1 /*
2 * Copyright (c) 1998-2007 The TCPDUMP project
3 *
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that: (1) source code
6 * distributions retain the above copyright notice and this paragraph
7 * in its entirety, and (2) distributions including binary code include
8 * the above copyright notice and this paragraph in its entirety in
9 * the documentation or other materials provided with the distribution.
10 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND
11 * WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, WITHOUT
12 * LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
13 * FOR A PARTICULAR PURPOSE.
14 *
15 * Original code by Carles Kishimoto <carles.kishimoto@gmail.com>
16 */
17
18 /* \summary: Light Weight Access Point Protocol (LWAPP) printer */
19
20 /* specification: RFC 5412 */
21
22 #include <config.h>
23
24 #include "netdissect-stdinc.h"
25
26 #include "netdissect.h"
27 #include "extract.h"
28 #include "addrtoname.h"
29
30
31 /*
32 * LWAPP transport (common) header
33 * 0 1 2 3
34 * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
35 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
36 * |VER| RID |C|F|L| Frag ID | Length |
37 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
38 * | Status/WLANs | Payload... |
39 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
40 *
41 */
42
43 struct lwapp_transport_header {
44 nd_uint8_t version;
45 nd_uint8_t frag_id;
46 nd_uint16_t length;
47 nd_uint16_t status;
48 };
49
50 /*
51 * LWAPP control header
52 * 0 1 2 3
53 * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
54 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
55 * | Message Type | Seq Num | Msg Element Length |
56 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
57 * | Session ID |
58 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
59 * | Msg Element [0..N] |
60 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
61 */
62
63 struct lwapp_control_header {
64 nd_uint8_t msg_type;
65 nd_uint8_t seq_num;
66 nd_uint16_t len;
67 nd_uint32_t session_id;
68 };
69
70 #define LWAPP_VERSION 0
71 #define LWAPP_EXTRACT_VERSION(x) (((x)&0xC0)>>6)
72 #define LWAPP_EXTRACT_RID(x) (((x)&0x38)>>3)
73 #define LWAPP_EXTRACT_CONTROL_BIT(x) (((x)&0x04)>>2)
74
75 static const struct tok lwapp_header_bits_values[] = {
76 { 0x01, "Last Fragment Bit"},
77 { 0x02, "Fragment Bit"},
78 { 0x04, "Control Bit"},
79 { 0, NULL}
80 };
81
82 #define LWAPP_MSGTYPE_DISCOVERY_REQUEST 1
83 #define LWAPP_MSGTYPE_DISCOVERY_RESPONSE 2
84 #define LWAPP_MSGTYPE_JOIN_REQUEST 3
85 #define LWAPP_MSGTYPE_JOIN_RESPONSE 4
86 #define LWAPP_MSGTYPE_JOIN_ACK 5
87 #define LWAPP_MSGTYPE_JOIN_CONFIRM 6
88 #define LWAPP_MSGTYPE_CONFIGURE_REQUEST 10
89 #define LWAPP_MSGTYPE_CONFIGURE_RESPONSE 11
90 #define LWAPP_MSGTYPE_CONF_UPDATE_REQUEST 12
91 #define LWAPP_MSGTYPE_CONF_UPDATE_RESPONSE 13
92 #define LWAPP_MSGTYPE_WTP_EVENT_REQUEST 14
93 #define LWAPP_MSGTYPE_WTP_EVENT_RESPONSE 15
94 #define LWAPP_MSGTYPE_CHANGE_STATE_EVENT_REQUEST 16
95 #define LWAPP_MSGTYPE_CHANGE_STATE_EVENT_RESPONSE 17
96 #define LWAPP_MSGTYPE_ECHO_REQUEST 22
97 #define LWAPP_MSGTYPE_ECHO_RESPONSE 23
98 #define LWAPP_MSGTYPE_IMAGE_DATA_REQUEST 24
99 #define LWAPP_MSGTYPE_IMAGE_DATA_RESPONSE 25
100 #define LWAPP_MSGTYPE_RESET_REQUEST 26
101 #define LWAPP_MSGTYPE_RESET_RESPONSE 27
102 #define LWAPP_MSGTYPE_KEY_UPDATE_REQUEST 30
103 #define LWAPP_MSGTYPE_KEY_UPDATE_RESPONSE 31
104 #define LWAPP_MSGTYPE_PRIMARY_DISCOVERY_REQUEST 32
105 #define LWAPP_MSGTYPE_PRIMARY_DISCOVERY_RESPONSE 33
