frag_sid, NULL, /* ID for fragments belonging together */
811 frag_seq, /* Fragment Sequence Number */
812 (len_sid - 4), /* fragment length - to the end */
813 !(frag_flags & FRAG_LAST)); /* More fragments? */
814
815 next_tvb = process_reassembled_data(tvb, hdrlen, pinfo,
816 "Reassembled Message", frag_msg, &docsis_frag_items,
817 NULL, docsis_tree);
818
819 if (frag_flags == FRAG_LAST)
820 pinfo->fragmented = false;
821 else
822 pinfo->fragmented = true;
823
824 if (frag_msg) { /* Reassembled */
825 proto_item_append_text (ti, " (Message Reassembled)");
826 } else { /* Not last packet of reassembled Short Message */
827 proto_item_append_text (ti, " (Message fragment %u)", frag_seq);
828
829 }
830
831 if(next_tvb)
832 {
833 /* By default assume an Ethernet payload */
834 if(is_encrypted && !docsis_dissect_encrypted_frames)
835 dissect_encrypted_frame (next_tvb, pinfo, docsis_tree, fctype, fcparm);
836 else
837 call_dissector (eth_withoutfcs_handle, next_tvb, pinfo, docsis_tree);
838 } else {
839 /* Otherwise treat as Data */
840 tvbuff_t *payload_tvb = tvb_new_subset_length_caplen(tvb, hdrlen, (len_sid - 4), -1);
841 call_data_dissector(payload_tvb, pinfo, docsis_tree);
842 }
843 } else {
844 /* Report frames with a bad FCS */
845 expert_add_info(pinfo, ti, &ei_docsis_frag_fcs_bad);
846 }
847 /* Add the Fragment FCS to the end of the parent tree */
848 proto_tree_add_checksum(docsis_tree, tvb, (hdrlen + len_sid - 4), hf_docsis_frag_fcs, hf_docsis_frag_fcs_status, &ei_docsis_frag_fcs_bad, pinfo, fcs, ENC_BIG_ENDIAN, PROTO_CHECKSUM_VERIFY);
849
850 pinfo->fragmented = save_fragmented;
851 }
852 break;
853 }
854 case FCPARM_QUEUE_DEPTH_REQ_FRM:
855 {
856 /* Decode for a Queue-depth Based Request */
857 proto_tree_add_uint (docsis_tree, hf_docsis_requested_size, tvb, 1, 2, mac_parm);
858 proto_tree_add_uint (docsis_tree, hf_docsis_sid, tvb, 3, 2, len_sid);
859 /* Dissect Header Check Sequence field for a PDU */
860 fcs_correct = dissect_hcs_field (tvb, pinfo, docsis_tree, hdrlen);
861 if (fcs_correct)
862 {
863 /* No PDU Payload for this frame */
864 }
865 break;
866 }
867 case FCPARM_CONCAT_HDR:
868 {
869 /* Decode for a Concatenated Header; ONLY for DOCSIS versions < 3.1. No Extended Header */
870 proto_item_append_text (ti, " (Concatenated Header)");
871 proto_tree_add_item (docsis_tree, hf_docsis_concat_cnt, tvb, 1, 1, ENC_BIG_ENDIAN);
872 proto_tree_add_item (docsis_tree, hf_docsis_len, tvb, 2, 2, ENC_BIG_ENDIAN);
873 /* Dissect Header Check Sequence field for a PDU */
874 fcs_correct = dissect_hcs_field (tvb, pinfo, docsis_tree, hdrlen);
875 if (fcs_correct)
876 {
877 // There used to be a section of code here that recursively
878 // called dissect_docsis. It has been removed. If you plan on
879 // adding concatenated PDU support back you should consider
880 // doing something like the following:
881 // dissect_docsis(...) {
882 // while(we_have_pdus_remaining) {
883 // int pdu_len = dissect_docsis_pdu(...)
884 // if (pdu_len < 1) {
885 // add_expert...
886 // break;
887 // }
888 // }
889 // }
890 // Adding back this functionality using recursion might result
891 // in this dissector being disabled by default or removed entirely.
