1/* 2 * Copyright (c) 2009 3 * Siemens AG, All rights reserved. 4 * Dmitry Eremin-Solenikov (dbaryshkov@gmail.com) 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that: (1) source code distributions 8 * retain the above copyright notice and this paragraph in its entirety, (2) 9 * distributions including binary code include the above copyright notice and 10 * this paragraph in its entirety in the documentation or other materials 11 * provided with the distribution, and (3) all advertising materials mentioning 12 * features or use of this software display the following acknowledgement: 13 * ``This product includes software developed by the University of California, 14 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of 15 * the University nor the names of its contributors may be used to endorse 16 * or promote products derived from this software without specific prior 17 * written permission. 18 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED 19 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF 20 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 21 */ 22 23/* \summary: IEEE 802.15.4 printer */ 24 25#ifdef HAVE_CONFIG_H 26#include <config.h> 27#endif 28 29#include "netdissect-stdinc.h" 30 31#define ND_LONGJMP_FROM_TCHECK 32#include "netdissect.h" 33#include "addrtoname.h" 34 35#include "extract.h" 36 37#define CHECK_BIT(num,bit) (((num) >> (bit)) & 0x1) 38 39#define BROKEN_6TISCH_PAN_ID_COMPRESSION 0 40 41/* Frame types from Table 7-1 of 802.15.4-2015 */ 42static const char *ftypes[] = { 43 "Beacon", /* 0 */ 44 "Data", /* 1 */ 45 "ACK", /* 2 */ 46 "Command", /* 3 */ 47 "Reserved", /* 4 */ 48 "Multipurpose", /* 5 */ 49 "Fragment", /* 6 */ 50 "Extended" /* 7 */ 51}; 52 53/* Element IDs for Header IEs from Table 7-7 of 802.15.4-2015 */ 54static const char *h_ie_names[] = { 55 "Vendor Specific Header IE", /* 0x00 */ 56 "Reserved 0x01", /* 0x01 */ 57 "Reserved 0x02", /* 0x02 */ 58 "Reserved 0x03", /* 0x03 */ 59 "Reserved 0x04", /* 0x04 */ 60 "Reserved 0x05", /* 0x05 */ 61 "Reserved 0x06", /* 0x06 */ 62 "Reserved 0x07", /* 0x07 */ 63 "Reserved 0x08", /* 0x08 */ 64 "Reserved 0x09", /* 0x09 */ 65 "Reserved 0x0a", /* 0x0a */ 66 "Reserved 0x0b", /* 0x0b */ 67 "Reserved 0x0c", /* 0x0c */ 68 "Reserved 0x0d", /* 0x0d */ 69 "Reserved 0x0e", /* 0x0e */ 70 "Reserved 0x0f", /* 0x0f */ 71 "Reserved 0x10", /* 0x10 */ 72 "Reserved 0x11", /* 0x11 */ 73 "Reserved 0x12", /* 0x12 */ 74 "Reserved 0x13", /* 0x13 */ 75 "Reserved 0x14", /* 0x14 */ 76 "Reserved 0x15", /* 0x15 */ 77 "Reserved 0x16", /* 0x16 */ 78 "Reserved 0x17", /* 0x17 */ 79 "Reserved 0x18", /* 0x18 */ 80 "Reserved 0x19", /* 0x19 */ 81 "LE CSL IE", /* 0x1a */ 82 "LE RIT IE", /* 0x1b */ 83 "DSME PAN descriptor IE", /* 0x1c */ 84 "Rendezvous Time IE", /* 0x1d */ 85 "Time Correction IE", /* 0x1e */ 86 "Reserved 0x1f", /* 0x1f */ 87 "Reserved 0x20", /* 0x20 */ 88 "Extended DSME PAN descriptor IE", /* 0x21 */ 89 "Fragment Sequence Context Description IE", /* 0x22 */ 90 "Simplified Superframe Specification IE", /* 0x23 */ 91 "Simplified GTS Specification IE", /* 0x24 */ 92 "LECIM Capabilities IE", /* 0x25 */ 93 "TRLE Descriptor IE", /* 0x26 */ 94 "RCC Capabilities IE", /* 0x27 */ 95 "RCCN Descriptor IE", /* 0x28 */ 96 "Global Time IE", /* 0x29 */ 97 "Omnibus Header IE", /* 0x2a */ 98 "DA IE", /* 0x2b */ 99 "Reserved 0x2c", /* 0x2c */ 100 "Reserved 0x2d", /* 0x2d */ 101 "Reserved 0x2e", /* 0x2e */ 102 "Reserved 0x2f", /* 0x2f */ 103 "Reserved 0x30", /* 0x30 */ 104 "Reserved 0x31", /* 0x31 */ 105 "Reserved 0x32", /* 0x32 */ 106 "Reserved 0x33", /* 0x33 */ 107 "Reserved 0x34", /* 0x34 */ 108 "Reserved 0x35", /* 0x35 */ 109 "Reserved 0x36", /* 0x36 */ 110 "Reserved 0x37", /* 0x37 */ 111 "Reserved 0x38", /* 0x38 */ 112 "Reserved 0x39", /* 0x39 */ 113 "Reserved 0x3a", /* 0x3a */ 114 "Reserved 0x3b", /* 0x3b */ 115 "Reserved 0x3c", /* 0x3c */ 116 "Reserved 0x3d", /* 0x3d */ 117 "Reserved 0x3e", /* 0x3e */ 118 "Reserved 0x3f", /* 0x3f */ 119 "Reserved 0x40", /* 0x40 */ 120 "Reserved 0x41", /* 0x41 */ 121 "Reserved 0x42", /* 0x42 */ 122 "Reserved 0x43", /* 0x43 */ 123 "Reserved 0x44", /* 0x44 */ 124 "Reserved 0x45", /* 0x45 */ 125 "Reserved 0x46", /* 0x46 */ 126 "Reserved 0x47", /* 0x47 */ 127 "Reserved 0x48", /* 0x48 */ 128 "Reserved 0x49", /* 0x49 */ 129 "Reserved 0x4a", /* 0x4a */ 130 "Reserved 0x4b", /* 0x4b */ 131 "Reserved 0x4c", /* 0x4c */ 132 "Reserved 0x4d", /* 0x4d */ 133 "Reserved 0x4e", /* 0x4e */ 134 "Reserved 0x4f", /* 0x4f */ 135 "Reserved 0x50", /* 0x50 */ 136 "Reserved 0x51", /* 0x51 */ 137 "Reserved 0x52", /* 0x52 */ 138 "Reserved 0x53", /* 0x53 */ 139 "Reserved 0x54", /* 0x54 */ 140 "Reserved 0x55", /* 0x55 */ 141 "Reserved 0x56", /* 0x56 */ 142 "Reserved 0x57", /* 0x57 */ 143 "Reserved 0x58", /* 0x58 */ 144 "Reserved 0x59", /* 0x59 */ 145 "Reserved 0x5a", /* 0x5a */ 146 "Reserved 0x5b", /* 0x5b */ 147 "Reserved 0x5c", /* 0x5c */ 148 "Reserved 0x5d", /* 0x5d */ 149 "Reserved 0x5e", /* 0x5e */ 150 "Reserved 0x5f", /* 0x5f */ 151 "Reserved 0x60", /* 0x60 */ 152 "Reserved 0x61", /* 0x61 */ 153 "Reserved 0x62", /* 0x62 */ 154 "Reserved 0x63", /* 0x63 */ 155 "Reserved 0x64", /* 0x64 */ 156 "Reserved 0x65", /* 0x65 */ 157 "Reserved 0x66", /* 0x66 */ 158 "Reserved 0x67", /* 0x67 */ 159 "Reserved 0x68", /* 0x68 */ 160 "Reserved 0x69", /* 0x69 */ 161 "Reserved 0x6a", /* 0x6a */ 162 "Reserved 0x6b", /* 0x6b */ 163 "Reserved 0x6c", /* 0x6c */ 164 "Reserved 0x6d", /* 0x6d */ 165 "Reserved 0x6e", /* 0x6e */ 166 "Reserved 0x6f", /* 0x6f */ 167 "Reserved 0x70", /* 0x70 */ 168 "Reserved 0x71", /* 0x71 */ 169 "Reserved 0x72", /* 0x72 */ 170 "Reserved 0x73", /* 0x73 */ 171 "Reserved 0x74", /* 0x74 */ 172 "Reserved 0x75", /* 0x75 */ 173 "Reserved 0x76", /* 0x76 */ 174 "Reserved 0x77", /* 0x77 */ 175 "Reserved 0x78", /* 0x78 */ 176 "Reserved 0x79", /* 0x79 */ 177 "Reserved 0x7a", /* 0x7a */ 178 "Reserved 0x7b", /* 0x7b */ 179 "Reserved 0x7c", /* 0x7c */ 180 "Reserved 0x7d", /* 0x7d */ 181 "Header Termination 1 IE", /* 0x7e */ 182 "Header Termination 2 IE" /* 0x7f */ 183}; 184 185/* Payload IE Group IDs from Table 7-15 of 802.15.4-2015 */ 186static const char *p_ie_names[] = { 187 "ESDU IE", /* 0x00 */ 188 "MLME IE", /* 0x01 */ 189 "Vendor Specific Nested IE", /* 0x02 */ 190 "Multiplexed IE (802.15.9)", /* 0x03 */ 191 "Omnibus Payload Group IE", /* 0x04 */ 192 "IETF IE", /* 0x05 */ 193 "Reserved 0x06", /* 0x06 */ 194 "Reserved 0x07", /* 0x07 */ 195 "Reserved 0x08", /* 0x08 */ 196 "Reserved 0x09", /* 0x09 */ 197 "Reserved 0x0a", /* 0x0a */ 198 "Reserved 0x0b", /* 0x0b */ 199 "Reserved 0x0c", /* 0x0c */ 200 "Reserved 0x0d", /* 0x0d */ 201 "Reserved 0x0e", /* 0x0e */ 202 "List termination" /* 0x0f */ 203}; 204 205/* Sub-ID for short format from Table 7-16 of 802.15.4-2015 */ 206static const char *p_mlme_short_names[] = { 207 "Reserved for long format 0x0", /* 0x00 */ 208 "Reserved for long format 0x1", /* 0x01 */ 209 "Reserved for long format 0x2", /* 0x02 */ 210 "Reserved for long format 0x3", /* 0x03 */ 211 "Reserved for long format 0x4", /* 0x04 */ 212 "Reserved for long format 0x5", /* 0x05 */ 213 "Reserved for long format 0x6", /* 0x06 */ 214 "Reserved for long format 0x7", /* 0x07 */ 215 "Reserved for long format 0x8", /* 0x08 */ 216 "Reserved for long format 0x9", /* 0x09 */ 217 "Reserved for long format 0xa", /* 0x0a */ 218 "Reserved for long format 0xb", /* 0x0b */ 219 "Reserved for long format 0xc", /* 0x0c */ 220 "Reserved for long format 0xd", /* 0x0d */ 221 "Reserved for long format 0xe", /* 0x0e */ 222 "Reserved for long format 0xf", /* 0x0f */ 223 "Reserved 0x10", /* 0x10 */ 224 "Reserved 0x11", /* 0x11 */ 225 "Reserved 0x12", /* 0x12 */ 226 "Reserved 0x13", /* 0x13 */ 227 "Reserved 0x14", /* 0x14 */ 228 "Reserved 0x15", /* 0x15 */ 229 "Reserved 0x16", /* 0x16 */ 230 "Reserved 0x17", /* 0x17 */ 231 "Reserved 0x18", /* 0x18 */ 232 "Reserved 0x19", /* 0x19 */ 233 "TSCH Synchronization IE", /* 0x1a */ 234 "TSCH Slotframe and Link IE", /* 0x1b */ 235 "TSCH Timeslot IE", /* 0x1c */ 236 "Hopping timing IE", /* 0x1d */ 237 "Enhanced Beacon Filter IE", /* 0x1e */ 238 "MAC Metrics IE", /* 0x1f */ 239 "All MAC Metrics IE", /* 0x20 */ 240 "Coexistence Specification IE", /* 0x21 */ 241 "SUN Device Capabilities IE", /* 0x22 */ 242 "SUN FSK Generic PHY IE", /* 0x23 */ 243 "Mode Switch Parameter IE", /* 0x24 */ 244 "PHY Parameter Change IE", /* 0x25 */ 245 "O-QPSK PHY Mode IE", /* 0x26 */ 246 "PCA Allocation IE", /* 0x27 */ 247 "LECIM DSSS Operating Mode IE", /* 0x28 */ 248 "LECIM FSK Operating Mode IE", /* 0x29 */ 249 "Reserved 0x2a", /* 0x2a */ 250 "TVWS PHY Operating Mode Description IE", /* 0x2b */ 251 "TVWS Device Capabilities IE", /* 0x2c */ 252 "TVWS Device Category IE", /* 0x2d */ 253 "TVWS Device Identiication IE", /* 0x2e */ 254 "TVWS Device Location IE", /* 0x2f */ 255 "TVWS Channel Information Query IE", /* 0x30 */ 256 "TVWS