]> The Tcpdump Group git mirrors - tcpdump/blob - print-802_15_4.c
projects / tcpdump / blob
summary | shortlog | log | commit | commitdiff | tree
history | raw | HEAD
Clean up whitespaces
[tcpdump] / print-802_15_4.c
1 /*
2 * Copyright (c) 2009
3 * Siemens AG, All rights reserved.
4 * Dmitry Eremin-Solenikov (dbaryshkov@gmail.com)
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that: (1) source code distributions
8 * retain the above copyright notice and this paragraph in its entirety, (2)
9 * distributions including binary code include the above copyright notice and
10 * this paragraph in its entirety in the documentation or other materials
11 * provided with the distribution, and (3) all advertising materials mentioning
12 * features or use of this software display the following acknowledgement:
13 * ``This product includes software developed by the University of California,
14 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
15 * the University nor the names of its contributors may be used to endorse
16 * or promote products derived from this software without specific prior
17 * written permission.
18 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
19 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
20 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
21 */
22
23 /* \summary: IEEE 802.15.4 printer */
24
25 #ifdef HAVE_CONFIG_H
26 #include <config.h>
27 #endif
28
29 #include <netdissect-stdinc.h>
30
31 #include "netdissect.h"
32 #include "addrtoname.h"
33
34 #include "extract.h"
35
36 #define CHECK_BIT(num,bit) (((num) >> (bit)) & 0x1)
37
38 #define BROKEN_6TISCH_PAN_ID_COMPRESSION 0
39
40 /* Frame types from Table 7-1 of 802.15.4-2015 */
41 static const char *ftypes[] = {
42 "Beacon", /* 0 */
43 "Data", /* 1 */
44 "ACK", /* 2 */
45 "Command", /* 3 */
46 "Reserved", /* 4 */
47 "Multipurpose", /* 5 */
48 "Fragment", /* 6 */
49 "Extended" /* 7 */
50 };
51
52 /* Element IDs for Header IEs from Table 7-7 of 802.15.4-2015 */
53 static const char *h_ie_names[] = {
54 "Vendor Specific Header IE", /* 0x00 */
55 "Reserved 0x01", /* 0x01 */
56 "Reserved 0x02", /* 0x02 */
57 "Reserved 0x03", /* 0x03 */
58 "Reserved 0x04", /* 0x04 */
59 "Reserved 0x05", /* 0x05 */
60 "Reserved 0x06", /* 0x06 */
61 "Reserved 0x07", /* 0x07 */
62 "Reserved 0x08", /* 0x08 */
63 "Reserved 0x09", /* 0x09 */
64 "Reserved 0x0a", /* 0x0a */
65 "Reserved 0x0b", /* 0x0b */
66 "Reserved 0x0c", /* 0x0c */
67 "Reserved 0x0d", /* 0x0d */
68 "Reserved 0x0e", /* 0x0e */
69 "Reserved 0x0f", /* 0x0f */
70 "Reserved 0x10", /* 0x10 */
71 "Reserved 0x11", /* 0x11 */
72 "Reserved 0x12", /* 0x12 */
73 "Reserved 0x13", /* 0x13 */
74 "Reserved 0x14", /* 0x14 */
75 "Reserved 0x15", /* 0x15 */
76 "Reserved 0x16", /* 0x16 */
77 "Reserved 0x17", /* 0x17 */
78 "Reserved 0x18", /* 0x18 */
79 "Reserved 0x19", /* 0x19 */
80 "LE CSL IE", /* 0x1a */