892 }
893 break;
894 }
895 default:
896 /* Unknown parameter, stop dissection */
897 break;
898 } /* switch fcparm */
899 break;
900 }
901 } /* switch fctype */
902
903 return tvb_captured_length(tvb);
904 }
905
906 /* Register the protocol with Wireshark */
907 void
908 proto_register_docsis (void)
909 {
910 static hf_register_info hf[] = {
911 {&hf_docsis_fctype,
912 {"FCType", "docsis.fctype",
913 FT_UINT8, BASE_HEX, VALS (fctype_vals), 0xC0,
914 "Frame Control Type", HFILL}
915 },
916 {&hf_docsis_fcparm,
917 {"FCParm", "docsis.fcparm",
918 FT_UINT8, BASE_DEC, VALS (pkt_fcparm_vals), 0x3E,
919 "Parameter Field", HFILL}
920 },
921 {&hf_docsis_machdr_fcparm,
922 {"FCParm", "docsis.fcparm",
923 FT_UINT8, BASE_DEC, VALS (ms_fcparm_vals), 0x3E,
924 "Parameter Field", HFILL}
925 },
926 {&hf_docsis_exthdr,
927 {"EXTHDR", "docsis.exthdr",
928 FT_BOOLEAN, 8, TFS (&exthdr_tfs), 0x01,
929 "Extended Header Presence", HFILL}
930 },
931 {&hf_docsis_macparm,
932 {"MACParm", "docsis.macparm",
933 FT_UINT8, BASE_HEX, NULL, 0x0,
934 "MAC Parameter Field", HFILL}
935 },
936 {&hf_docsis_concat_cnt,
937 {"Number of Concatenated Frames", "docsis.concat_cnt",
938 FT_UINT8, BASE_DEC, NULL, 0x0,
939 NULL, HFILL}
940 },
941 {&hf_docsis_ehdrlen,
942 {"Extended Header Length (bytes)", "docsis.ehdrlen",
943 FT_UINT8, BASE_DEC, NULL, 0x0,
944 NULL, HFILL}
945 },
946 {&hf_docsis_len,
947 {"Length of the MAC frame (bytes)", "docsis.len",
948 FT_UINT16, BASE_DEC, NULL, 0x0,
949 "Length of the MAC frame, not counting the fixed-length MAC header", HFILL}
950 },
951 {&hf_docsis_eh_type,
952 {"Type", "docsis.ehdr.type",
953 FT_UINT8, BASE_DEC, VALS (eh_type_vals), 0xF0,
954 "TLV Type", HFILL}
955 },
956 {&hf_docsis_eh_len,
957 {"Length", "docsis.ehdr.len",
958 FT_UINT8, BASE_DEC, NULL, 0x0F,
959 "TLV Len", HFILL}
960 },
961 {&hf_docsis_eh_val,
962 {"Value", "docsis.ehdr.value",
963 FT_BYTES, BASE_NONE, NULL, 0x0,
964 "TLV Value", HFILL}
965 },
966 {&hf_docsis_ehx_type,
967 {"Extended Type", "docsis.ehdr.ehx_type",
968 FT_UINT8, BASE_DEC, NULL, 0x0,
969 "TLV Type", HFILL}
970 },
971 {&hf_docsis_ehx_len,
972 {"Extended Length", "docsis.ehdr.ehx_len",
973 FT_UINT8, BASE_DEC, NULL, 0x0,
974 "TLV Len", HFILL}
975 },
976 {&hf_docsis_frag_rsvd,
977 {"Reserved", "docsis.frag_rsvd",
978 FT_UINT8, BASE_DEC, NULL, 0xC0,
979 NULL, HFILL}
980 },
981 {&hf_docsis_frag_first,
982 {"First Frame", "docsis.frag_first",
983 FT_BOOLEAN, 8, NULL, 0x20,
984 NULL, HFILL}
985 },
986 {&hf_docsis_frag_last,
987 {"Last Frame", "docsis.frag_last",
988 FT_BOOLEAN, 8, NULL, 0x10,
989 NULL, HFILL}
990 },
991 {&hf_docsis_frag_seq,
992 {"Fragmentation Sequence #", "docsis.frag_seq",
993 FT_UINT8, BASE_DEC, NULL, 0x0F,
994 "Fragmentation Sequence Number", HFILL}
995 },
996 {&hf_docsis_sid,
997 {"SID", "docsis.ehdr.sid",
998 FT_UINT16, BASE_DEC_HEX, NULL, 0x3FFF,
999 "Service Identifier", HFILL}
1000 },
1001 {&hf_docsis_said,
1002 {"SAID", "docsis.ehdr.said",
1003 FT_UINT16, BASE_DEC, NULL, 0x3FFF,
1004 "Security Association Identifier", HFILL}
1005 },
1006 {&hf_docsis_reserved,