Channel Information Source IE", /* 0x31 */ 257 "CTM IE", /* 0x32 */ 258 "Timestamp IE", /* 0x33 */ 259 "Timestamp Difference IE", /* 0x34 */ 260 "TMCTP Specification IE", /* 0x35 */ 261 "RCC PHY Operating Mode IE", /* 0x36 */ 262 "Reserved 0x37", /* 0x37 */ 263 "Reserved 0x38", /* 0x38 */ 264 "Reserved 0x39", /* 0x39 */ 265 "Reserved 0x3a", /* 0x3a */ 266 "Reserved 0x3b", /* 0x3b */ 267 "Reserved 0x3c", /* 0x3c */ 268 "Reserved 0x3d", /* 0x3d */ 269 "Reserved 0x3e", /* 0x3e */ 270 "Reserved 0x3f", /* 0x3f */ 271 "Reserved 0x40", /* 0x40 */ 272 "Reserved 0x41", /* 0x41 */ 273 "Reserved 0x42", /* 0x42 */ 274 "Reserved 0x43", /* 0x43 */ 275 "Reserved 0x44", /* 0x44 */ 276 "Reserved 0x45", /* 0x45 */ 277 "Reserved 0x46", /* 0x46 */ 278 "Reserved 0x47", /* 0x47 */ 279 "Reserved 0x48", /* 0x48 */ 280 "Reserved 0x49", /* 0x49 */ 281 "Reserved 0x4a", /* 0x4a */ 282 "Reserved 0x4b", /* 0x4b */ 283 "Reserved 0x4c", /* 0x4c */ 284 "Reserved 0x4d", /* 0x4d */ 285 "Reserved 0x4e", /* 0x4e */ 286 "Reserved 0x4f", /* 0x4f */ 287 "Reserved 0x50", /* 0x50 */ 288 "Reserved 0x51", /* 0x51 */ 289 "Reserved 0x52", /* 0x52 */ 290 "Reserved 0x53", /* 0x53 */ 291 "Reserved 0x54", /* 0x54 */ 292 "Reserved 0x55", /* 0x55 */ 293 "Reserved 0x56", /* 0x56 */ 294 "Reserved 0x57", /* 0x57 */ 295 "Reserved 0x58", /* 0x58 */ 296 "Reserved 0x59", /* 0x59 */ 297 "Reserved 0x5a", /* 0x5a */ 298 "Reserved 0x5b", /* 0x5b */ 299 "Reserved 0x5c", /* 0x5c */ 300 "Reserved 0x5d", /* 0x5d */ 301 "Reserved 0x5e", /* 0x5e */ 302 "Reserved 0x5f", /* 0x5f */ 303 "Reserved 0x60", /* 0x60 */ 304 "Reserved 0x61", /* 0x61 */ 305 "Reserved 0x62", /* 0x62 */ 306 "Reserved 0x63", /* 0x63 */ 307 "Reserved 0x64", /* 0x64 */ 308 "Reserved 0x65", /* 0x65 */ 309 "Reserved 0x66", /* 0x66 */ 310 "Reserved 0x67", /* 0x67 */ 311 "Reserved 0x68", /* 0x68 */ 312 "Reserved 0x69", /* 0x69 */ 313 "Reserved 0x6a", /* 0x6a */ 314 "Reserved 0x6b", /* 0x6b */ 315 "Reserved 0x6c", /* 0x6c */ 316 "Reserved 0x6d", /* 0x6d */ 317 "Reserved 0x6e", /* 0x6e */ 318 "Reserved 0x6f", /* 0x6f */ 319 "Reserved 0x70", /* 0x70 */ 320 "Reserved 0x71", /* 0x71 */ 321 "Reserved 0x72", /* 0x72 */ 322 "Reserved 0x73", /* 0x73 */ 323 "Reserved 0x74", /* 0x74 */ 324 "Reserved 0x75", /* 0x75 */ 325 "Reserved 0x76", /* 0x76 */ 326 "Reserved 0x77", /* 0x77 */ 327 "Reserved 0x78", /* 0x78 */ 328 "Reserved 0x79", /* 0x79 */ 329 "Reserved 0x7a", /* 0x7a */ 330 "Reserved 0x7b", /* 0x7b */ 331 "Reserved 0x7c", /* 0x7c */ 332 "Reserved 0x7d", /* 0x7d */ 333 "Reserved 0x7e", /* 0x7e */ 334 "Reserved 0x7f" /* 0x7f */ 335}; 336 337/* Sub-ID for long format from Table 7-17 of 802.15.4-2015 */ 338static const char *p_mlme_long_names[] = { 339 "Reserved 0x00", /* 0x00 */ 340 "Reserved 0x01", /* 0x01 */ 341 "Reserved 0x02", /* 0x02 */ 342 "Reserved 0x03", /* 0x03 */ 343 "Reserved 0x04", /* 0x04 */ 344 "Reserved 0x05", /* 0x05 */ 345 "Reserved 0x06", /* 0x06 */ 346 "Reserved 0x07", /* 0x07 */ 347 "Vendor Specific MLME Nested IE", /* 0x08 */ 348 "Channel Hopping IE", /* 0x09 */ 349 "Reserved 0x0a", /* 0x0a */ 350 "Reserved 0x0b", /* 0x0b */ 351 "Reserved 0x0c", /* 0x0c */ 352 "Reserved 0x0d", /* 0x0d */ 353 "Reserved 0x0e", /* 0x0e */ 354 "Reserved 0x0f" /* 0x0f */ 355}; 356 357/* MAC commands from Table 7-49 of 802.15.4-2015 */ 358static const char *mac_c_names[] = { 359 "Reserved 0x00", /* 0x00 */ 360 "Association Request command", /* 0x01 */ 361 "Association Response command", /* 0x02 */ 362 "Disassociation Notification command", /* 0x03 */ 363 "Data Request command", /* 0x04 */ 364 "PAN ID Conflict Notification command", /* 0x05 */ 365 "Orphan Notification command", /* 0x06 */ 366 "Beacon Request command", /* 0x07 */ 367 "Coordinator realignment command", /* 0x08 */ 368 "GTS request command", /* 0x09 */ 369 "TRLE Management Request command", /* 0x0a */ 370 "TRLE Management Response command", /* 0x0b */ 371 "Reserved 0x0c", /* 0x0c */ 372 "Reserved 0x0d", /* 0x0d */ 373 "Reserved 0x0e", /* 0x0e */ 374 "Reserved 0x0f", /* 0x0f */ 375 "Reserved 0x10", /* 0x10 */ 376 "Reserved 0x11", /* 0x11 */ 377 "Reserved 0x12", /* 0x12 */ 378 "DSME Association Request command", /* 0x13 */ 379 "DSME Association Response command", /* 0x14 */ 380 "DSME GTS Request command", /* 0x15 */ 381 "DSME GTS Response command", /* 0x16 */ 382 "DSME GTS Notify command", /* 0x17 */ 383 "DSME Information Request command", /* 0x18 */ 384 "DSME Information Response command", /* 0x19 */ 385 "DSME Beacon Allocation Notification command", /* 0x1a */ 386 "DSME Beacon Collision Notification command", /* 0x1b */ 387 "DSME Link Report command", /* 0x1c */ 388 "Reserved 0x1d", /* 0x1d */ 389 "Reserved 0x1e", /* 0x1e */ 390 "Reserved 0x1f", /* 0x1f */ 391 "RIT Data Request command", /* 0x20 */ 392 "DBS Request command", /* 0x21 */ 393 "DBS Response command", /* 0x22 */ 394 "RIT Data Response command", /* 0x23 */ 395 "Vendor Specific command", /* 0x24 */ 396 "Reserved 0x25", /* 0x25 */ 397 "Reserved 0x26", /* 0x26 */ 398 "Reserved 0x27", /* 0x27 */ 399 "Reserved 0x28", /* 0x28 */ 400 "Reserved 0x29", /* 0x29 */ 401 "Reserved 0x2a", /* 0x2a */ 402 "Reserved 0x2b", /* 0x2b */ 403 "Reserved 0x2c", /* 0x2c */ 404 "Reserved 0x2d", /* 0x2d */ 405 "Reserved 0x2e", /* 0x2e */ 406 "Reserved 0x2f" /* 0x2f */ 407}; 408 409/* 410 * Frame Control subfields. 411 */ 412#define FC_FRAME_TYPE(fc) ((fc) & 0x7) 413#define FC_FRAME_VERSION(fc) (((fc) >> 12) & 0x3) 414 415#define FC_ADDRESSING_MODE_NONE 0x00 416#define FC_ADDRESSING_MODE_RESERVED 0x01 417#define FC_ADDRESSING_MODE_SHORT 0x02 418#define FC_ADDRESSING_MODE_LONG 0x03 419 420/* 421 * IEEE 802.15.4 CRC 16 function. This is using CCITT polynomical of 0x1021, 422 * but the initial value is 0, and the bits are reversed for both in and out. 423 * See section 7.2.10 of 802.15.4-2015 for more information. 424 */ 425static uint16_t 426ieee802_15_4_crc16(netdissect_options *ndo, const u_char *p, 427 u_int data_len) 428{ 429 uint16_t crc; 430 u_char x, y; 431 432 crc = 0x0000; /* Note, initial value is 0x0000 not 0xffff. */ 433 434 while (data_len != 0){ 435 y = GET_U_1(p); 436 p++; 437 /* Reverse bits on input */ 438 y = (((y & 0xaa) >> 1) | ((y & 0x55) << 1)); 439 y = (((y & 0xcc) >> 2) | ((y & 0x33) << 2)); 440 y = (((y & 0xf0) >> 4) | ((y & 0x0f) << 4)); 441 /* Update CRC */ 442 x = crc >> 8 ^ y; 443 x ^= x >> 4; 444 crc = ((uint16_t)(crc << 8)) ^ 445 ((uint16_t)(x << 12)) ^ 446 ((uint16_t)(x << 5)) ^ 447 ((uint16_t)x); 448 data_len--; 449 } 450 /* Reverse bits on output */ 451 crc = (((crc & 0xaaaa) >> 1) | ((crc & 0x5555) << 1)); 452 crc = (((crc & 0xcccc) >> 2) | ((crc & 0x3333) << 2)); 453 crc = (((crc & 0xf0f0) >> 4) | ((crc & 0x0f0f) << 4)); 454 crc = (((crc & 0xff00) >> 8) | ((crc & 0x00ff) << 8)); 455 return crc; 456} 457 458/* 459 * Reverses the bits of the 32-bit word. 460 */ 461static uint32_t 462ieee802_15_4_reverse32(uint32_t x) 463{ 464 x = ((x & 0x55555555) << 1) | ((x >> 1) & 0x55555555); 465 x = ((x & 0x33333333) << 2) | ((x >> 2) & 0x33333333); 466 x = ((x & 0x0F0F0F0F) << 4) | ((x >> 4) & 0x0F0F0F0F); 467 x = (x << 24) | ((x & 0xFF00) << 8) | 468 ((x >> 8) & 0xFF00) | (x >> 24); 469 return x; 470} 471 472/* 473 * IEEE 802.15.4 CRC 32 function. This is using ANSI X3.66-1979 polynomical of 474 * 0x04C11DB7, but the initial value is 0, and the bits are reversed for both 475 * in and out. See section 7.2.10 of 802.15.4-2015 for more information. 476 */ 477static uint32_t 478ieee802_15_4_crc32(netdissect_options *ndo, const u_char *p, 479 u_int data_len) 480{ 481 uint32_t crc, byte; 482 int b; 483 484 crc = 0x00000000; /* Note, initial value is 0x00000000 not 0xffffffff */ 485 486 while (data_len != 0){ 487 byte = GET_U_1(p); 488 p++; 489 /* Reverse bits on input */ 490 byte = ieee802_15_4_reverse32(byte); 491 /* Update CRC */ 492 for(b = 0; b <= 7; b++) { 493 if ((int) (crc ^ byte) < 0) 494 crc = (crc << 1) ^ 0x04C11DB7; 495 else 496 crc = crc << 1; 497 byte = byte << 1; 498 } 499 data_len--; 500 } 501 /* Reverse bits on output */ 502 crc = ieee802_15_4_reverse32(crc); 503 return crc; 504} 505 506/* 507 * Find out the address length based on the address type. See table 7-3 of 508 * 802.15.4-2015. Returns the address length. 509 */ 510static int 511ieee802_15_4_addr_len(uint16_t addr_type) 512{ 513 switch (addr_type) { 514 case FC_ADDRESSING_MODE_NONE: /* None. */ 515 return 0; 516 break; 517 case FC_ADDRESSING_MODE_RESERVED: /* Reserved, there used to be 8-bit 518 * address type in one amendment, but 519 * that and the feature using it was 520 * removed during 802.15.4-2015 521 * maintenance process. */ 522 return -1; 523 break; 524 case FC_ADDRESSING_MODE_SHORT: /* Short. */ 525 return 2; 526 break; 527 case FC_ADDRESSING_MODE_LONG: /* Extended. */ 528 return 8; 529 break; 530 } 531 return 0; 532} 533 534/* 535 * Print out the ieee 802.15.4 address. 