81 "LE RIT IE", /* 0x1b */
82 "DSME PAN descriptor IE", /* 0x1c */
83 "Rendezvous Time IE", /* 0x1d */
84 "Time Correction IE", /* 0x1e */
85 "Reserved 0x1f", /* 0x1f */
86 "Reserved 0x20", /* 0x20 */
87 "Extended DSME PAN descriptor IE", /* 0x21 */
88 "Fragment Sequence Context Description IE", /* 0x22 */
89 "Simplified Superframe Specification IE", /* 0x23 */
90 "Simplified GTS Specification IE", /* 0x24 */
91 "LECIM Capabilities IE", /* 0x25 */
92 "TRLE Descriptor IE", /* 0x26 */
93 "RCC Capabilities IE", /* 0x27 */
94 "RCCN Descriptor IE", /* 0x28 */
95 "Global Time IE", /* 0x29 */
96 "Omnibus Header IE", /* 0x2a */
97 "DA IE", /* 0x2b */
98 "Reserved 0x2c", /* 0x2c */
99 "Reserved 0x2d", /* 0x2d */
100 "Reserved 0x2e", /* 0x2e */
101 "Reserved 0x2f", /* 0x2f */
102 "Reserved 0x30", /* 0x30 */
103 "Reserved 0x31", /* 0x31 */
104 "Reserved 0x32", /* 0x32 */
105 "Reserved 0x33", /* 0x33 */
106 "Reserved 0x34", /* 0x34 */
107 "Reserved 0x35", /* 0x35 */
108 "Reserved 0x36", /* 0x36 */
109 "Reserved 0x37", /* 0x37 */
110 "Reserved 0x38", /* 0x38 */
111 "Reserved 0x39", /* 0x39 */
112 "Reserved 0x3a", /* 0x3a */
113 "Reserved 0x3b", /* 0x3b */
114 "Reserved 0x3c", /* 0x3c */
115 "Reserved 0x3d", /* 0x3d */
116 "Reserved 0x3e", /* 0x3e */
117 "Reserved 0x3f", /* 0x3f */
118 "Reserved 0x40", /* 0x40 */
119 "Reserved 0x41", /* 0x41 */
120 "Reserved 0x42", /* 0x42 */
121 "Reserved 0x43", /* 0x43 */
122 "Reserved 0x44", /* 0x44 */
123 "Reserved 0x45", /* 0x45 */
124 "Reserved 0x46", /* 0x46 */
125 "Reserved 0x47", /* 0x47 */
126 "Reserved 0x48", /* 0x48 */
127 "Reserved 0x49", /* 0x49 */
128 "Reserved 0x4a", /* 0x4a */
129 "Reserved 0x4b", /* 0x4b */
130 "Reserved 0x4c", /* 0x4c */
131 "Reserved 0x4d", /* 0x4d */
132 "Reserved 0x4e", /* 0x4e */
133 "Reserved 0x4f", /* 0x4f */
134 "Reserved 0x50", /* 0x50 */
135 "Reserved 0x51", /* 0x51 */
136 "Reserved 0x52", /* 0x52 */
137 "Reserved 0x53", /* 0x53 */
138 "Reserved 0x54", /* 0x54 */
139 "Reserved 0x55", /* 0x55 */
140 "Reserved 0x56", /* 0x56 */
141 "Reserved 0x57", /* 0x57 */
142 "Reserved 0x58", /* 0x58 */
143 "Reserved 0x59", /* 0x59 */
144 "Reserved 0x5a", /* 0x5a */
145 "Reserved 0x5b", /* 0x5b */
146 "Reserved 0x5c", /* 0x5c */
147 "Reserved 0x5d", /* 0x5d */
148 "Reserved 0x5e", /* 0x5e */
149 "Reserved 0x5f", /* 0x5f */
150 "Reserved 0x60", /* 0x60 */
151 "Reserved 0x61", /* 0x61 */
152 "Reserved 0x62", /* 0x62 */
153 "Reserved 0x63", /* 0x63 */
154 "Reserved 0x64", /* 0x64 */
155 "Reserved 0x65", /* 0x65 */
156 "Reserved 0x66", /* 0x66 */
157 "Reserved 0x67", /* 0x67 */
158 "Reserved 0x68", /* 0x68 */
159 "Reserved 0x69", /* 0x69 */
160 "Reserved 0x6a", /* 0x6a */
161 "Reserved 0x6b", /* 0x6b */
162 "Reserved 0x6c", /* 0x6c */
163 "Reserved 0x6d", /* 0x6d */
164 "Reserved 0x6e", /* 0x6e */
165 "Reserved 0x6f", /* 0x6f */
166 "Reserved 0x70", /* 0x70 */
167 "Reserved 0x71", /* 0x71 */