1007 {"Reserved", "docsis.ehdr.rsvd",
1008 FT_UINT8, BASE_HEX, NULL, 0x0,
1009 "Reserved Byte", HFILL}
1010 },
1011 {&hf_docsis_mini_slots,
1012 {"MiniSlots", "docsis.ehdr.minislots",
1013 FT_UINT8, BASE_DEC, NULL, 0x0,
1014 "Mini Slots Requested", HFILL}
1015 },
1016 {&hf_docsis_requested_size,
1017 {"Requested bytes in units of N bytes, N a parameter of the service flow for which this request is being made", "docsis.ehdr.reqsize",
1018 FT_UINT16, BASE_DEC, NULL, 0x0,
1019 NULL, HFILL}
1020 },
1021 {&hf_docsis_key_seq,
1022 {"Key Sequence", "docsis.ehdr.keyseq",
1023 FT_UINT8, BASE_DEC, NULL, 0xF0,
1024 NULL, HFILL}
1025 },
1026 {&hf_docsis_ehdr_ver,
1027 {"Version", "docsis.ehdr.ver",
1028 FT_UINT8, BASE_DEC, NULL, 0x0F,
1029 NULL, HFILL}
1030 },
1031 {&hf_docsis_ehdr_phsi,
1032 {"Payload Header Suppression Index", "docsis.ehdr.phsi",
1033 FT_UINT8, BASE_DEC|BASE_SPECIAL_VALS, VALS(unique_no_phs), 0x0,
1034 NULL, HFILL}
1035 },
1036 {&hf_docsis_ehdr_qind,
1037 {"Queue Indicator", "docsis.ehdr.qind",
1038 FT_BOOLEAN, 8, TFS(&qind_tfs), 0x80,
1039 NULL, HFILL}
1040 },
1041 {&hf_docsis_ehdr_grants,
1042 {"Active Grants", "docsis.ehdr.act_grants",
1043 FT_UINT8, BASE_DEC, NULL, 0x7F,
1044 NULL, HFILL}
1045 },
1046 {&hf_docsis_ehdr_bpup2_key_seq,
1047 {"Key Sequence", "docsis.ehdr.bpup2_keyseq",
1048 FT_UINT8, BASE_DEC, NULL, 0xF0,
1049 NULL, HFILL}
1050 },
1051 {&hf_docsis_ehdr_bpup2_ver,
1052 {"Version", "docsis.ehdr.bpup2_ver",
1053 FT_UINT8, BASE_DEC, NULL, 0x0F,
1054 NULL, HFILL}
1055 },
1056 {&hf_docsis_ehdr_bpup2_bpi_en,
1057 {"Encryption", "docsis.ehdr.bpup2_bpi_en",
1058 FT_BOOLEAN, 8, TFS (&tfs_enabled_disabled), 0x80,
1059 "BPI Enable", HFILL}
1060 },
1061 {&hf_docsis_ehdr_bpup2_toggle_bit,
1062 {"Toggle", "docsis.ehdr.bpup2_toggle_bit",
1063 FT_BOOLEAN, 8, TFS (&odd_even_tfs), 0x40,
1064 NULL, HFILL}
1065 },
1066 {&hf_docsis_ehdr_bpup2_sid,
1067 {"SID", "docsis.ehdr.bpup2_sid",
1068 FT_UINT16, BASE_DEC, NULL, 0x3FFF,
1069 "Service Identifier", HFILL}
1070 },
1071 { &hf_docsis_ehdr_pv_st_refpt,
1072 { "Start Reference Point", "docsis.ehdr.pv_start_ref",
1073 FT_UINT8, BASE_DEC, NULL, 0x0,
1074 NULL, HFILL}
1075 },
1076 { &hf_docsis_ehdr_pv_timestamp,
1077 { "Timestamp", "docsis.ehdr.pv_timestamp",
1078 FT_UINT32, BASE_DEC, NULL, 0x0,
1079 NULL, HFILL}
1080 },
1081 {&hf_docsis_ehdr_ds_traffic_pri,
1082 {"DS Traffic Priority", "docsis.ehdr.ds_traffic_pri",
1083 FT_UINT8, BASE_DEC, NULL, 0xE0,
1084 NULL, HFILL}
1085 },
1086 {&hf_docsis_ehdr_ds_seq_chg_cnt,
1087 {"DS Sequence Change Count", "docsis.ehdr.ds_seq_chg_cnt",
1088 FT_UINT8, BASE_DEC, NULL, 0x10,
1089 NULL, HFILL}
1090 },
1091 {&hf_docsis_ehdr_ds_dsid,
1092 {"DS DSID", "docsis.ehdr.ds_dsid",
1093 FT_UINT32, BASE_DEC, NULL, 0x0FFFFF,
1094 NULL, HFILL}
1095 },
1096 {&hf_docsis_ehdr_ds_pkt_seq_num,
1097 {"DS Packet Sequence Number", "docsis.ehdr.ds_pkt_seq_num",
1098 FT_UINT16, BASE_DEC, NULL, 0x0,
1099 NULL, HFILL}
1100 },
1101 {&hf_docsis_hcs,
1102 {"Header check sequence", "docsis.hcs",
1103 FT_UINT16, BASE_HEX, NULL, 0x0,
1104 NULL, HFILL}