536 */ 537static void 538ieee802_15_4_print_addr(netdissect_options *ndo, const u_char *p, 539 int dst_addr_len) 540{ 541 switch (dst_addr_len) { 542 case 0: 543 ND_PRINT("none"); 544 break; 545 case 2: 546 ND_PRINT("%04x", GET_LE_U_2(p)); 547 break; 548 case 8: 549 ND_PRINT("%s", GET_LE64ADDR_STRING(p)); 550 break; 551 } 552} 553 554/* 555 * Beacon frame superframe specification structure. Used in the old Beacon 556 * frames, and in the DSME PAN Descriptor IE. See section 7.3.1.3 of the 557 * 802.15.4-2015. 558 */ 559static void 560ieee802_15_4_print_superframe_specification(netdissect_options *ndo, 561 uint16_t ss) 562{ 563 if (ndo->ndo_vflag < 1) { 564 return; 565 } 566 ND_PRINT("\n\tBeacon order = %d, Superframe order = %d, ", 567 (ss & 0xf), ((ss >> 4) & 0xf)); 568 ND_PRINT("Final CAP Slot = %d", 569 ((ss >> 8) & 0xf)); 570 if (CHECK_BIT(ss, 12)) { ND_PRINT(", BLE enabled"); } 571 if (CHECK_BIT(ss, 14)) { ND_PRINT(", PAN Coordinator"); } 572 if (CHECK_BIT(ss, 15)) { ND_PRINT(", Association Permit"); } 573} 574 575/* 576 * Beacon frame gts info structure. Used in the old Beacon frames, and 577 * in the DSME PAN Descriptor IE. See section 7.3.1.4 of 802.15.4-2015. 578 * 579 * Returns number of byts consumed from the packet or -1 in case of error. 580 */ 581static int 582ieee802_15_4_print_gts_info(netdissect_options *ndo, 583 const u_char *p, 584 u_int data_len) 585{ 586 uint8_t gts_spec, gts_cnt; 587 u_int len; 588 int i; 589 590 gts_spec = GET_U_1(p); 591 gts_cnt = gts_spec & 0x7; 592 593 if (gts_cnt == 0) { 594 if (ndo->ndo_vflag > 0) { 595 ND_PRINT("\n\tGTS Descriptor Count = %d, ", gts_cnt); 596 } 597 return 1; 598 } 599 len = 1 + 1 + gts_cnt * 3; 600 601 if (data_len < len) { 602 ND_PRINT(" [ERROR: Truncated GTS Info List]"); 603 return -1; 604 } 605 if (ndo->ndo_vflag < 2) { 606 return len; 607 } 608 ND_PRINT("GTS Descriptor Count = %d, ", gts_cnt); 609 ND_PRINT("GTS Directions Mask = %02x, [ ", 610 GET_U_1(p + 1) & 0x7f); 611 612 for(i = 0; i < gts_cnt; i++) { 613 ND_PRINT("[ "); 614 ieee802_15_4_print_addr(ndo, p + 2 + i * 3, 2); 615 ND_PRINT(", Start slot = %d, Length = %d ] ", 616 GET_U_1(p + 2 + i * 3 + 1) & 0x0f, 617 (GET_U_1(p + 2 + i * 3 + 1) >> 4) & 0x0f); 618 } 619 ND_PRINT("]"); 620 return len; 621} 622 623/* 624 * Beacon frame pending address structure. Used in the old Beacon frames, and 625 * in the DSME PAN Descriptor IE. See section 7.3.1.5 of 802.15.4-2015. 626 * 627 * Returns number of byts consumed from the packet or -1 in case of error. 628 */ 629static int16_t 630ieee802_15_4_print_pending_addresses(netdissect_options *ndo, 631 const u_char *p, 632 u_int data_len) 633{ 634 uint8_t pas, s_cnt, e_cnt, len, i; 635 636 pas = GET_U_1(p); 637 s_cnt = pas & 0x7; 638 e_cnt = (pas >> 4) & 0x7; 639 len = 1 + s_cnt * 2 + e_cnt * 8; 640 if (ndo->ndo_vflag > 0) { 641 ND_PRINT("\n\tPending address list, " 642 "# short addresses = %d, # extended addresses = %d", 643 s_cnt, e_cnt); 644 } 645 if (data_len < len) { 646 ND_PRINT(" [ERROR: Pending address list truncated]"); 647 return -1; 648 } 649 if (ndo->ndo_vflag < 2) { 650 return len; 651 } 652 if (s_cnt != 0) { 653 ND_PRINT(", Short address list = [ "); 654 for(i = 0; i < s_cnt; i++) { 655 ieee802_15_4_print_addr(ndo, p + 1 + i * 2, 2); 656 ND_PRINT(" "); 657 } 658 ND_PRINT("]"); 659 } 660 if (e_cnt != 0) { 661 ND_PRINT(", Extended address list = [ "); 662 for(i = 0; i < e_cnt; i++) { 663 ieee802_15_4_print_addr(ndo, p + 1 + s_cnt * 2 + 664 i * 8, 8); 665 ND_PRINT(" "); 666 } 667 ND_PRINT("]"); 668 } 669 return len; 670} 671 672/* 673 * Print header ie content. 674 */ 675static void 676ieee802_15_4_print_header_ie(netdissect_options *ndo, 677 const u_char *p, 678 uint16_t ie_len, 679 int element_id) 680{ 681 int i; 682 683 switch (element_id) { 684 case 0x00: /* Vendor Specific Header IE */ 685 if (ie_len < 3) { 686 ND_PRINT("[ERROR: Vendor OUI missing]"); 687 } else { 688 ND_PRINT("OUI = 0x%02x%02x%02x, ", GET_U_1(p), 689 GET_U_1(p + 1), GET_U_1(p + 2)); 690 ND_PRINT("Data = "); 691 for(i = 3; i < ie_len; i++) { 692 ND_PRINT("%02x ", GET_U_1(p + i)); 693 } 694 } 695 break; 696 case 0x1a: /* LE CSL IE */ 697 if (ie_len < 4) { 698 ND_PRINT("[ERROR: Truncated CSL IE]"); 699 } else { 700 ND_PRINT("CSL Phase = %d, CSL Period = %d", 701 GET_LE_U_2(p), GET_LE_U_2(p + 2)); 702 if (ie_len >= 6) { 703 ND_PRINT(", Rendezvous time = %d", 704 GET_LE_U_2(p + 4)); 705 } 706 if (ie_len != 4 && ie_len != 6) { 707 ND_PRINT(" [ERROR: CSL IE length wrong]"); 708 } 709 } 710 break; 711 case 0x1b: /* LE RIT IE */ 712 if (ie_len < 4) { 713 ND_PRINT("[ERROR: Truncated RIT IE]"); 714 } else { 715 ND_PRINT("Time to First Listen = %d, # of Repeat Listen = %d, Repeat Listen Interval = %d", 716 GET_U_1(p), 717 GET_U_1(p + 1), 718 GET_LE_U_2(p + 2)); 719 } 720 break; 721 case 0x1c: /* DSME PAN Descriptor IE */ 722 /*FALLTHROUGH*/ 723 case 0x21: /* Extended DSME PAN descriptor IE */ 724 if (ie_len < 2) { 725 ND_PRINT("[ERROR: Truncated DSME PAN IE]"); 726 } else { 727 uint16_t ss, ptr, ulen; 728 int16_t len; 729 int hopping_present; 730 731 hopping_present = 0; 732 733 ss = GET_LE_U_2(p); 734 ieee802_15_4_print_superframe_specification(ndo, ss); 735 if (ie_len < 3) { 736 ND_PRINT("[ERROR: Truncated before pending addresses field]"); 737 break; 738 } 739 ptr = 2; 740 len = ieee802_15_4_print_pending_addresses(ndo, 741 p + ptr, 742 ie_len - 743 ptr); 744 if (len < 0) { 745 break; 746 } 747 ptr += len; 748 749 if (element_id == 0x21) { 750 /* Extended version. */ 751 if (ie_len < ptr + 2) { 752 ND_PRINT("[ERROR: Truncated before DSME Superframe Specification]"); 753 break; 754 } 755 ss = GET_LE_U_2(p + ptr); 756 ptr += 2; 757 ND_PRINT("Multi-superframe Order = %d", ss & 0xff); 758 ND_PRINT(", %s", ((ss & 0x100) ? 759 "Channel hopping mode" : 760 "Channel adaptation mode")); 761 if (ss & 0x400) { 762 ND_PRINT(", CAP reduction enabled"); 763 } 764 if (ss & 0x800) { 765 ND_PRINT(", Deferred beacon enabled"); 766 } 767 if (ss & 0x1000) { 768 ND_PRINT(", Hopping Sequence Present"); 769 hopping_present = 1; 770 } 771 } else { 772 if (ie_len < ptr + 1) { 773 ND_PRINT("[ERROR: Truncated before DSME Superframe Specification]"); 774 break; 775 } 776 ss = GET_U_1(p + ptr); 777 ptr++; 778 ND_PRINT("Multi-superframe Order = %d", 779 ss & 0x0f); 780 ND_PRINT(", %s", ((ss & 0x10) ? 781 "Channel hopping mode" : 782 "Channel adaptation mode")); 783 if (ss & 0x40) { 784 ND_PRINT(", CAP reduction enabled"); 785 } 786 if (ss & 0x80) { 787 ND_PRINT(", Deferred beacon enabled"); 788 } 789 } 790 if (ie_len < ptr + 8) { 791 ND_PRINT(" [ERROR: Truncated before Time synchronization specification]"); 792 break; 793 } 794 ND_PRINT("Beacon timestamp = %" PRIu64 ", offset = %d", 795 GET_LE_U_6(p + ptr), 796 GET_LE_U_2(p + ptr + 6)); 797 ptr += 8; 798 if (ie_len < ptr + 4) { 799 ND_PRINT(" [ERROR: Truncated before Beacon Bitmap]"); 800 break; 801 } 802 803 ulen = GET_LE_U_2(p + ptr + 2); 804 ND_PRINT("SD Index = %d, Bitmap len = %d, ", 805 GET_LE_U_2(p + ptr), ulen); 806 ptr += 4; 807 if (ie_len < ptr + ulen) { 808 ND_PRINT(" [ERROR: Truncated in SD bitmap]"); 809 break; 810 } 811 ND_PRINT(" SD Bitmap = "); 812 for(i = 0; i < ulen; i++) { 813 ND_PRINT("%02x ", GET_U_1(p + ptr + i)); 814 } 815 ptr += ulen; 816 817 if (ie_len < ptr + 5) { 818 ND_PRINT(" [ERROR: Truncated before Channel hopping specification]"); 819 break; 820 } 821 822 ulen = GET_LE_U_2(p + ptr + 4); 823 ND_PRINT("Hopping Seq ID = %d, PAN Coordinator BSN = %d, " 824 "Channel offset = %d, Bitmap length = %d, ", 825 GET_U_1(p + ptr), 826 GET_U_1(p + ptr + 1), 827 GET_LE_U_2(p + ptr + 2), 828 ulen); 829 ptr += 5; 830 if (ie_len < ptr + ulen) { 831 ND_PRINT(" [ERROR: Truncated in Channel offset bitmap]"); 832 break; 833 } 834 ND_PRINT(" Channel offset bitmap = "); 835 for(i = 0; i < ulen; i++) { 836 ND_PRINT("%02x ", GET_U_1(p + ptr + i)); 837 } 838 ptr += ulen; 839 if (hopping_present) { 840 if (ie_len < ptr + 1) { 841 ND_PRINT(" [ERROR: Truncated in Hopping Sequence length]"); 842 break; 843 } 844 ulen = GET_U_1(p + ptr); 845 ptr++; 846 ND_PRINT("Hopping Seq length = %d [ ", ulen); 847 848 /* The specification is not clear how the 849 hopping sequence is encoded, I assume two 850 octet unsigned integers for each channel. */ 851 852 if (ie_len < ptr + ulen * 2) { 853 ND_PRINT(" [ERROR: Truncated in Channel offset bitmap]"); 854 break; 855 } 856 for(i = 0; i < ulen; i++) { 857 ND_PRINT("%02x ", 858 GET_LE_U_2(p + ptr + i * 2)); 859 } 860 ND_PRINT("]"); 861 ptr += ulen * 2; 862 } 863 } 864 break; 865 case 0x1d: /* Rendezvous Tome IE */ 866 if (ie_len != 4) { 867 ND_PRINT("[ERROR: Length != 2]"); 868 } else { 869 uint16_t r_time, w_u_interval; 870 r_time = GET_LE_U_2(p); 871 w_u_interval = GET_LE_U_2(p + 2); 872 873 ND_PRINT("Rendezvous time = %d, Wake-up Interval = %d", 874 r_time, w_u_interval); 875 } 876 break; 877 case 0x1e: /* Time correction IE */ 878 if (ie_len != 2) { 879 ND_PRINT("[ERROR: Length != 2]"); 880 } else { 881 uint16_t val; 882 int16_t timecorr; 883 884 val = GET_LE_U_2(p); 885 if (val & 0x8000) { ND_PRINT("Negative "); } 886 val &= 0xfff; 887 val <<= 4; 888 timecorr = val; 889 timecorr >>= 4; 890 891 ND_PRINT("Ack time correction = %d, ", timecorr); 892 } 893 break; 894 case 0x22: /* Fragment Sequence Content Description IE */ 895 /* XXX Not implemented */ 896 case 0x23: /* Simplified Superframe Specification IE */ 897 /* XXX Not implemented */ 898 case 0x24: /* Simplified GTS Specification IE */ 899 /* XXX Not implemented */ 900 case 0x25: /* LECIM Capabilities IE */ 901 /* XXX Not implemented */ 902 case 0x26: /* TRLE Descriptor IE */ 903 /* XXX Not implemented */ 904 case 0x27: /* RCC Capabilities IE */ 905 /* XXX Not implemented */ 906 case 0x28: /* RCCN Descriptor IE */ 907 /* XXX Not implemented */ 908 case 0x29: /* Global Time IE */ 909 /* XXX Not implemented */ 910 case 0x2b: /* DA IE */ 911 /* XXX Not implemented */ 912 default: 913 ND_PRINT("IE Data = "); 914 for(i = 0; i < ie_len; i++) { 915 ND_PRINT("%02x ", GET_U_1(p + i)); 916 } 917 break; 918 } 919} 920 921/* 922 * Parse and print Header IE list. See 7.4.2 of 802.15.4-2015 for 923 * more information. 