168 "Reserved 0x72", /* 0x72 */
169 "Reserved 0x73", /* 0x73 */
170 "Reserved 0x74", /* 0x74 */
171 "Reserved 0x75", /* 0x75 */
172 "Reserved 0x76", /* 0x76 */
173 "Reserved 0x77", /* 0x77 */
174 "Reserved 0x78", /* 0x78 */
175 "Reserved 0x79", /* 0x79 */
176 "Reserved 0x7a", /* 0x7a */
177 "Reserved 0x7b", /* 0x7b */
178 "Reserved 0x7c", /* 0x7c */
179 "Reserved 0x7d", /* 0x7d */
180 "Header Termination 1 IE", /* 0x7e */
181 "Header Termination 2 IE" /* 0x7f */
182 };
183
184 /* Payload IE Group IDs from Table 7-15 of 802.15.4-2015 */
185 static const char *p_ie_names[] = {
186 "ESDU IE", /* 0x00 */
187 "MLME IE", /* 0x01 */
188 "Vendor Specific Nested IE", /* 0x02 */
189 "Multiplexed IE (802.15.9)", /* 0x03 */
190 "Omnibus Payload Group IE", /* 0x04 */
191 "IETF IE", /* 0x05 */
192 "Reserved 0x06", /* 0x06 */
193 "Reserved 0x07", /* 0x07 */
194 "Reserved 0x08", /* 0x08 */
195 "Reserved 0x09", /* 0x09 */
196 "Reserved 0x0a", /* 0x0a */
197 "Reserved 0x0b", /* 0x0b */
198 "Reserved 0x0c", /* 0x0c */
199 "Reserved 0x0d", /* 0x0d */
200 "Reserved 0x0e", /* 0x0e */
201 "List termination" /* 0x0f */
202 };
203
204 /* Sub-ID for short format from Table 7-16 of 802.15.4-2015 */
205 static const char *p_mlme_short_names[] = {
206 "Reserved for long format 0x0", /* 0x00 */
207 "Reserved for long format 0x1", /* 0x01 */
208 "Reserved for long format 0x2", /* 0x02 */
209 "Reserved for long format 0x3", /* 0x03 */
210 "Reserved for long format 0x4", /* 0x04 */
211 "Reserved for long format 0x5", /* 0x05 */
212 "Reserved for long format 0x6", /* 0x06 */
213 "Reserved for long format 0x7", /* 0x07 */
214 "Reserved for long format 0x8", /* 0x08 */
215 "Reserved for long format 0x9", /* 0x09 */
216 "Reserved for long format 0xa", /* 0x0a */
217 "Reserved for long format 0xb", /* 0x0b */
218 "Reserved for long format 0xc", /* 0x0c */
219 "Reserved for long format 0xd", /* 0x0d */
220 "Reserved for long format 0xe", /* 0x0e */
221 "Reserved for long format 0xf", /* 0x0f */
222 "Reserved 0x10", /* 0x10 */
223 "Reserved 0x11", /* 0x11 */
224 "Reserved 0x12", /* 0x12 */
225 "Reserved 0x13", /* 0x13 */
226 "Reserved 0x14", /* 0x14 */
227 "Reserved 0x15", /* 0x15 */
228 "Reserved 0x16", /* 0x16 */
229 "Reserved 0x17", /* 0x17 */
230 "Reserved 0x18", /* 0x18 */
231 "Reserved 0x19", /* 0x19 */
232 "TSCH Synchronization IE", /* 0x1a */
233 "TSCH Slotframe and Link IE", /* 0x1b */
234 "TSCH Timeslot IE", /* 0x1c */
235 "Hopping timing IE", /* 0x1d */
236 "Enhanced Beacon Filter IE", /* 0x1e */
237 "MAC Metrics IE", /* 0x1f */
238 "All MAC Metrics IE", /* 0x20 */
239 "Coexistence Specification IE", /* 0x21 */
240 "SUN Device Capabilities IE", /* 0x22 */
241 "SUN FSK Generic PHY IE", /* 0x23 */
242 "Mode Switch Parameter IE", /* 0x24 */
243 "PHY Parameter Change IE", /* 0x25 */
244 "O-QPSK PHY Mode IE", /* 0x26 */
245 "PCA Allocation IE", /* 0x27 */