1105 },
1106 { &hf_docsis_hcs_status,
1107 { "HCS Status", "docsis.hcs.status",
1108 FT_UINT8, BASE_NONE, VALS(local_proto_checksum_vals), 0x0,
1109 NULL, HFILL}
1110 },
1111 { &hf_docsis_bpi_en,
1112 { "Encryption", "docsis.bpi_en",
1113 FT_BOOLEAN, 8, TFS (&tfs_enabled_disabled), 0x80,
1114 "BPI Enable", HFILL}
1115 },
1116 { &hf_docsis_toggle_bit,
1117 { "Toggle", "docsis.toggle_bit",
1118 FT_BOOLEAN, 8, TFS (&odd_even_tfs), 0x40,
1119 NULL, HFILL}
1120 },
1121 { &hf_docsis_fragment_overlap,
1122 { "Fragment overlap", "docsis.fragment.overlap",
1123 FT_BOOLEAN, BASE_NONE, NULL, 0x0,
1124 "Fragment overlaps with other fragments", HFILL}
1125 },
1126 { &hf_docsis_fragment_overlap_conflict,
1127 { "Conflicting data in fragment overlap", "docsis.fragment.overlap.conflict",
1128 FT_BOOLEAN, BASE_NONE, NULL, 0x0,
1129 "Overlapping fragments contained conflicting data", HFILL}
1130 },
1131 { &hf_docsis_fragment_multiple_tails,
1132 { "Multiple tail fragments found", "docsis.fragment.multipletails",
1133 FT_BOOLEAN, BASE_NONE, NULL, 0x0,
1134 "Several tails were found when defragmenting the packet", HFILL}
1135 },
1136 { &hf_docsis_fragment_too_long_fragment,
1137 { "Fragment too long", "docsis.fragment.toolongfragment",
1138 FT_BOOLEAN, BASE_NONE, NULL, 0x0,
1139 "Fragment contained data past end of packet", HFILL}
1140 },
1141 { &hf_docsis_fragment_error,
1142 { "Defragmentation error", "docsis.fragment.error",
1143 FT_FRAMENUM, BASE_NONE, NULL, 0x0,
1144 "Defragmentation error due to illegal fragments", HFILL}
1145 },
1146 { &hf_docsis_fragment_count,
1147 { "Fragment count", "docsis.fragment.count",
1148 FT_UINT32, BASE_DEC, NULL, 0x0,
1149 NULL, HFILL}
1150 },
1151 { &hf_docsis_fragment,
1152 { "DOCSIS Fragment", "docsis.fragment",
1153 FT_FRAMENUM, BASE_NONE, NULL, 0x0,
1154 NULL, HFILL}
1155 },
1156 { &hf_docsis_fragments,
1157 { "DOCSIS Fragments", "docsis.fragments",
1158 FT_BYTES, BASE_NONE, NULL, 0x0,
1159 NULL, HFILL}
1160 },
1161 { &hf_docsis_reassembled_in,
1162 { "Reassembled DOCSIS in frame", "docsis.reassembled_in",
1163 FT_FRAMENUM, BASE_NONE, NULL, 0x0,
1164 "This DOCSIS packet is reassembled in this frame", HFILL}
1165 },
1166 { &hf_docsis_reassembled_length,
1167 { "Reassembled DOCSIS length", "docsis.reassembled.length",
1168 FT_UINT32, BASE_DEC, NULL, 0x0,
1169 "The total length of the reassembled payload", HFILL}
1170 },
1171 { &hf_docsis_reassembled_data,
1172 { "Reassembled DOCSIS data", "docsis.reassembled.data",
1173 FT_BYTES, BASE_NONE, NULL, 0x0,
1174 "The reassembled payload", HFILL}
1175 },
1176 { &hf_docsis_frag_fcs,
1177 { "Fragment FCS", "docsis.frag.fcs",
1178 FT_UINT32, BASE_HEX, NULL, 0x0,
1179 NULL, HFILL}
1180 },
1181 { &hf_docsis_frag_fcs_status,
1182 { "Fragment FCS Status", "docsis.frag.fcs.status",
1183 FT_UINT8, BASE_NONE, VALS(local_proto_checksum_vals), 0x0,
1184 NULL, HFILL}
1185 },
1186 { &hf_docsis_encrypted_payload,
1187 { "Encrypted Payload", "docsis.encrypted_payload",
1188 FT_BYTES, BASE_NONE, NULL, 0x0,
1189 "Encrypted data", HFILL }
1190 }
1191 };
1192