924 * 925 * Returns number of byts consumed from the packet or -1 in case of error. 926 */ 927static int 928ieee802_15_4_print_header_ie_list(netdissect_options *ndo, 929 const u_char *p, 930 u_int caplen, 931 int *payload_ie_present) 932{ 933 int len, ie, element_id, i; 934 uint16_t ie_len; 935 936 *payload_ie_present = 0; 937 len = 0; 938 do { 939 if (caplen < 2) { 940 ND_PRINT("[ERROR: Truncated header IE]"); 941 return -1; 942 } 943 /* Extract IE Header */ 944 ie = GET_LE_U_2(p); 945 if (CHECK_BIT(ie, 15)) { 946 ND_PRINT("[ERROR: Header IE with type 1] "); 947 } 948 /* Get length and Element ID */ 949 ie_len = ie & 0x7f; 950 element_id = (ie >> 7) & 0xff; 951 if (element_id > 127) { 952 ND_PRINT("Reserved Element ID %02x, length = %d ", 953 element_id, ie_len); 954 } else { 955 if (ie_len == 0) { 956 ND_PRINT("\n\t%s [", h_ie_names[element_id]); 957 } else { 958 ND_PRINT("\n\t%s [ length = %d, ", 959 h_ie_names[element_id], ie_len); 960 } 961 } 962 if (caplen < 2U + ie_len) { 963 ND_PRINT("[ERROR: Truncated IE data]"); 964 return -1; 965 } 966 /* Skip header */ 967 p += 2; 968 969 /* Parse and print content. */ 970 if (ndo->ndo_vflag > 3 && ie_len != 0) { 971 ieee802_15_4_print_header_ie(ndo, p, 972 ie_len, element_id); 973 } else { 974 if (ie_len != 0) { 975 ND_PRINT("IE Data = "); 976 for(i = 0; i < ie_len; i++) { 977 ND_PRINT("%02x ", GET_U_1(p + i)); 978 } 979 } 980 } 981 ND_PRINT("] "); 982 len += 2 + ie_len; 983 p += ie_len; 984 caplen -= 2 + ie_len; 985 if (element_id == 0x7e) { 986 *payload_ie_present = 1; 987 break; 988 } 989 if (element_id == 0x7f) { 990 break; 991 } 992 } while (caplen != 0); 993 return len; 994} 995 996/* 997 * Print MLME ie content. 998 */ 999static void 1000ieee802_15_4_print_mlme_ie(netdissect_options *ndo, 1001 const u_char *p, 1002 uint16_t sub_ie_len, 1003 int sub_id) 1004{ 1005 int i, j; 1006 uint16_t len; 1007 1008 /* Note, as there is no overlap with the long and short 1009 MLME sub IDs, we can just use one switch here. */ 1010 switch (sub_id) { 1011 case 0x08: /* Vendor Specific Nested IE */ 1012 if (sub_ie_len < 3) { 1013 ND_PRINT("[ERROR: Vendor OUI missing]"); 1014 } else { 1015 ND_PRINT("OUI = 0x%02x%02x%02x, ", 1016 GET_U_1(p), 1017 GET_U_1(p + 1), 1018 GET_U_1(p + 2)); 1019 ND_PRINT("Data = "); 1020 for(i = 3; i < sub_ie_len; i++) { 1021 ND_PRINT("%02x ", GET_U_1(p + i)); 1022 } 1023 } 1024 break; 1025 case 0x09: /* Channel Hopping IE */ 1026 if (sub_ie_len < 1) { 1027 ND_PRINT("[ERROR: Hopping sequence ID missing]"); 1028 } else if (sub_ie_len == 1) { 1029 ND_PRINT("Hopping Sequence ID = %d", GET_U_1(p)); 1030 p++; 1031 sub_ie_len--; 1032 } else { 1033 uint16_t channel_page, number_of_channels; 1034 1035 ND_PRINT("Hopping Sequence ID = %d", GET_U_1(p)); 1036 p++; 1037 sub_ie_len--; 1038 if (sub_ie_len < 7) { 1039 ND_PRINT("[ERROR: IE truncated]"); 1040 break; 1041 } 1042 channel_page = GET_U_1(p); 1043 number_of_channels = GET_LE_U_2(p + 1); 1044 ND_PRINT("Channel Page = %d, Number of Channels = %d, ", 1045 channel_page, number_of_channels); 1046 ND_PRINT("Phy Configuration = 0x%08x, ", 1047 GET_LE_U_4(p + 3)); 1048 p += 7; 1049 sub_ie_len -= 7; 1050 if (channel_page == 9 || channel_page == 10) { 1051 len = (number_of_channels + 7) / 8; 1052 if (sub_ie_len < len) { 1053 ND_PRINT("[ERROR: IE truncated]"); 1054 break; 1055 } 1056 ND_PRINT("Extended bitmap = 0x"); 1057 for(i = 0; i < len; i++) { 1058 ND_PRINT("%02x", GET_U_1(p + i)); 1059 } 1060 ND_PRINT(", "); 1061 p += len; 1062 sub_ie_len -= len; 1063 } 1064 if (sub_ie_len < 2) { 1065 ND_PRINT("[ERROR: IE truncated]"); 1066 break; 1067 } 1068 len = GET_LE_U_2(p); 1069 p += 2; 1070 sub_ie_len -= 2; 1071 ND_PRINT("Hopping Seq length = %d [ ", len); 1072 1073 if (sub_ie_len < len * 2) { 1074 ND_PRINT(" [ERROR: IE truncated]"); 1075 break; 1076 } 1077 for(i = 0; i < len; i++) { 1078 ND_PRINT("%02x ", GET_LE_U_2(p + i * 2)); 1079 } 1080 ND_PRINT("]"); 1081 p += len * 2; 1082 sub_ie_len -= len * 2; 1083 if (sub_ie_len < 2) { 1084 ND_PRINT("[ERROR: IE truncated]"); 1085 break; 1086 } 1087 ND_PRINT("Current hop = %d", GET_LE_U_2(p)); 1088 } 1089 1090 break; 1091 case 0x1a: /* TSCH Synchronization IE. */ 1092 if (sub_ie_len < 6) { 1093 ND_PRINT("[ERROR: Length != 6]"); 1094 } 1095 ND_PRINT("ASN = %010" PRIx64 ", Join Metric = %d ", 1096 GET_LE_U_5(p), GET_U_1(p + 5)); 1097 break; 1098 case 0x1b: /* TSCH Slotframe and Link IE. */ 1099 { 1100 int sf_num, off, links, opts; 1101 1102 if (sub_ie_len < 1) { 1103 ND_PRINT("[ERROR: Truncated IE]"); 1104 break; 1105 } 1106 sf_num = GET_U_1(p); 1107 ND_PRINT("Slotframes = %d ", sf_num); 1108 off = 1; 1109 for(i = 0; i < sf_num; i++) { 1110 if (sub_ie_len < off + 4) { 1111 ND_PRINT("[ERROR: Truncated IE before slotframes]"); 1112 break; 1113 } 1114 links = GET_U_1(p + off + 3); 1115 ND_PRINT("\n\t\t\t[ Handle %d, size = %d, links = %d ", 1116 GET_U_1(p + off), 1117 GET_LE_U_2(p + off + 1), 1118 links); 1119 off += 4; 1120 for(j = 0; j < links; j++) { 1121 if (sub_ie_len < off + 5) { 1122 ND_PRINT("[ERROR: Truncated IE links]"); 1123 break; 1124 } 1125 opts = GET_U_1(p + off + 4); 1126 ND_PRINT("\n\t\t\t\t[ Timeslot = %d, Offset = %d, Options = ", 1127 GET_LE_U_2(p + off), 1128 GET_LE_U_2(p + off + 2)); 1129 if (opts & 0x1) { ND_PRINT("TX "); } 1130 if (opts & 0x2) { ND_PRINT("RX "); } 1131 if (opts & 0x4) { ND_PRINT("Shared "); } 1132 if (opts & 0x8) { 1133 ND_PRINT("Timekeeping "); 1134 } 1135 if (opts & 0x10) { 1136 ND_PRINT("Priority "); 1137 } 1138 off += 5; 1139 ND_PRINT("] "); 1140 } 1141 ND_PRINT("] "); 1142 } 1143 } 1144 break; 1145 case 0x1c: /* TSCH Timeslot IE. */ 1146 if (sub_ie_len == 1) { 1147 ND_PRINT("Time slot ID = %d ", GET_U_1(p)); 1148 } else if (sub_ie_len == 25) { 1149 ND_PRINT("Time slot ID = %d, CCA Offset = %d, CCA = %d, TX Offset = %d, RX Offset = %d, RX Ack Delay = %d, TX Ack Delay = %d, RX Wait = %d, Ack Wait = %d, RX TX = %d, Max Ack = %d, Max TX = %d, Time slot Length = %d ", 1150 GET_U_1(p), 1151 GET_LE_U_2(p + 1), 1152 GET_LE_U_2(p + 3), 1153 GET_LE_U_2(p + 5), 1154 GET_LE_U_2(p + 7), 1155 GET_LE_U_2(p + 9), 1156 GET_LE_U_2(p + 11), 1157 GET_LE_U_2(p + 13), 1158 GET_LE_U_2(p + 15), 1159 GET_LE_U_2(p + 17), 1160 GET_LE_U_2(p + 19), 1161 GET_LE_U_2(p + 21), 1162 GET_LE_U_2(p + 23)); 1163 } else if (sub_ie_len == 27) { 1164 ND_PRINT("Time slot ID = %d, CCA Offset = %d, CCA = %d, TX Offset = %d, RX Offset = %d, RX Ack Delay = %d, TX Ack Delay = %d, RX Wait = %d, Ack Wait = %d, RX TX = %d, Max Ack = %d, Max TX = %d, Time slot Length = %d ", 1165 GET_U_1(p), 1166 GET_LE_U_2(p + 1), 1167 GET_LE_U_2(p + 3), 1168 GET_LE_U_2(p + 5), 1169 GET_LE_U_2(p + 7), 1170 GET_LE_U_2(p + 9), 1171 GET_LE_U_2(p + 11), 1172 GET_LE_U_2(p + 13), 1173 GET_LE_U_2(p + 15), 1174 GET_LE_U_2(p + 17), 1175 GET_LE_U_2(p + 19), 1176 GET_LE_U_3(p + 21), 1177 GET_LE_U_3(p + 24)); 1178 } else { 1179 ND_PRINT("[ERROR: Length not 1, 25, or 27]"); 1180 ND_PRINT("\n\t\t\tIE Data = "); 1181 for(i = 0; i < sub_ie_len; i++) { 1182 ND_PRINT("%02x ", GET_U_1(p + i)); 1183 } 1184 } 1185 break; 1186 case 0x1d: /* Hopping timing IE */ 1187 /* XXX Not implemented */ 1188 case 0x1e: /* Enhanced Beacon Filter IE */ 1189 /* XXX Not implemented */ 1190 case 0x1f: /* MAC Metrics IE */ 1191 /* XXX Not implemented */ 1192 case 0x20: /* All MAC Metrics IE */ 1193 /* XXX Not implemented */ 1194 case 0x21: /* Coexistence Specification IE */ 1195 /* XXX Not implemented */ 1196 case 0x22: /* SUN Device Capabilities IE */ 1197 /* XXX Not implemented */ 1198 case 0x23: /* SUN FSK Generic PHY IE */ 1199 /* XXX Not implemented */ 1200 case 0x24: /* Mode Switch Parameter IE */ 1201 /* XXX Not implemented */ 1202 case 0x25: /* PHY Parameter Change IE */ 1203 /* XXX Not implemented */ 1204 case 0x26: /* O-QPSK PHY Mode IE */ 1205 /* XXX Not implemented */ 1206 case 0x27: /* PCA Allocation IE */ 1207 /* XXX Not implemented */ 1208 case 0x28: /* LECIM DSSS Operating Mode IE */ 1209 /* XXX Not implemented */ 1210 case 0x29: /* LECIM FSK Operating Mode IE */ 1211 /* XXX Not implemented */ 1212 case 0x2b: /* TVWS PHY Operating Mode Description IE */ 1213 /* XXX Not implemented */ 1214 case 0x2c: /* TVWS Device Capabilities IE */ 1215 /* XXX Not implemented */ 1216 case 0x2d: /* TVWS Device Category IE */ 1217 /* XXX Not implemented */ 1218 case 0x2e: /* TVWS Device Identification IE */ 1219 /* XXX Not implemented */ 1220 case 0x2f: /* TVWS Device Location IE */ 1221 /* XXX Not implemented */ 1222 case 0x30: /* TVWS Channel Information Query IE */ 1223 /* XXX Not implemented */ 1224 case 0x31: /* TVWS Channel Information Source IE */ 1225 /* XXX Not implemented */ 1226 case 0x32: /* CTM IE */ 1227 /* XXX Not implemented */ 1228 case 0x33: /* Timestamp IE */ 1229 /* XXX Not implemented */ 1230 case 0x34: /* Timestamp Difference IE */ 1231 /* XXX Not implemented */ 1232 case 0x35: /* TMCTP Specification IE */ 1233 /* XXX Not implemented */ 1234 case 0x36: /* TCC PHY Operating Mode IE */ 1235 /* XXX Not implemented */ 1236 default: 1237 ND_PRINT("IE Data = "); 1238 for(i = 0; i < sub_ie_len; i++) { 1239 ND_PRINT("%02x ", GET_U_1(p + i)); 1240 } 1241 break; 1242 } 1243} 1244 1245/* 1246 * MLME IE list parsing and printing. See 7.4.3.2 of 802.15.4-2015 1247 * for more information. 1248 */ 1249static void 1250ieee802_15_4_print_mlme_ie_list(netdissect_options *ndo, 1251 const u_char *p, 1252 uint16_t ie_len) 1253{ 1254 int ie, sub_id, i, type; 1255 uint16_t sub_ie_len; 1256 1257 do { 1258 if (ie_len < 2) { 1259 ND_PRINT("[ERROR: Truncated MLME IE]"); 1260 return; 1261 } 1262 /* Extract IE header */ 1263 ie = GET_LE_U_2(p); 1264 type = CHECK_BIT(ie, 15); 1265 if (type) { 1266 /* Long type */ 1267 sub_ie_len = ie & 0x3ff; 1268 sub_id = (ie >> 11) & 0x0f; 1269 } else { 1270 sub_ie_len = ie & 0xff; 1271 sub_id = (ie >> 8) & 0x7f; 1272 } 1273 1274 /* Skip the IE header */ 1275 p += 2; 1276 1277 if (type == 0) { 1278 ND_PRINT("\n\t\t%s [ length = %d, ", 1279 p_mlme_short_names[sub_id], sub_ie_len); 1280 } else { 1281 ND_PRINT("\n\t\t%s [ length = %d, ", 1282 p_mlme_long_names[sub_id], sub_ie_len); 1283 } 1284 1285 if (ie_len < 2 + sub_ie_len) { 1286 ND_PRINT("[ERROR: Truncated IE data]"); 1287 return; 1288 } 1289 if (sub_ie_len != 0) { 1290 if (ndo->ndo_vflag > 3) { 1291 ieee802_15_4_print_mlme_ie(ndo, p, sub_ie_len, sub_id); 1292 } else if (ndo->ndo_vflag > 2) { 1293 ND_PRINT("IE Data = "); 1294 for(i = 0; i < sub_ie_len; i++) { 1295 ND_PRINT("%02x ", GET_U_1(p + i)); 1296 } 1297 } 1298 } 1299 ND_PRINT("] "); 1300 p += sub_ie_len; 1301 ie_len -= 2 + sub_ie_len; 1302 } while (ie_len > 0); 1303} 1304 1305/* 1306 * Multiplexd IE (802.15.9) parsing and printing. 1307 * 1308 * Returns number of bytes consumed from packet or -1 in case of error. 1309 */ 1310static void 1311ieee802_15_4_print_mpx_ie(netdissect_options *ndo, 1312 const u_char *p, 1313 uint16_t ie_len) 1314{ 1315 int transfer_type, tid; 1316 int fragment_number, data_start; 1317 int i; 1318 1319 data_start = 0; 1320 if (ie_len < 1) { 1321 ND_PRINT("[ERROR: Transaction control byte missing]"); 1322 return; 1323 } 1324 1325 transfer_type = GET_U_1(p) & 0x7; 1326 tid = GET_U_1(p) >> 3; 1327 switch (transfer_type) { 1328 case 0x00: /* Full upper layer frame. */ 1329 case 0x01: /* Full upper layer frame with small Multiplex ID. */ 1330 ND_PRINT("Type = Full upper layer fragment%s, ", 1331 (transfer_type == 0x01 ? 1332 " with small Multiplex ID" : "")); 1333 if (transfer_type == 0x00) { 1334 if (ie_len < 3) { 1335 ND_PRINT("[ERROR: Multiplex ID missing]"); 1336 return; 1337 } 1338 data_start = 3; 1339 ND_PRINT("tid = 0x%02x, Multiplex ID = 0x%04x, ", 1340 tid, GET_LE_U_2(p + 1)); 1341 } else { 1342 data_start = 1; 1343 ND_PRINT("Multiplex ID = 0x%04x, ", tid); 1344 } 1345 break; 1346 case 0x02: /* First, or middle, Fragments */ 1347 case 0x04: /* Last fragment */ 1348 if (ie_len < 2) { 1349 ND_PRINT("[ERROR: fragment number missing]"); 1350 return; 1351 } 1352 1353 fragment_number = GET_U_1(p + 1); 1354 ND_PRINT("Type = %s, tid = 0x%02x, fragment = 0x%02x, ", 1355 (transfer_type == 0x02 ? 1356 (fragment_number == 0 ? 1357 "First fragment" : "Middle fragment") : 1358 "Last fragment"), tid, 1359 fragment_number); 1360 data_start = 2; 1361 if (fragment_number == 0) { 1362 int total_size, multiplex_id; 1363 1364 if (ie_len < 6) { 1365 ND_PRINT("[ERROR: Total upper layer size or multiplex ID missing]"); 1366 return; 1367 } 1368 total_size = GET_LE_U_2(p + 2); 1369 multiplex_id = GET_LE_U_2(p + 4); 1370 ND_PRINT("Total upper layer size = 0x%04x, Multiplex ID = 0x%04x, ", 1371 total_size, multiplex_id); 1372 data_start = 6; 1373 } 1374 break; 1375 case 0x06: /* Abort code */ 1376 if (ie_len == 1) { 1377 ND_PRINT("Type = Abort, tid = 0x%02x, no max size given", 1378 tid); 1379 } else if (ie_len == 3) { 1380 ND_PRINT("Type = Abort, tid = 0x%02x, max size = 0x%04x", 1381 tid, GET_LE_U_2(p + 1)); 1382 } else { 1383 ND_PRINT("Type = Abort, tid = 0x%02x, invalid length = %d (not 1 or 3)", 1384 tid, ie_len); 1385 ND_PRINT("Abort data = "); 1386 for(i = 1; i < ie_len; i++) { 1387 ND_PRINT("%02x ", GET_U_1(p + i)); 1388 } 1389 } 1390 return; 1391 /* NOTREACHED */ 1392 break; 1393 case 0x03: /* Reserved */ 1394 case 0x05: /* Reserved */ 1395 case 0x07: /* Reserved */ 1396 ND_PRINT("Type = %d (Reserved), tid = 0x%02x, ", 1397 transfer_type, tid); 1398 data_start = 1; 1399 break; 1400 } 1401 1402 ND_PRINT("Upper layer data = "); 1403 for(i = data_start; i < ie_len; i++) { 1404 ND_PRINT("%02x ", GET_U_1(p + i)); 1405 } 1406} 1407 1408/* 1409 * Payload IE list parsing and printing. See 7.4.3 of 802.15.4-2015 1410 * for more information. 1411 * 1412 * Returns number of byts consumed from the packet or -1 in case of error. 1413 */ 1414static int 1415ieee802_15_4_print_payload_ie_list(netdissect_options *ndo, 1416 const u_char *p, 1417 u_int caplen) 1418{ 1419 int len, ie, group_id, i; 1420 uint16_t ie_len; 1421 1422 len = 0; 1423 do { 1424 if (caplen < 2) { 1425 ND_PRINT("[ERROR: Truncated header IE]"); 1426 return -1; 1427 } 1428 /* Extract IE header */ 1429 ie = GET_LE_U_2(p); 1430 if ((CHECK_BIT(ie, 15)) == 0) { 1431 ND_PRINT("[ERROR: Payload IE with type 0] "); 1432 } 1433 ie_len = ie & 0x3ff; 1434 group_id = (ie >> 11) & 0x0f; 1435 1436 /* Skip the IE header */ 1437 p += 2; 1438 if (ie_len == 0) { 1439 ND_PRINT("\n\t%s [", p_ie_names[group_id]); 1440 } else { 1441 ND_PRINT("\n\t%s [ length = %d, ", 1442 p_ie_names[group_id], ie_len); 1443 } 1444 if (caplen < 2U + ie_len) { 1445 ND_PRINT("[ERROR: Truncated IE data]"); 1446 return -1; 1447 } 1448 if (ndo->ndo_vflag > 3 && ie_len != 0) { 1449 switch (group_id) { 1450 case 0x1: /* MLME IE */ 1451 ieee802_15_4_print_mlme_ie_list(ndo, p, ie_len); 1452 break; 1453 case 0x2: /* Vendor Specific Nested IE */ 1454 if (ie_len < 3) { 1455 ND_PRINT("[ERROR: Vendor OUI missing]"); 1456 } else { 1457 ND_PRINT("OUI = 0x%02x%02x%02x, ", 1458 GET_U_1(p), 1459 GET_U_1(p + 1), 1460 GET_U_1(p + 2)); 1461 ND_PRINT("Data = "); 1462 for(i = 3; i < ie_len; i++) { 1463 ND_PRINT("%02x ", 1464 GET_U_1(p + i)); 1465 } 1466 } 1467 break; 1468 case 0x3: /* Multiplexed IE (802.15.9) */ 1469 ieee802_15_4_print_mpx_ie(ndo, p, ie_len); 1470 break; 1471 case 0x5: /* IETF IE */ 1472 if (ie_len < 1) { 1473 ND_PRINT("[ERROR: Subtype ID missing]"); 1474 } else { 1475 ND_PRINT("Subtype ID = 0x%02x, Subtype content = ", 1476 GET_U_1(p)); 1477 for(i = 1; i < ie_len; i++) { 1478 ND_PRINT("%02x ", 1479 GET_U_1(p + i)); 1480 } 1481 } 1482 break; 1483 default: 1484 ND_PRINT("IE Data = "); 1485 for(i = 0; i < ie_len; i++) { 1486 ND_PRINT("%02x ", GET_U_1(p + i)); 1487 } 1488 break; 1489 } 1490 } else { 1491 if (ie_len != 0) { 1492 ND_PRINT("IE Data = "); 1493 for(i = 0; i < ie_len; i++) { 1494 ND_PRINT("%02x ", GET_U_1(p + i)); 1495 } 1496 } 1497 } 1498 ND_PRINT("]\n\t"); 1499 len += 2 + ie_len; 1500 p += ie_len; 1501 caplen -= 2 + ie_len; 1502 if (group_id == 0xf) { 1503 break; 1504 } 1505 } while (caplen > 0); 1506 return len; 1507} 1508 1509/* 1510 * Parse and print auxiliary security header. 1511 * 1512 * Returns number of byts consumed from the packet or -1 in case of error. 