246 "LECIM DSSS Operating Mode IE", /* 0x28 */
247 "LECIM FSK Operating Mode IE", /* 0x29 */
248 "Reserved 0x2a", /* 0x2a */
249 "TVWS PHY Operating Mode Description IE", /* 0x2b */
250 "TVWS Device Capabilities IE", /* 0x2c */
251 "TVWS Device Category IE", /* 0x2d */
252 "TVWS Device Identiication IE", /* 0x2e */
253 "TVWS Device Location IE", /* 0x2f */
254 "TVWS Channel Information Query IE", /* 0x30 */
255 "TVWS Channel Information Source IE", /* 0x31 */
256 "CTM IE", /* 0x32 */
257 "Timestamp IE", /* 0x33 */
258 "Timestamp Difference IE", /* 0x34 */
259 "TMCTP Sepcification IE", /* 0x35 */
260 "RCC PHY Operating Mode IE", /* 0x36 */
261 "Reserved 0x37", /* 0x37 */
262 "Reserved 0x38", /* 0x38 */
263 "Reserved 0x39", /* 0x39 */
264 "Reserved 0x3a", /* 0x3a */
265 "Reserved 0x3b", /* 0x3b */
266 "Reserved 0x3c", /* 0x3c */
267 "Reserved 0x3d", /* 0x3d */
268 "Reserved 0x3e", /* 0x3e */
269 "Reserved 0x3f", /* 0x3f */
270 "Reserved 0x40", /* 0x40 */
271 "Reserved 0x41", /* 0x41 */
272 "Reserved 0x42", /* 0x42 */
273 "Reserved 0x43", /* 0x43 */
274 "Reserved 0x44", /* 0x44 */
275 "Reserved 0x45", /* 0x45 */
276 "Reserved 0x46", /* 0x46 */
277 "Reserved 0x47", /* 0x47 */
278 "Reserved 0x48", /* 0x48 */
279 "Reserved 0x49", /* 0x49 */
280 "Reserved 0x4a", /* 0x4a */
281 "Reserved 0x4b", /* 0x4b */
282 "Reserved 0x4c", /* 0x4c */
283 "Reserved 0x4d", /* 0x4d */
284 "Reserved 0x4e", /* 0x4e */
285 "Reserved 0x4f", /* 0x4f */
286 "Reserved 0x50", /* 0x50 */
287 "Reserved 0x51", /* 0x51 */
288 "Reserved 0x52", /* 0x52 */
289 "Reserved 0x53", /* 0x53 */
290 "Reserved 0x54", /* 0x54 */
291 "Reserved 0x55", /* 0x55 */
292 "Reserved 0x56", /* 0x56 */
293 "Reserved 0x57", /* 0x57 */
294 "Reserved 0x58", /* 0x58 */
295 "Reserved 0x59", /* 0x59 */
296 "Reserved 0x5a", /* 0x5a */
297 "Reserved 0x5b", /* 0x5b */
298 "Reserved 0x5c", /* 0x5c */
299 "Reserved 0x5d", /* 0x5d */
300 "Reserved 0x5e", /* 0x5e */
301 "Reserved 0x5f", /* 0x5f */
302 "Reserved 0x60", /* 0x60 */
303 "Reserved 0x61", /* 0x61 */
304 "Reserved 0x62", /* 0x62 */
305 "Reserved 0x63", /* 0x63 */
306 "Reserved 0x64", /* 0x64 */
307 "Reserved 0x65", /* 0x65 */
308 "Reserved 0x66", /* 0x66 */
309 "Reserved 0x67", /* 0x67 */
310 "Reserved 0x68", /* 0x68 */
311 "Reserved 0x69", /* 0x69 */
312 "Reserved 0x6a", /* 0x6a */
313 "Reserved 0x6b", /* 0x6b */
314 "Reserved 0x6c", /* 0x6c */
315 "Reserved 0x6d", /* 0x6d */
316 "Reserved 0x6e", /* 0x6e */
317 "Reserved 0x6f", /* 0x6f */
318 "Reserved 0x70", /* 0x70 */
319 "Reserved 0x71", /* 0x71 */
320 "Reserved 0x72", /* 0x72 */
321 "Reserved 0x73", /* 0x73 */
322 "Reserved 0x74", /* 0x74 */
323 "Reserved 0x75", /* 0x75 */
324 "Reserved 0x76", /* 0x76 */
325 "Reserved 0x77", /* 0x77 */
326 "Reserved 0x78", /* 0x78 */
327 "Reserved 0x79", /* 0x79 */
328 "Reserved 0x7a", /* 0x7a */
329 "Reserved 0x7b", /* 0x7b */