1193 static ei_register_info ei[] = {
1194 { &ei_docsis_hcs_bad, { "docsis.hcs_bad", PI_CHECKSUM, PI_ERROR, "Bad checksum", EXPFILL }},
1195 { &ei_docsis_len, { "docsis.len.past_end", PI_MALFORMED, PI_ERROR, "Length field value goes past the end of the payload", EXPFILL }},
1196 { &ei_docsis_frag_fcs_bad, { "docsis.frag.fcs_bad", PI_CHECKSUM, PI_ERROR, "Bad checksum", EXPFILL }},
1197 { &ei_docsis_eh_len, { "docsis.ehdr.len.past_end", PI_MALFORMED, PI_ERROR, "Extended Header Length Invalid!", EXPFILL }}
1198 };
1199
1200 static int *ett[] = {
1201 &ett_docsis,
1202 &ett_ehdr,
1203 &ett_docsis_fragment,
1204 &ett_docsis_fragments,
1205 &ett_addr
1206 };
1207
1208 module_t *docsis_module;
1209 expert_module_t* expert_docsis;
1210
1211 proto_docsis = proto_register_protocol ("DOCSIS", "DOCSIS", "docsis");
1212 proto_register_field_array (proto_docsis, hf, array_length (hf));
1213 proto_register_subtree_array (ett, array_length (ett));
1214
1215 /* register expert notifications */
1216 expert_docsis = expert_register_protocol(proto_docsis);
1217 expert_register_field_array(expert_docsis, ei, array_length(ei));
1218
1219 /* Register configuration preferences */
1220 docsis_module = prefs_register_protocol(proto_docsis, NULL);
1221 prefs_register_bool_preference(docsis_module, "check_fcs",
1222 "Validate the DOCSIS checksum if possible",
1223 "Whether or not to validate the Header Check Sequence",
1224 &docsis_check_fcs);
1225 prefs_register_bool_preference(docsis_module, "dissect_encrypted_frames",
1226 "Ignore EH 'encrypted' bit",
1227 "Whether or not to attempt to dissect encrypted DOCSIS payload",
1228 &docsis_dissect_encrypted_frames);
1229
1230 #if 0
1231 docsis_dissector_table = register_dissector_table ("docsis",
1232 "DOCSIS Encapsulation Type", proto_docsis,
1233 FT_UINT8, BASE_DEC);
1234 #endif
1235
1236 docsis_handle = register_dissector ("docsis", dissect_docsis, proto_docsis);
1237 reassembly_table_register(&docsis_reassembly_table,
1238 &addresses_reassembly_table_functions);
1239 }
1240
1241 void
1242 proto_reg_handoff_docsis (void)
1243 {
1244 dissector_add_uint ("wtap_encap", WTAP_ENCAP_DOCSIS, docsis_handle);
1245
1246 hf_docsis_dst = proto_registrar_get_id_byname ("eth.dst");
1247 hf_docsis_dst_resolved = proto_registrar_get_id_byname ("eth.dst_resolved");
1248 hf_docsis_src = proto_registrar_get_id_byname ("eth.src");
1249 hf_docsis_src_resolved = proto_registrar_get_id_byname ("eth.src_resolved");
1250 hf_docsis_lg = proto_registrar_get_id_byname ("eth.lg");
1251 hf_docsis_ig = proto_registrar_get_id_byname ("eth.ig");
1252
1253 docsis_mgmt_handle = find_dissector ("docsis_mgmt");
1254 eth_withoutfcs_handle = find_dissector_add_dependency("eth_withoutfcs", proto_docsis);
1255 }
1256
1257 /*
1258 * Editor modelines - https://www.wireshark.org/tools/modelines.html
1259 *
1260 * Local Variables:
1261 * c-basic-offset: 2
1262 * tab-width: 8
1263 * indent-tabs-mode: nil
1264 * End:
1265 *
1266 * ex: set shiftwidth=2 tabstop=8 expandtab:
1267 * :indentSize=2:tabSize=8:noTabs=true:
1268 */
Metzes wireshark repo