1513 */ 1514static int 1515ieee802_15_4_print_aux_sec_header(netdissect_options *ndo, 1516 const u_char *p, 1517 u_int caplen, 1518 int *security_level) 1519{ 1520 int sc, key_id_mode, len; 1521 1522 if (caplen < 1) { 1523 ND_PRINT("[ERROR: Truncated before Aux Security Header]"); 1524 return -1; 1525 } 1526 sc = GET_U_1(p); 1527 len = 1; 1528 *security_level = sc & 0x7; 1529 key_id_mode = (sc >> 3) & 0x3; 1530 1531 caplen -= 1; 1532 p += 1; 1533 1534 if (ndo->ndo_vflag > 0) { 1535 ND_PRINT("\n\tSecurity Level %d, Key Id Mode %d, ", 1536 *security_level, key_id_mode); 1537 } 1538 if ((CHECK_BIT(sc, 5)) == 0) { 1539 if (caplen < 4) { 1540 ND_PRINT("[ERROR: Truncated before Frame Counter]"); 1541 return -1; 1542 } 1543 if (ndo->ndo_vflag > 1) { 1544 ND_PRINT("Frame Counter 0x%08x ", 1545 GET_LE_U_4(p)); 1546 } 1547 p += 4; 1548 caplen -= 4; 1549 len += 4; 1550 } 1551 switch (key_id_mode) { 1552 case 0x00: /* Implicit. */ 1553 if (ndo->ndo_vflag > 1) { 1554 ND_PRINT("Implicit"); 1555 } 1556 return len; 1557 break; 1558 case 0x01: /* Key Index, nothing to print here. */ 1559 break; 1560 case 0x02: /* PAN and Short address Key Source, and Key Index. */ 1561 if (caplen < 4) { 1562 ND_PRINT("[ERROR: Truncated before Key Source]"); 1563 return -1; 1564 } 1565 if (ndo->ndo_vflag > 1) { 1566 ND_PRINT("KeySource 0x%04x:%0x4x, ", 1567 GET_LE_U_2(p), GET_LE_U_2(p + 2)); 1568 } 1569 p += 4; 1570 caplen -= 4; 1571 len += 4; 1572 break; 1573 case 0x03: /* Extended address and Key Index. */ 1574 if (caplen < 8) { 1575 ND_PRINT("[ERROR: Truncated before Key Source]"); 1576 return -1; 1577 } 1578 if (ndo->ndo_vflag > 1) { 1579 ND_PRINT("KeySource %s, ", GET_LE64ADDR_STRING(p)); 1580 } 1581 p += 4; 1582 caplen -= 4; 1583 len += 4; 1584 break; 1585 } 1586 if (caplen < 1) { 1587 ND_PRINT("[ERROR: Truncated before Key Index]"); 1588 return -1; 1589 } 1590 if (ndo->ndo_vflag > 1) { 1591 ND_PRINT("KeyIndex 0x%02x, ", GET_U_1(p)); 1592 } 1593 caplen -= 1; 1594 p += 1; 1595 len += 1; 1596 return len; 1597} 1598 1599/* 1600 * Print command data. 1601 * 1602 * Returns number of byts consumed from the packet or -1 in case of error. 1603 */ 1604static int 1605ieee802_15_4_print_command_data(netdissect_options *ndo, 1606 uint8_t command_id, 1607 const u_char *p, 1608 u_int caplen) 1609{ 1610 u_int i; 1611 1612 switch (command_id) { 1613 case 0x01: /* Association Request */ 1614 if (caplen != 1) { 1615 ND_PRINT("Invalid Association request command length"); 1616 return -1; 1617 } else { 1618 uint8_t cap_info; 1619 cap_info = GET_U_1(p); 1620 ND_PRINT("%s%s%s%s%s%s", 1621 ((cap_info & 0x02) ? 1622 "FFD, " : "RFD, "), 1623 ((cap_info & 0x04) ? 1624 "AC powered, " : ""), 1625 ((cap_info & 0x08) ? 1626 "Receiver on when idle, " : ""), 1627 ((cap_info & 0x10) ? 1628 "Fast association, " : ""), 1629 ((cap_info & 0x40) ? 1630 "Security supported, " : ""), 1631 ((cap_info & 0x80) ? 1632 "Allocate address, " : "")); 1633 return caplen; 1634 } 1635 break; 1636 case 0x02: /* Association Response */ 1637 if (caplen != 3) { 1638 ND_PRINT("Invalid Association response command length"); 1639 return -1; 1640 } else { 1641 ND_PRINT("Short address = "); 1642 ieee802_15_4_print_addr(ndo, p, 2); 1643 switch (GET_U_1(p + 2)) { 1644 case 0x00: 1645 ND_PRINT(", Association successful"); 1646 break; 1647 case 0x01: 1648 ND_PRINT(", PAN at capacity"); 1649 break; 1650 case 0x02: 1651 ND_PRINT(", PAN access denied"); 1652 break; 1653 case 0x03: 1654 ND_PRINT(", Hooping sequence offset duplication"); 1655 break; 1656 case 0x80: 1657 ND_PRINT(", Fast association successful"); 1658 break; 1659 default: 1660 ND_PRINT(", Status = 0x%02x", 1661 GET_U_1(p + 2)); 1662 break; 1663 } 1664 return caplen; 1665 } 1666 break; 1667 case 0x03: /* Diassociation Notification command */ 1668 if (caplen != 1) { 1669 ND_PRINT("Invalid Disassociation Notification command length"); 1670 return -1; 1671 } else { 1672 switch (GET_U_1(p)) { 1673 case 0x00: 1674 ND_PRINT("Reserved"); 1675 break; 1676 case 0x01: 1677 ND_PRINT("Reason = The coordinator wishes the device to leave PAN"); 1678 break; 1679 case 0x02: 1680 ND_PRINT("Reason = The device wishes to leave the PAN"); 1681 break; 1682 default: 1683 ND_PRINT("Reason = 0x%02x", GET_U_1(p + 2)); 1684 break; 1685 } 1686 return caplen; 1687 } 1688 1689 /* Following ones do not have any data. */ 1690 case 0x04: /* Data Request command */ 1691 case 0x05: /* PAN ID Conflict Notification command */ 1692 case 0x06: /* Orphan Notification command */ 1693 case 0x07: /* Beacon Request command */ 1694 /* Should not have any data. */ 1695 return 0; 1696 case 0x08: /* Coordinator Realignment command */ 1697 if (caplen < 7 || caplen > 8) { 1698 ND_PRINT("Invalid Coordinator Realignment command length"); 1699 return -1; 1700 } else { 1701 uint16_t channel, page; 1702 1703 ND_PRINT("Pan ID = 0x%04x, Coordinator short address = ", 1704 GET_LE_U_2(p)); 1705 ieee802_15_4_print_addr(ndo, p + 2, 2); 1706 channel = GET_U_1(p + 4); 1707 1708 if (caplen == 8) { 1709 page = GET_U_1(p + 7); 1710 } else { 1711 page = 0x80; 1712 } 1713 if (CHECK_BIT(page, 7)) { 1714 /* No page present, instead we have msb of 1715 channel in the page. */ 1716 channel |= (page & 0x7f) << 8; 1717 ND_PRINT(", Channel Number = %d", channel); 1718 } else { 1719 ND_PRINT(", Channel Number = %d, page = %d", 1720 channel, page); 1721 } 1722 ND_PRINT(", Short address = "); 1723 ieee802_15_4_print_addr(ndo, p + 5, 2); 1724 return caplen; 1725 } 1726 break; 1727 case 0x09: /* GTS Request command */ 1728 if (caplen != 1) { 1729 ND_PRINT("Invalid GTS Request command length"); 1730 return -1; 1731 } else { 1732 uint8_t gts; 1733 1734 gts = GET_U_1(p); 1735 ND_PRINT("GTS Length = %d, %s, %s", 1736 gts & 0xf, 1737 (CHECK_BIT(gts, 4) ? 1738 "Receive-only GTS" : "Transmit-only GTS"), 1739 (CHECK_BIT(gts, 5) ? 1740 "GTS allocation" : "GTS deallocations")); 1741 return caplen; 1742 } 1743 break; 1744 case 0x13: /* DSME Association Request command */ 1745 /* XXX Not implemented */ 1746 case 0x14: /* DSME Association Response command */ 1747 /* XXX Not implemented */ 1748 case 0x15: /* DSME GTS Request command */ 1749 /* XXX Not implemented */ 1750 case 0x16: /* DSME GTS Response command */ 1751 /* XXX Not implemented */ 1752 case 0x17: /* DSME GTS Notify command */ 1753 /* XXX Not implemented */ 1754 case 0x18: /* DSME Information Request command */ 1755 /* XXX Not implemented */ 1756 case 0x19: /* DSME Information Response command */ 1757 /* XXX Not implemented */ 1758 case 0x1a: /* DSME Beacon Allocation Notification command */ 1759 /* XXX Not implemented */ 1760 case 0x1b: /* DSME Beacon Collision Notification command */ 1761 /* XXX Not implemented */ 1762 case 0x1c: /* DSME Link Report command */ 1763 /* XXX Not implemented */ 1764 case 0x20: /* RIT Data Request command */ 1765 /* XXX Not implemented */ 1766 case 0x21: /* DBS Request command */ 1767 /* XXX Not implemented */ 1768 case 0x22: /* DBS Response command */ 1769 /* XXX Not implemented */ 1770 case 0x23: /* RIT Data Response command */ 1771 /* XXX Not implemented */ 1772 case 0x24: /* Vendor Specific command */ 1773 /* XXX Not implemented */ 1774 case 0x0a: /* TRLE Management Request command */ 1775 /* XXX Not implemented */ 1776 case 0x0b: /* TRLE Management Response command */ 1777 /* XXX Not implemented */ 1778 default: 1779 ND_PRINT("Command Data = "); 1780 for(i = 0; i < caplen; i++) { 1781 ND_PRINT("%02x ", GET_U_1(p + i)); 1782 } 1783 break; 1784 } 1785 return 0; 1786} 1787 1788/* 1789 * Parse and print frames following standard format. 1790 * 1791 * Returns FALSE in case of error. 1792 */ 1793static u_int 1794ieee802_15_4_std_frames(netdissect_options *ndo, 1795 const u_char *p, u_int caplen, 1796 uint16_t fc) 1797{ 1798 int len, frame_version, pan_id_comp; 1799 int frame_type; 1800 int src_pan, dst_pan, src_addr_len, dst_addr_len; 1801 int security_level; 1802 u_int miclen = 0; 1803 int payload_ie_present; 1804 uint8_t seq; 1805 uint32_t fcs, crc_check; 1806 const u_char *mic_start = NULL; 1807 1808 payload_ie_present = 0; 1809 1810 crc_check = 0; 1811 /* Assume 2 octet FCS, the FCS length depends on the PHY, and we do not 1812 know about that. */ 1813 if (caplen < 4) { 1814 /* Cannot have FCS, assume no FCS. */ 1815 fcs = 0; 1816 } else { 1817 /* Test for 4 octet FCS. */ 1818 fcs = GET_LE_U_4(p + caplen - 4); 1819 crc_check = ieee802_15_4_crc32(ndo, p, caplen - 4); 1820 if (crc_check == fcs) { 1821 /* Remove FCS */ 1822 caplen -= 4; 1823 } else { 1824 /* Test for 2 octet FCS. */ 1825 fcs = GET_LE_U_2(p + caplen - 2); 1826 crc_check = ieee802_15_4_crc16(ndo, p, caplen - 2); 1827 if (crc_check == fcs) { 1828 /* Remove FCS */ 1829 caplen -= 2; 1830 } else { 1831 /* Wrong FCS, FCS might not be included in the 1832 captured frame, do not remove it. */ 1833 } 1834 } 1835 } 1836 1837 /* Frame version. */ 1838 frame_version = FC_FRAME_VERSION(fc); 1839 frame_type = FC_FRAME_TYPE(fc); 1840 ND_PRINT("v%d ", frame_version); 1841 1842 if (ndo->ndo_vflag > 2) { 1843 if (CHECK_BIT(fc, 3)) { ND_PRINT("Security Enabled, "); } 1844 if (CHECK_BIT(fc, 4)) { ND_PRINT("Frame Pending, "); } 1845 if (CHECK_BIT(fc, 5)) { ND_PRINT("AR, "); } 1846 if (CHECK_BIT(fc, 