106 #define LWAPP_MSGTYPE_DATA_TRANSFER_REQUEST 34
107 #define LWAPP_MSGTYPE_DATA_TRANSFER_RESPONSE 35
108 #define LWAPP_MSGTYPE_CLEAR_CONFIG_INDICATION 36
109 #define LWAPP_MSGTYPE_WLAN_CONFIG_REQUEST 37
110 #define LWAPP_MSGTYPE_WLAN_CONFIG_RESPONSE 38
111 #define LWAPP_MSGTYPE_MOBILE_CONFIG_REQUEST 39
112 #define LWAPP_MSGTYPE_MOBILE_CONFIG_RESPONSE 40
113
114 static const struct tok lwapp_msg_type_values[] = {
115 { LWAPP_MSGTYPE_DISCOVERY_REQUEST, "Discovery req"},
116 { LWAPP_MSGTYPE_DISCOVERY_RESPONSE, "Discovery resp"},
117 { LWAPP_MSGTYPE_JOIN_REQUEST, "Join req"},
118 { LWAPP_MSGTYPE_JOIN_RESPONSE, "Join resp"},
119 { LWAPP_MSGTYPE_JOIN_ACK, "Join ack"},
120 { LWAPP_MSGTYPE_JOIN_CONFIRM, "Join confirm"},
121 { LWAPP_MSGTYPE_CONFIGURE_REQUEST, "Configure req"},
122 { LWAPP_MSGTYPE_CONFIGURE_RESPONSE, "Configure resp"},
123 { LWAPP_MSGTYPE_CONF_UPDATE_REQUEST, "Update req"},
124 { LWAPP_MSGTYPE_CONF_UPDATE_RESPONSE, "Update resp"},
125 { LWAPP_MSGTYPE_WTP_EVENT_REQUEST, "WTP event req"},
126 { LWAPP_MSGTYPE_WTP_EVENT_RESPONSE, "WTP event resp"},
127 { LWAPP_MSGTYPE_CHANGE_STATE_EVENT_REQUEST, "Change state event req"},
128 { LWAPP_MSGTYPE_CHANGE_STATE_EVENT_RESPONSE, "Change state event resp"},
129 { LWAPP_MSGTYPE_ECHO_REQUEST, "Echo req"},
130 { LWAPP_MSGTYPE_ECHO_RESPONSE, "Echo resp"},
131 { LWAPP_MSGTYPE_IMAGE_DATA_REQUEST, "Image data req"},
132 { LWAPP_MSGTYPE_IMAGE_DATA_RESPONSE, "Image data resp"},
133 { LWAPP_MSGTYPE_RESET_REQUEST, "Channel status req"},
134 { LWAPP_MSGTYPE_RESET_RESPONSE, "Channel status resp"},
135 { LWAPP_MSGTYPE_KEY_UPDATE_REQUEST, "Key update req"},
136 { LWAPP_MSGTYPE_KEY_UPDATE_RESPONSE, "Key update resp"},
137 { LWAPP_MSGTYPE_PRIMARY_DISCOVERY_REQUEST, "Primary discovery req"},
138 { LWAPP_MSGTYPE_PRIMARY_DISCOVERY_RESPONSE, "Primary discovery resp"},
139 { LWAPP_MSGTYPE_DATA_TRANSFER_REQUEST, "Data transfer req"},
140 { LWAPP_MSGTYPE_DATA_TRANSFER_RESPONSE, "Data transfer resp"},
141 { LWAPP_MSGTYPE_CLEAR_CONFIG_INDICATION, "Clear config ind"},
142 { LWAPP_MSGTYPE_WLAN_CONFIG_REQUEST, "Wlan config req"},
143 { LWAPP_MSGTYPE_WLAN_CONFIG_RESPONSE, "Wlan config resp"},
144 { LWAPP_MSGTYPE_MOBILE_CONFIG_REQUEST, "Mobile config req"},
145 { LWAPP_MSGTYPE_MOBILE_CONFIG_RESPONSE, "Mobile config resp"},
146 { 0, NULL}
147 };
148
149 /*
150 * LWAPP message elements
151 *
152 * 0 1 2 3
153 * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
154 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
155 * | Type | Length | Value ... |
156 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
157 */
158 struct lwapp_message_header {
159 nd_uint8_t type;
160 nd_uint16_t length;
161 };
162
163 void
lwapp_control_print(netdissect_options * ndo,const u_char * pptr,u_int len,int has_ap_ident)164 lwapp_control_print(netdissect_options *ndo,
165 const u_char *pptr, u_int len, int has_ap_ident)
166 {
167 const struct lwapp_transport_header *lwapp_trans_header;
168 const struct lwapp_control_header *lwapp_control_header;
169 const u_char *tptr;
170 uint8_t version;
171 u_int tlen;
172 u_int msg_type, msg_tlen;
173
174 ndo->ndo_protocol = "lwapp_control";
175 tptr=pptr;
176
177 if (has_ap_ident) {
178 /* check if enough bytes for AP identity */
179 ND_TCHECK_6(tptr);
180 lwapp_trans_header = (const struct lwapp_transport_header *)(pptr+6);
181 } else {
182 lwapp_trans_header = (const struct lwapp_transport_header *)pptr;
183 }
184 ND_TCHECK_SIZE(lwapp_trans_header);
185 version = GET_U_1(lwapp_trans_header->version);
186
187 /*
188 * Sanity checking of the header.