330 "Reserved 0x7c", /* 0x7c */
331 "Reserved 0x7d", /* 0x7d */
332 "Reserved 0x7e", /* 0x7e */
333 "Reserved 0x7f" /* 0x7f */
334 };
335
336 /* Sub-ID for long format from Table 7-17 of 802.15.4-2015 */
337 static const char *p_mlme_long_names[] = {
338 "Reserved 0x00", /* 0x00 */
339 "Reserved 0x01", /* 0x01 */
340 "Reserved 0x02", /* 0x02 */
341 "Reserved 0x03", /* 0x03 */
342 "Reserved 0x04", /* 0x04 */
343 "Reserved 0x05", /* 0x05 */
344 "Reserved 0x06", /* 0x06 */
345 "Reserved 0x07", /* 0x07 */
346 "Vendor Specific MLME Nested IE", /* 0x08 */
347 "Channel Hopping IE", /* 0x09 */
348 "Reserved 0x0a", /* 0x0a */
349 "Reserved 0x0b", /* 0x0b */
350 "Reserved 0x0c", /* 0x0c */
351 "Reserved 0x0d", /* 0x0d */
352 "Reserved 0x0e", /* 0x0e */
353 "Reserved 0x0f" /* 0x0f */
354 };
355
356 /* MAC commands from Table 7-49 of 802.15.4-2015 */
357 static const char *mac_c_names[] = {
358 "Reserved 0x00", /* 0x00 */
359 "Association Request command", /* 0x01 */
360 "Association Response command", /* 0x02 */
361 "Disassociation Notification command", /* 0x03 */
362 "Data Request command", /* 0x04 */
363 "PAN ID Conflict Notification command", /* 0x05 */
364 "Orphan Notification command", /* 0x06 */
365 "Beacon Request command", /* 0x07 */
366 "Coordinator realignment command", /* 0x08 */
367 "GTS request command", /* 0x09 */
368 "TRLE Management Request command", /* 0x0a */
369 "TRLE Management Response command", /* 0x0b */
370 "Reserved 0x0c", /* 0x0c */
371 "Reserved 0x0d", /* 0x0d */
372 "Reserved 0x0e", /* 0x0e */
373 "Reserved 0x0f", /* 0x0f */
374 "Reserved 0x10", /* 0x10 */
375 "Reserved 0x11", /* 0x11 */
376 "Reserved 0x12", /* 0x12 */
377 "DSME Association Request command", /* 0x13 */
378 "DSME Association Response command", /* 0x14 */
379 "DSME GTS Request command", /* 0x15 */
380 "DSME GTS Response command", /* 0x16 */
381 "DSME GTS Notify command", /* 0x17 */
382 "DSME Information Request command", /* 0x18 */
383 "DSME Information Response command", /* 0x19 */
384 "DSME Beacon Allocation Notification command", /* 0x1a */
385 "DSME Beacon Collision Notification command", /* 0x1b */
386 "DSME Link Report command", /* 0x1c */
387 "Reserved 0x1d", /* 0x1d */
388 "Reserved 0x1e", /* 0x1e */
389 "Reserved 0x1f", /* 0x1f */
390 "RIT Data Request command", /* 0x20 */
391 "DBS Request command", /* 0x21 */
392 "DBS Response command", /* 0x22 */
393 "RIT Data Response command", /* 0x23 */
394 "Vendor Specific command", /* 0x24 */
395 "Reserved 0x25", /* 0x25 */
396 "Reserved 0x26", /* 0x26 */
397 "Reserved 0x27", /* 0x27 */
398 "Reserved 0x28", /* 0x28 */
399 "Reserved 0x29", /* 0x29 */
400 "Reserved 0x2a", /* 0x2a */
401 "Reserved 0x2b", /* 0x2b */
402 "Reserved 0x2c", /* 0x2c */
403 "Reserved 0x2d", /* 0x2d */
404 "Reserved 0x2e", /* 0x2e */
405 "Reserved 0x2f" /* 0x2f */
406 };
407
408 /*
409 * Frame Control subfields.