6)) { ND_PRINT("PAN ID Compression, "); } 1847 if (CHECK_BIT(fc, 8)) { ND_PRINT("Sequence Number Suppression, "); } 1848 if (CHECK_BIT(fc, 9)) { ND_PRINT("IE present, "); } 1849 } 1850 1851 /* Check for the sequence number suppression. */ 1852 if (CHECK_BIT(fc, 8)) { 1853 /* Sequence number is suppressed. */ 1854 if (frame_version < 2) { 1855 /* Sequence number can only be suppressed for frame 1856 version 2 or higher, this is invalid frame. */ 1857 ND_PRINT("[ERROR: Sequence number suppressed on frames where version < 2]"); 1858 } 1859 if (ndo->ndo_vflag) 1860 ND_PRINT("seq suppressed "); 1861 if (caplen < 2) { 1862 nd_print_trunc(ndo); 1863 return 0; 1864 } 1865 p += 2; 1866 caplen -= 2; 1867 } else { 1868 seq = GET_U_1(p + 2); 1869 if (ndo->ndo_vflag) 1870 ND_PRINT("seq %02x ", seq); 1871 if (caplen < 3) { 1872 nd_print_trunc(ndo); 1873 return 0; 1874 } 1875 p += 3; 1876 caplen -= 3; 1877 } 1878 1879 /* See which parts of addresses we have. */ 1880 dst_addr_len = ieee802_15_4_addr_len((fc >> 10) & 0x3); 1881 src_addr_len = ieee802_15_4_addr_len((fc >> 14) & 0x3); 1882 if (src_addr_len < 0) { 1883 ND_PRINT("[ERROR: Invalid src address mode]"); 1884 return 0; 1885 } 1886 if (dst_addr_len < 0) { 1887 ND_PRINT("[ERROR: Invalid dst address mode]"); 1888 return 0; 1889 } 1890 src_pan = 0; 1891 dst_pan = 0; 1892 pan_id_comp = CHECK_BIT(fc, 6); 1893 1894 /* The PAN ID Compression rules are complicated. */ 1895 1896 /* First check old versions, where the rules are simple. */ 1897 if (frame_version < 2) { 1898 if (pan_id_comp) { 1899 src_pan = 0; 1900 dst_pan = 1; 1901 if (dst_addr_len <= 0 || src_addr_len <= 0) { 1902 /* Invalid frame, PAN ID Compression must be 0 1903 if only one address in the frame. */ 1904 ND_PRINT("[ERROR: PAN ID Compression != 0, and only one address with frame version < 2]"); 1905 } 1906 } else { 1907 src_pan = 1; 1908 dst_pan = 1; 1909 } 1910 if (dst_addr_len <= 0) { 1911 dst_pan = 0; 1912 } 1913 if (src_addr_len <= 0) { 1914 src_pan = 0; 1915 } 1916 } else { 1917 /* Frame version 2 rules are more complicated, and they depend 1918 on the address modes of the frame, generic rules are same, 1919 but then there are some special cases. */ 1920 if (pan_id_comp) { 1921 src_pan = 0; 1922 dst_pan = 1; 1923 } else { 1924 src_pan = 1; 1925 dst_pan = 1; 1926 } 1927 if (dst_addr_len <= 0) { 1928 dst_pan = 0; 1929 } 1930 if (src_addr_len <= 0) { 1931 src_pan = 0; 1932 } 1933 if (pan_id_comp) { 1934 if (src_addr_len == 0 && 1935 dst_addr_len == 0) { 1936 /* Both addresses are missing, but PAN ID 1937 compression set, special case we have 1938 destination PAN but no addresses. */ 1939 dst_pan = 1; 1940 } else if ((src_addr_len == 0 && 1941 dst_addr_len > 0) || 1942 (src_addr_len > 0 && 1943 dst_addr_len == 0)) { 1944 /* Only one address present, and PAN ID 1945 compression is set, we do not have PAN id at 1946 all. */ 1947 dst_pan = 0; 1948 src_pan = 0; 1949 } else if (src_addr_len == 8 && 1950 dst_addr_len == 8) { 1951 /* Both addresses are Extended, and PAN ID 1952 compression set, we do not have PAN ID at 1953 all. */ 1954 dst_pan = 0; 1955 src_pan = 0; 1956 } 1957 } else { 1958 /* Special cases where PAN ID Compression is not set. */ 1959 if (src_addr_len == 8 && 1960 dst_addr_len == 8) { 1961 /* Both addresses are Extended, and PAN ID 1962 compression not set, we do have only one PAN 1963 ID (destination). */ 1964 dst_pan = 1; 1965 src_pan = 0; 1966 } 1967#ifdef BROKEN_6TISCH_PAN_ID_COMPRESSION 1968 if (src_addr_len == 8 && 1969 dst_addr_len == 2) { 1970 /* Special case for the broken 6tisch 1971 implementations. */ 1972 src_pan = 0; 1973 } 1974#endif /* BROKEN_6TISCH_PAN_ID_COMPRESSION */ 1975 } 1976 } 1977 1978 /* Print dst PAN and address. */ 1979 if (dst_pan) { 1980 if (caplen < 2) { 1981 ND_PRINT("[ERROR: Truncated before dst_pan]"); 1982 return 0; 1983 } 1984 ND_PRINT("%04x:", GET_LE_U_2(p)); 1985 p += 2; 1986 caplen -= 2; 1987 } else { 1988 ND_PRINT("-:"); 1989 } 1990 if (caplen < (u_int) dst_addr_len) { 1991 ND_PRINT("[ERROR: Truncated before dst_addr]"); 1992 return 0; 1993 } 1994 ieee802_15_4_print_addr(ndo, p, dst_addr_len); 1995 p += dst_addr_len; 1996 caplen -= dst_addr_len; 1997 1998 ND_PRINT(" < "); 1999 2000 /* Print src PAN and address. */ 2001 if (src_pan) { 2002 if (caplen < 2) { 2003 ND_PRINT("[ERROR: Truncated before dst_pan]"); 2004 return 0; 2005 } 2006 ND_PRINT("%04x:", GET_LE_U_2(p)); 2007 p += 2; 2008 caplen -= 2; 2009 } else { 2010 ND_PRINT("-:"); 2011 } 2012 if (caplen < (u_int) src_addr_len) { 2013 ND_PRINT("[ERROR: Truncated before dst_addr]"); 2014 return 0; 2015 } 2016 ieee802_15_4_print_addr(ndo, p, src_addr_len); 2017 ND_PRINT(" "); 2018 p += src_addr_len; 2019 caplen -= src_addr_len; 2020 if (CHECK_BIT(fc, 3)) { 2021 /* 2022 * XXX - if frame_version is 0, this is the 2003 2023 * spec, and you don't have the auxiliary security 2024 * header, you have a frame counter and key index 2025 * for the AES-CTR and AES-CCM security suites but 2026 * not for the AES-CBC-MAC security suite. 2027 */ 2028 len = ieee802_15_4_print_aux_sec_header(ndo, p, caplen, 2029 &security_level); 2030 if (len < 0) { 2031 return 0; 2032 } 2033 ND_TCHECK_LEN(p, len); 2034 p += len; 2035 caplen -= len; 2036 } else { 2037 security_level = 0; 2038 } 2039 2040 switch (security_level) { 2041 case 0: /*FALLTHOUGH */ 2042 case 4: 2043 miclen = 0; 2044 break; 2045 case 1: /*FALLTHOUGH */ 2046 case 5: 2047 miclen = 4; 2048 break; 2049 case 2: /*FALLTHOUGH */ 2050 case 6: 2051 miclen = 8; 2052 break; 2053 case 3: /*FALLTHOUGH */ 2054 case 7: 2055 miclen = 16; 2056 break; 2057 } 2058 2059 /* Remove MIC */ 2060 if (miclen != 0) { 2061 if (caplen < miclen) { 2062 ND_PRINT("[ERROR: Truncated before MIC]"); 2063 return 0; 2064 } 2065 caplen -= miclen; 2066 mic_start = p + caplen; 2067 } 2068 2069 /* Parse Information elements if present */ 2070 if (CHECK_BIT(fc, 9)) { 2071 /* Yes we have those. */ 2072 len = ieee802_15_4_print_header_ie_list(ndo, p, caplen, 2073 &payload_ie_present); 2074 if (len < 0) { 2075 return 0; 2076 } 2077 p += len; 2078 caplen -= len; 2079 } 2080 2081 if (payload_ie_present) { 2082 if (security_level >= 4) { 2083 ND_PRINT("Payload IEs present, but encrypted, cannot print "); 2084 } else { 2085 len = ieee802_15_4_print_payload_ie_list(ndo, p, caplen); 2086 if (len < 0) { 2087 return 0; 2088 } 2089 p += len; 2090 caplen -= len; 2091 } 2092 } 2093 2094 /* Print MIC */ 2095 if (ndo->ndo_vflag > 2 && miclen != 0) { 2096 ND_PRINT("\n\tMIC "); 2097 2098 for (u_int micoffset = 0; micoffset < miclen; micoffset++) { 2099 ND_PRINT("%02x", GET_U_1(mic_start + micoffset)); 2100 } 2101 ND_PRINT(" "); 2102 } 2103 2104 /* Print FCS */ 2105 if (ndo->ndo_vflag > 2) { 2106 if (crc_check == fcs) { 2107 ND_PRINT("FCS %x ", fcs); 2108 } else { 2109 ND_PRINT("wrong FCS %x vs %x (assume no FCS stored) ", 2110 fcs, crc_check); 2111 } 2112 } 2113 2114 /* Payload print */ 2115 switch (frame_type) { 2116 case 0x00: /* Beacon */ 2117 if (frame_version < 2) { 2118 if (caplen < 2) { 2119 ND_PRINT("[ERROR: Truncated before beacon information]"); 2120 break; 2121 } else { 2122 uint16_t ss; 2123 2124 ss = GET_LE_U_2(p); 2125 ieee802_15_4_print_superframe_specification(ndo, ss); 2126 p += 2; 2127 caplen -= 2; 2128 2129 /* GTS */ 2130 if (caplen < 1) { 2131 ND_PRINT("[ERROR: Truncated before GTS info]"); 2132 break; 2133 } 2134 2135 len = ieee802_15_4_print_gts_info(ndo, p, caplen); 2136 if (len < 0) { 2137 break; 2138 } 2139 2140 p += len; 2141 caplen -= len; 2142 2143 /* Pending Addresses */ 2144 if (caplen < 1) { 2145 ND_PRINT("[ERROR: Truncated before pending addresses]"); 2146 break; 2147 } 2148 len = ieee802_15_4_print_pending_addresses(ndo, p, caplen); 2149 if (len < 0) { 2150 break; 2151 } 2152 ND_TCHECK_LEN(p, len); 2153 p += len; 2154 caplen -= len; 2155 } 2156 } 2157 if (!ndo->ndo_suppress_default_print) 2158 ND_DEFAULTPRINT(p, caplen); 2159 2160 break; 2161 case 0x01: /* Data */ 2162 case 0x02: /* Acknowledgement */ 2163 if (!ndo->ndo_suppress_default_print) 2164 ND_DEFAULTPRINT(p, caplen); 2165 break; 2166 case 0x03: /* MAC Command */ 2167 if (caplen < 1) { 2168 ND_PRINT("[ERROR: Truncated before Command ID]"); 2169 } else { 2170 uint8_t command_id; 2171 2172 command_id = GET_U_1(p); 2173 if (command_id >= 0x30) { 2174 ND_PRINT("Command ID = Reserved 0x%02x ", 2175 command_id); 2176 } else { 2177 ND_PRINT("Command ID = %s ", 2178 mac_c_names[command_id]); 2179 } 2180 p++; 2181 caplen--; 2182 if (caplen != 0) { 2183 len = ieee802_15_4_print_command_data(ndo, command_id, p, caplen); 2184 if (len >= 0) { 2185 p += len; 2186 caplen -= len; 2187 } 2188 } 2189 } 2190 if (!ndo->ndo_suppress_default_print) 2191 ND_DEFAULTPRINT(p, caplen); 2192 break; 2193 } 2194 return 1; 2195} 2196 2197/* 2198 * Print and parse Multipurpose frames. 2199 * 2200 * Returns FALSE in case of error. 