189 */
190 if (LWAPP_EXTRACT_VERSION(version) != LWAPP_VERSION) {
191 ND_PRINT("LWAPP version %u packet not supported",
192 LWAPP_EXTRACT_VERSION(version));
193 return;
194 }
195
196 /* non-verbose */
197 if (ndo->ndo_vflag < 1) {
198 ND_PRINT("LWAPPv%u, %s frame, Flags [%s], length %u",
199 LWAPP_EXTRACT_VERSION(version),
200 LWAPP_EXTRACT_CONTROL_BIT(version) ? "Control" : "Data",
201 bittok2str(lwapp_header_bits_values,"none",version&0x07),
202 len);
203 return;
204 }
205
206 /* ok they seem to want to know everything - lets fully decode it */
207 tlen=GET_BE_U_2(lwapp_trans_header->length);
208
209 ND_PRINT("LWAPPv%u, %s frame, Radio-id %u, Flags [%s], Frag-id %u, length %u",
210 LWAPP_EXTRACT_VERSION(version),
211 LWAPP_EXTRACT_CONTROL_BIT(version) ? "Control" : "Data",
212 LWAPP_EXTRACT_RID(version),
213 bittok2str(lwapp_header_bits_values,"none",version&0x07),
214 GET_U_1(lwapp_trans_header->frag_id),
215 tlen);
216
217 if (has_ap_ident) {
218 ND_PRINT("\n\tAP identity: %s", GET_ETHERADDR_STRING(tptr));
219 tptr+=sizeof(struct lwapp_transport_header)+6;
220 } else {
221 tptr+=sizeof(struct lwapp_transport_header);
222 }
223
224 while(tlen!=0) {
225
226 /* did we capture enough for fully decoding the object header ? */
227 ND_TCHECK_LEN(tptr, sizeof(struct lwapp_control_header));
228 if (tlen < sizeof(struct lwapp_control_header)) {
229 ND_PRINT("\n\t Msg goes past end of PDU");
230 break;
231 }
232
233 lwapp_control_header = (const struct lwapp_control_header *)tptr;
234 msg_tlen = GET_BE_U_2(lwapp_control_header->len);
235 if (tlen < sizeof(struct lwapp_control_header) + msg_tlen) {
236 ND_PRINT("\n\t Msg goes past end of PDU");
237 break;
238 }
239
240 /* print message header */
241 msg_type = GET_U_1(lwapp_control_header->msg_type);
242 ND_PRINT("\n\t Msg type: %s (%u), Seqnum: %u, Msg len: %u, Session: 0x%08x",
243 tok2str(lwapp_msg_type_values,"Unknown",msg_type),
244 msg_type,
245 GET_U_1(lwapp_control_header->seq_num),
246 msg_tlen,
247 GET_BE_U_4(lwapp_control_header->session_id));
248
249 /* did we capture enough for fully decoding the message */
250 ND_TCHECK_LEN(tptr, msg_tlen);
251
252 /* XXX - Decode sub messages for each message */
253 switch(msg_type) {
254 case LWAPP_MSGTYPE_DISCOVERY_REQUEST:
255 case LWAPP_MSGTYPE_DISCOVERY_RESPONSE:
256 case LWAPP_MSGTYPE_JOIN_REQUEST:
257 case LWAPP_MSGTYPE_JOIN_RESPONSE:
258 case LWAPP_MSGTYPE_JOIN_ACK:
259 case LWAPP_MSGTYPE_JOIN_CONFIRM:
260 case LWAPP_MSGTYPE_CONFIGURE_REQUEST:
261 case LWAPP_MSGTYPE_CONFIGURE_RESPONSE:
262 case LWAPP_MSGTYPE_CONF_UPDATE_REQUEST:
263 case LWAPP_MSGTYPE_CONF_UPDATE_RESPONSE:
264 case LWAPP_MSGTYPE_WTP_EVENT_REQUEST:
265 case LWAPP_MSGTYPE_WTP_EVENT_RESPONSE:
266 case LWAPP_MSGTYPE_CHANGE_STATE_EVENT_REQUEST:
267 case LWAPP_MSGTYPE_CHANGE_STATE_EVENT_RESPONSE:
268 case LWAPP_MSGTYPE_ECHO_REQUEST:
269 case LWAPP_MSGTYPE_ECHO_RESPONSE:
270 case LWAPP_MSGTYPE_IMAGE_DATA_REQUEST:
271 case LWAPP_MSGTYPE_IMAGE_DATA_RESPONSE:
272 case LWAPP_MSGTYPE_RESET_REQUEST:
273 case LWAPP_MSGTYPE_RESET_RESPONSE:
274 case LWAPP_MSGTYPE_KEY_UPDATE_REQUEST:
275 case LWAPP_MSGTYPE_KEY_UPDATE_RESPONSE:
276 case LWAPP_MSGTYPE_PRIMARY_DISCOVERY_REQUEST:
277 case LWAPP_MSGTYPE_PRIMARY_DISCOVERY_RESPONSE:
278 case LWAPP_MSGTYPE_DATA_TRANSFER_REQUEST:
279 case LWAPP_MSGTYPE_DATA_TRANSFER_RESPONSE:
280 case LWAPP_MSGTYPE_CLEAR_CONFIG_INDICATION:
281 case LWAPP_MSGTYPE_WLAN_CONFIG_REQUEST:
282 case LWAPP_MSGTYPE_WLAN_CONFIG_RESPONSE:
283 case LWAPP_MSGTYPE_MOBILE_CONFIG_REQUEST:
284 case LWAPP_MSGTYPE_MOBILE_CONFIG_RESPONSE:
285 default:
286 break;
287 }
288
289 tptr += sizeof(struct lwapp_control_header) + msg_tlen;
290 tlen -= sizeof(struct lwapp_control_header) + msg_tlen;
291 }
292 return;
293
294 trunc:
295 nd_print_trunc(ndo);
296 }
297
298 void
lwapp_data_print(netdissect_options * ndo,const u_char * pptr,u_int len)299 lwapp_data_print(netdissect_options *ndo,
300 const u_char *pptr, u_int len)
301 {
302 const struct lwapp_transport_header *lwapp_trans_header;
303 const u_char *tptr;
304 u_int tlen;
305 u_int version;
306
307 ndo->ndo_protocol = "lwapp_data";
308 tptr=pptr;
309
310 /* check if enough bytes for AP identity */
311 ND_TCHECK_6(tptr);
312 lwapp_trans_header = (const struct lwapp_transport_header *)pptr;
313 ND_TCHECK_SIZE(lwapp_trans_header);
314 version = GET_U_1(lwapp_trans_header->version);
315
316 /*
317 * Sanity checking of the header.
318 */
319 if (LWAPP_EXTRACT_VERSION(version) != LWAPP_VERSION) {
320 ND_PRINT("LWAPP version %u packet not supported",
321 LWAPP_EXTRACT_VERSION(version));
322 return;
323 }
324
325 /* non-verbose */
326 if (ndo->ndo_vflag < 1) {
327 ND_PRINT("LWAPPv%u, %s frame, Flags [%s], length %u",
328 LWAPP_EXTRACT_VERSION(version),
329 LWAPP_EXTRACT_CONTROL_BIT(version) ? "Control" : "Data",
330 bittok2str(lwapp_header_bits_values,"none",version&0x07),
331 len);
332 return;
333 }
334
335 /* ok they seem to want to know everything - lets fully decode it */
336 tlen=GET_BE_U_2(lwapp_trans_header->length);
337 if (tlen < sizeof(struct lwapp_transport_header)) {
338 ND_PRINT("LWAPPv%u, %s frame, Radio-id %u, Flags [%s], length %u < transport header length",
339 LWAPP_EXTRACT_VERSION(version),
340 LWAPP_EXTRACT_CONTROL_BIT(version) ? "Control" : "Data",
341 LWAPP_EXTRACT_RID(version),
342 bittok2str(lwapp_header_bits_values,"none",version&0x07),
343 tlen);
344 return;
345 }
346
347 ND_PRINT("LWAPPv%u, %s frame, Radio-id %u, Flags [%s], Frag-id %u, length %u",
348 LWAPP_EXTRACT_VERSION(version),
349 LWAPP_EXTRACT_CONTROL_BIT(version) ? "Control" : "Data",
350 LWAPP_EXTRACT_RID(version),
351 bittok2str(lwapp_header_bits_values,"none",version&0x07),
352 GET_U_1(lwapp_trans_header->frag_id),
353 tlen);
354
355 tptr+=sizeof(struct lwapp_transport_header);
356 tlen-=sizeof(struct lwapp_transport_header);
357
358 /* FIX - An IEEE 802.11 frame follows - hexdump for now */
359 print_unknown_data(ndo, tptr, "\n\t", tlen);
360
361 return;
362
363 trunc:
364 nd_print_trunc(ndo);
365 }
366