410 */
411 #define FC_FRAME_TYPE(fc) ((fc) & 0x7)
412 #define FC_FRAME_VERSION(fc) (((fc) >> 12) & 0x3)
413
414 #define FC_ADDRESSING_MODE_NONE 0x00
415 #define FC_ADDRESSING_MODE_RESERVED 0x01
416 #define FC_ADDRESSING_MODE_SHORT 0x02
417 #define FC_ADDRESSING_MODE_LONG 0x03
418
419 /*
420 * IEEE 802.15.4 CRC 16 function. This is using CCITT polynomical of 0x1021,
421 * but the initial value is 0, and the bits are reversed for both in and out.
422 * See secton 7.2.10 of 802.15.4-2015 for more information.
423 */
424 static uint16_t
425 ieee802_15_4_crc16(const u_char *p,
426 u_int data_len)
427 {
428 uint16_t crc;
429 u_char x, y;
430
431 crc = 0x0000; /* Note, initial value is 0x0000 not 0xffff. */
432
433 while (data_len != 0){
434 y = *p++;
435 /* Reverse bits on input */
436 y = (((y & 0xaa) >> 1) | ((y & 0x55) << 1));
437 y = (((y & 0xcc) >> 2) | ((y & 0x33) << 2));
438 y = (((y & 0xf0) >> 4) | ((y & 0x0f) << 4));
439 /* Update CRC */
440 x = crc >> 8 ^ y;
441 x ^= x >> 4;
442 crc = (crc << 8) ^
443 ((unsigned short)(x << 12)) ^
444 ((unsigned short)(x <<5)) ^
445 ((unsigned short)x);
446 data_len--;
447 }
448 /* Reverse bits on output */
449 crc = (((crc & 0xaaaa) >> 1) | ((crc & 0x5555) << 1));
450 crc = (((crc & 0xcccc) >> 2) | ((crc & 0x3333) << 2));
451 crc = (((crc & 0xf0f0) >> 4) | ((crc & 0x0f0f) << 4));
452 crc = (((crc & 0xff00) >> 8) | ((crc & 0x00ff) << 8));
453 return crc;
454 }
455
456 /*
457 * Reverses the bits of the 32-bit word.
458 */
459 static uint32_t
460 ieee802_15_4_reverse32(uint32_t x)
461 {
462 x = ((x & 0x55555555) << 1) | ((x >> 1) & 0x55555555);
463 x = ((x & 0x33333333) << 2) | ((x >> 2) & 0x33333333);
464 x = ((x & 0x0F0F0F0F) << 4) | ((x >> 4) & 0x0F0F0F0F);
465 x = (x << 24) | ((x & 0xFF00) << 8) |
466 ((x >> 8) & 0xFF00) | (x >> 24);
467 return x;
468 }
469
470 /*
471 * IEEE 802.15.4 CRC 32 function. This is using ANSI X3.66-1979 polynomical of
472 * 0x04C11DB7, but the initial value is 0, and the bits are reversed for both
473 * in and out. See secton 7.2.10 of 802.15.4-2015 for more information.
474 */
475 static uint32_t
476 ieee802_15_4_crc32(const u_char *p,
477 u_int data_len)
478 {
479 uint32_t crc, byte;
480 int b;
481
482 crc = 0x00000000; /* Note, initial value is 0x00000000 not 0xffffffff */
483
484 while (data_len != 0){
485 byte = *p++;
486 /* Reverse bits on input */
487 byte = ieee802_15_4_reverse32(byte);
488 /* Update CRC */
489 for(b = 0; b <= 7; b++) {
490 if ((int) (crc ^ byte) < 0)
491 crc = (crc << 1) ^ 0x04C11DB7;
492 else
493 crc = crc << 1;
494 byte = byte << 1;
495 }
496 data_len--;
497 }
498 /* Reverse bits on output */
499 crc = ieee802_15_4_reverse32(crc);
500 return crc;
501 }
502
503 /*
504 * Find out the address length based on the address type. See table 7-3 of
505 * 802.15.4-2015. Returns the address length.