2201 */ 2202static u_int 2203ieee802_15_4_mp_frame(netdissect_options *ndo, 2204 const u_char *p, u_int caplen, 2205 uint16_t fc) 2206{ 2207 int len, frame_version, pan_id_present; 2208 int src_addr_len, dst_addr_len; 2209 int security_level; 2210 u_int miclen = 0; 2211 int ie_present, payload_ie_present, security_enabled; 2212 uint8_t seq; 2213 uint32_t fcs, crc_check; 2214 const u_char *mic_start = NULL; 2215 2216 pan_id_present = 0; 2217 ie_present = 0; 2218 payload_ie_present = 0; 2219 security_enabled = 0; 2220 crc_check = 0; 2221 2222 /* Assume 2 octet FCS, the FCS length depends on the PHY, and we do not 2223 know about that. */ 2224 if (caplen < 3) { 2225 /* Cannot have FCS, assume no FCS. */ 2226 fcs = 0; 2227 } else { 2228 if (caplen > 4) { 2229 /* Test for 4 octet FCS. */ 2230 fcs = GET_LE_U_4(p + caplen - 4); 2231 crc_check = ieee802_15_4_crc32(ndo, p, caplen - 4); 2232 if (crc_check == fcs) { 2233 /* Remove FCS */ 2234 caplen -= 4; 2235 } else { 2236 fcs = GET_LE_U_2(p + caplen - 2); 2237 crc_check = ieee802_15_4_crc16(ndo, p, caplen - 2); 2238 if (crc_check == fcs) { 2239 /* Remove FCS */ 2240 caplen -= 2; 2241 } 2242 } 2243 } else { 2244 fcs = GET_LE_U_2(p + caplen - 2); 2245 crc_check = ieee802_15_4_crc16(ndo, p, caplen - 2); 2246 if (crc_check == fcs) { 2247 /* Remove FCS */ 2248 caplen -= 2; 2249 } 2250 } 2251 } 2252 2253 if (CHECK_BIT(fc, 3)) { 2254 /* Long Frame Control */ 2255 2256 /* Frame version. */ 2257 frame_version = FC_FRAME_VERSION(fc); 2258 ND_PRINT("v%d ", frame_version); 2259 2260 pan_id_present = CHECK_BIT(fc, 8); 2261 ie_present = CHECK_BIT(fc, 15); 2262 security_enabled = CHECK_BIT(fc, 9); 2263 2264 if (ndo->ndo_vflag > 2) { 2265 if (security_enabled) { ND_PRINT("Security Enabled, "); } 2266 if (CHECK_BIT(fc, 11)) { ND_PRINT("Frame Pending, "); } 2267 if (CHECK_BIT(fc, 14)) { ND_PRINT("AR, "); } 2268 if (pan_id_present) { ND_PRINT("PAN ID Present, "); } 2269 if (CHECK_BIT(fc, 10)) { 2270 ND_PRINT("Sequence Number Suppression, "); 2271 } 2272 if (ie_present) { ND_PRINT("IE present, "); } 2273 } 2274 2275 /* Check for the sequence number suppression. */ 2276 if (CHECK_BIT(fc, 10)) { 2277 /* Sequence number is suppressed, but long version. */ 2278 if (caplen < 2) { 2279 nd_print_trunc(ndo); 2280 return 0; 2281 } 2282 p += 2; 2283 caplen -= 2; 2284 } else { 2285 seq = GET_U_1(p + 2); 2286 if (ndo->ndo_vflag) 2287 ND_PRINT("seq %02x ", seq); 2288 if (caplen < 3) { 2289 nd_print_trunc(ndo); 2290 return 0; 2291 } 2292 p += 3; 2293 caplen -= 3; 2294 } 2295 } else { 2296 /* Short format of header, but with seq no */ 2297 seq = GET_U_1(p + 1); 2298 p += 2; 2299 caplen -= 2; 2300 if (ndo->ndo_vflag) 2301 ND_PRINT("seq %02x ", seq); 2302 } 2303 2304 /* See which parts of addresses we have. */ 2305 dst_addr_len = ieee802_15_4_addr_len((fc >> 4) & 0x3); 2306 src_addr_len = ieee802_15_4_addr_len((fc >> 6) & 0x3); 2307 if (src_addr_len < 0) { 2308 ND_PRINT("[ERROR: Invalid src address mode]"); 2309 return 0; 2310 } 2311 if (dst_addr_len < 0) { 2312 ND_PRINT("[ERROR: Invalid dst address mode]"); 2313 return 0; 2314 } 2315 2316 /* Print dst PAN and address. */ 2317 if (pan_id_present) { 2318 if (caplen < 2) { 2319 ND_PRINT("[ERROR: Truncated before dst_pan]"); 2320 return 0; 2321 } 2322 ND_PRINT("%04x:", GET_LE_U_2(p)); 2323 p += 2; 2324 caplen -= 2; 2325 } else { 2326 ND_PRINT("-:"); 2327 } 2328 if (caplen < (u_int) dst_addr_len) { 2329 ND_PRINT("[ERROR: Truncated before dst_addr]"); 2330 return 0; 2331 } 2332 ieee802_15_4_print_addr(ndo, p, dst_addr_len); 2333 p += dst_addr_len; 2334 caplen -= dst_addr_len; 2335 2336 ND_PRINT(" < "); 2337 2338 /* Print src PAN and address. */ 2339 ND_PRINT(" -:"); 2340 if (caplen < (u_int) src_addr_len) { 2341 ND_PRINT("[ERROR: Truncated before dst_addr]"); 2342 return 0; 2343 } 2344 ieee802_15_4_print_addr(ndo, p, src_addr_len); 2345 ND_PRINT(" "); 2346 p += src_addr_len; 2347 caplen -= src_addr_len; 2348 2349 if (security_enabled) { 2350 len = ieee802_15_4_print_aux_sec_header(ndo, p, caplen, 2351 &security_level); 2352 if (len < 0) { 2353 return 0; 2354 } 2355 ND_TCHECK_LEN(p, len); 2356 p += len; 2357 caplen -= len; 2358 } else { 2359 security_level = 0; 2360 } 2361 2362 switch (security_level) { 2363 case 0: /*FALLTHOUGH */ 2364 case 4: 2365 miclen = 0; 2366 break; 2367 case 1: /*FALLTHOUGH */ 2368 case 5: 2369 miclen = 4; 2370 break; 2371 case 2: /*FALLTHOUGH */ 2372 case 6: 2373 miclen = 8; 2374 break; 2375 case 3: /*FALLTHOUGH */ 2376 case 7: 2377 miclen = 16; 2378 break; 2379 } 2380 2381 /* Remove MIC */ 2382 if (miclen != 0) { 2383 if (caplen < miclen) { 2384 ND_PRINT("[ERROR: Truncated before MIC]"); 2385 return 0; 2386 } 2387 caplen -= miclen; 2388 mic_start = p + caplen; 2389 } 2390 2391 /* Parse Information elements if present */ 2392 if (ie_present) { 2393 /* Yes we have those. */ 2394 len = ieee802_15_4_print_header_ie_list(ndo, p, caplen, 2395 &payload_ie_present); 2396 if (len < 0) { 2397 return 0; 2398 } 2399 p += len; 2400 caplen -= len; 2401 } 2402 2403 if (payload_ie_present) { 2404 if (security_level >= 4) { 2405 ND_PRINT("Payload IEs present, but encrypted, cannot print "); 2406 } else { 2407 len = ieee802_15_4_print_payload_ie_list(ndo, p, 2408 caplen); 2409 if (len < 0) { 2410 return 0; 2411 } 2412 p += len; 2413 caplen -= len; 2414 } 2415 } 2416 2417 /* Print MIC */ 2418 if (ndo->ndo_vflag > 2 && miclen != 0) { 2419 ND_PRINT("\n\tMIC "); 2420 2421 for (u_int micoffset = 0; micoffset < miclen; micoffset++) { 2422 ND_PRINT("%02x", GET_U_1(mic_start + micoffset)); 2423 } 2424 ND_PRINT(" "); 2425 } 2426 2427 2428 /* Print FCS */ 2429 if (ndo->ndo_vflag > 2) { 2430 if (crc_check == fcs) { 2431 ND_PRINT("FCS %x ", fcs); 2432 } else { 2433 ND_PRINT("wrong FCS %x vs %x (assume no FCS stored) ", 2434 fcs, crc_check); 2435 } 2436 } 2437 2438 if (!ndo->ndo_suppress_default_print) 2439 ND_DEFAULTPRINT(p, caplen); 2440 2441 return 1; 2442} 2443 2444/* 2445 * Print frag frame. 2446 * 2447 * Returns FALSE in case of error. 2448 */ 2449static u_int 2450ieee802_15_4_frag_frame(netdissect_options *ndo _U_, 2451 const u_char *p _U_, 2452 u_int caplen _U_, 2453 uint16_t fc _U_) 2454{ 2455 /* Not implement yet, might be bit hard to implement, as the 2456 * information to set up the fragment is coming in the previous frame 2457 * in the Fragment Sequence Context Description IE, thus we need to 2458 * store information from there, so we can use it here. */ 2459 return 0; 2460} 2461 2462/* 2463 * Internal call to dissector taking packet + len instead of pcap_pkthdr. 2464 * 2465 * Returns FALSE in case of error. 2466 */ 2467u_int 2468ieee802_15_4_print(netdissect_options *ndo, 2469 const u_char *p, u_int caplen) 2470{ 2471 int frame_type; 2472 uint16_t fc; 2473 2474 ndo->ndo_protocol = "802.15.4"; 2475 2476 if (caplen < 2) { 2477 nd_print_trunc(ndo); 2478 return caplen; 2479 } 2480 2481 fc = GET_LE_U_2(p); 2482 2483 /* First we need to check the frame type to know how to parse the rest 2484 of the FC. Frame type is the first 3 bit of the frame control field. 2485 */ 2486 2487 frame_type = FC_FRAME_TYPE(fc); 2488 ND_PRINT("IEEE 802.15.4 %s packet ", ftypes[frame_type]); 2489 2490 switch (frame_type) { 2491 case 0x00: /* Beacon */ 2492 case 0x01: /* Data */ 2493 case 0x02: /* Acknowledgement */ 2494 case 0x03: /* MAC Command */ 2495 return ieee802_15_4_std_frames(ndo, p, caplen, fc); 2496 break; 2497 case 0x04: /* Reserved */ 2498 return 0; 2499 break; 2500 case 0x05: /* Multipurpose */ 2501 return ieee802_15_4_mp_frame(ndo, p, caplen, fc); 2502 break; 2503 case 0x06: /* Fragment or Frak */ 2504 return ieee802_15_4_frag_frame(ndo, p, caplen, fc); 2505 break; 2506 case 0x07: /* Extended */ 2507 return 0; 2508 break; 2509 } 2510 return 0; 2511} 2512 2513/* 2514 * Main function to print packets. 2515 */ 2516 2517void 2518ieee802_15_4_if_print(netdissect_options *ndo, 2519 const struct pcap_pkthdr *h, const u_char *p) 2520{ 2521 u_int caplen = h->caplen; 2522 ndo->ndo_protocol = "802.15.4"; 2523 ndo->ndo_ll_hdr_len += ieee802_15_4_print(ndo, p, caplen); 2524} 2525 2526/* For DLT_IEEE802_15_4_TAP */ 2527/* https://github.com/jkcko/ieee802.15.4-tap */ 2528void 2529ieee802_15_4_tap_if_print(netdissect_options *ndo, 2530 const struct pcap_pkthdr *h, const u_char *p) 2531{ 2532 uint8_t version; 2533 uint16_t length; 2534 2535 ndo->ndo_protocol = "802.15.4_tap"; 2536 if (h->caplen < 4) { 2537 nd_print_trunc(ndo); 2538 ndo->ndo_ll_hdr_len += h->caplen; 2539 return; 2540 } 2541 2542 version = GET_U_1(p); 2543 length = GET_LE_U_2(p + 2); 2544 if (version != 0 || length < 4) { 2545 nd_print_invalid(ndo); 2546 return; 2547 } 2548 2549 if (h->caplen < length) { 2550 nd_print_trunc(ndo); 2551 ndo->ndo_ll_hdr_len += h->caplen; 2552 return; 2553 } 2554 2555 ndo->ndo_ll_hdr_len += ieee802_15_4_print(ndo, p+length, h->caplen-length) + length; 2556} 2557