506 */
507 static int
508 ieee802_15_4_addr_len(uint16_t addr_type)
509 {
510 switch (addr_type) {
511 case FC_ADDRESSING_MODE_NONE: /* None. */
512 return 0;
513 break;
514 case FC_ADDRESSING_MODE_RESERVED: /* Reserved, there used to be 8-bit
515 * address type in one amendment, but
516 * that and the feature using it was
517 * removed during 802.15.4-2015
518 * maintenance process. */
519 return -1;
520 break;
521 case FC_ADDRESSING_MODE_SHORT: /* Short. */
522 return 2;
523 break;
524 case FC_ADDRESSING_MODE_LONG: /* Extended. */
525 return 8;
526 break;
527 }
528 return 0;
529 }
530
531 /*
532 * Print out the ieee 802.15.4 address.
533 */
534 static void
535 ieee802_15_4_print_addr(netdissect_options *ndo, const u_char *p,
536 int dst_addr_len)
537 {
538 switch (dst_addr_len) {
539 case 0:
540 ND_PRINT("none");
541 break;
542 case 2:
543 ND_PRINT("%04x", EXTRACT_LE_U_2(p));
544 break;
545 case 8:
546 ND_PRINT("%s", le64addr_string(ndo, p));
547 break;
548 }
549 return;
550 }
551
552 /*
553 * Beacon frame superframe specification structure. Used in the old Beacon
554 * frames, and in the DSME PAN Descriptor IE. See section 7.3.1.3 of the
555 * 802.15.4-2015.
556 */
557 static void
558 ieee802_15_4_print_superframe_specification(netdissect_options *ndo,
559 uint16_t ss)
560 {
561 if (ndo->ndo_vflag < 1) {
562 return;
563 }
564 ND_PRINT("\n\tBeacon order = %d, Superframe order = %d, ",
565 (ss & 0xf), ((ss >> 4) & 0xf));
566 ND_PRINT("Final CAP Slot = %d",
567 ((ss >> 8) & 0xf));
568 if (CHECK_BIT(ss, 12)) { ND_PRINT(", BLE enabled"); }
569 if (CHECK_BIT(ss, 14)) { ND_PRINT(", PAN Coordinator"); }
570 if (CHECK_BIT(ss, 15)) { ND_PRINT(", Assocation Permit"); }
571 }
572
573 /*
574 * Beacon frame gts info structure. Used in the old Beacon frames, and
575 * in the DSME PAN Descriptor IE. See section 7.3.1.4 of 802.15.4-2015.
576 *
577 * Returns number of byts consumed from the packet or -1 in case of error.
578 */
579 static int
580 ieee802_15_4_print_gts_info(netdissect_options *ndo,
581 const u_char *p,
582 u_int data_len)
583 {
584 uint8_t gts_spec, gts_cnt;
585 u_int len;
586 int i;
587
588 gts_spec = EXTRACT_U_1(p);
589 gts_cnt = gts_spec & 0x7;
590
591 if (gts_cnt == 0) {
592 if (ndo->ndo_vflag > 0) {
593 ND_PRINT("\n\tGTS Descriptor Count = %d, ", gts_cnt);
594 }
595 return 1;
596 }
597 len = 1 + 1 + gts_cnt * 3;
598
599 if (data_len < len) {
600 ND_PRINT(" [ERROR: Truncated GTS Info List]");
601 return -1;
602 }
603 if (ndo->ndo_vflag < 2) {
604 return len;
605 }
606 ND_PRINT("GTS Descriptor Count = %d, ", gts_cnt);
607 ND_PRINT("GTS Directions Mask = %02x, [ ",
608 EXTRACT_U_1(p + 1) & 0x7f);
609
610 for(i = 0; i < gts_cnt; i++) {
611 ND_PRINT("[ ");
612 ieee802_15_4_print_addr(ndo, p + 2 + i * 3, 2);
613 ND_PRINT(", Start slot = %d, Length = %d ] ",
614 EXTRACT_U_1(p + 2 + i * 3 + 1) & 0x0f,
615 (EXTRACT_U_1(p + 2 + i * 3 + 1) >> 4) & 0x0f);
616 }
617 ND_PRINT("]");
618 return len;
619 }
620
621 /*
622 * Beacon frame pending address structure. Used in the old Beacon frames, and
623 * in the DSME PAN Descriptor IE. See section 7.3.1.5 of 802.15.4-2015.
624 *
625 * Returns number of byts consumed from the packet or -1 in case of error.
626 */
627 static int16_t
628 ieee802_15_4_print_pending_addresses(netdissect_options *ndo,
629 const u_char *p,
630 u_int data_len)
631 {
632 uint8_t pas, s_cnt, e_cnt, len, i;
633
634 pas = EXTRACT_U_1(p);
635 s_cnt = pas & 0x7;
636 e_cnt = (pas >> 4) & 0x7;
637 len = 1 + s_cnt * 2 + e_cnt * 8;
638 if (ndo->ndo_vflag > 0) {
639 ND_PRINT("\n\tPending address list, "
640 "# short addresses = %d, # extended addresses = %d",
641 s_cnt, e_cnt);
642 }
643 if (data_len < len) {
644 ND_PRINT(" [ERROR: Pending address list truncated]");
645 return -1;
646 }
647 if (ndo->ndo_vflag < 2) {
648 return len;
649 }
650 if (s_cnt != 0) {
651 ND_PRINT(", Short address list = [ ");
652 for(i = 0; i < s_cnt; i++) {
653 ieee802_15_4_print_addr(ndo, p + 1 + i * 2, 2);
654 ND_PRINT(" ");
655 }
656 ND_PRINT("]");
657 }
658 if (s_cnt != 0) {
659 ND_PRINT(", Extended address list = [ ");
660 for(i = 0; i < e_cnt; i++) {
661 ieee802_15_4_print_addr(ndo, p + 1 + s_cnt * 2 +
662 e_cnt * 8, 8);
663 ND_PRINT(" ");
664 }
665 ND_PRINT("]");
666 }
667 return len;
668 }
669
670 /*
671 * Print header ie content.
672 */
673 static void
674 ieee802_15_4_print_header_ie(netdissect_options *ndo,
675 const u_char *p,
676 uint16_t ie_len,
677 int element_id)
678 {
679 int i;
680
681 switch (element_id) {
682 case 0x00: /* Vendor Specific Header IE */
683 if (ie_len < 3) {
684 ND_PRINT("[ERROR: Vendor OUI missing]");
685 } else {
686 ND_PRINT("OUI = 0x%02x%02x%02x, ", EXTRACT_U_1(p),
687 EXTRACT_U_1(p + 1), EXTRACT_U_1(p + 2));
688 ND_PRINT("Data = ");
689 for(i = 3; i < ie_len; i++) {
690 ND_PRINT("%02x ", EXTRACT_U_1(p + i));
691 }
692 }
693 break;
694 case 0x1a: /* LE CSL IE */
695 if (ie_len < 4) {
696 ND_PRINT("[ERROR: Truncated CSL IE]");
697 } else {
698 ND_PRINT("CSL Phase = %d, CSL Period = %d",
699 EXTRACT_LE_U_2(p), EXTRACT_LE_U_2(p + 2));
700 if (ie_len >= 6) {
701 ND_PRINT(", Rendezvous time = %d",
702 EXTRACT_LE_U_2(p + 4));
703 }
704 if (ie_len != 4 && ie_len != 6) {
705 ND_PRINT(" [ERROR: CSL IE length wrong]");
706 }
707 }
708 break;
709 case 0x1b: /* LE RIT IE */
710 if (ie_len < 4) {
711 ND_PRINT("[ERROR: Truncated RIT IE]");
712 } else {
713 ND_PRINT("Time to First Listen = %d, # of Repeat Listen = %d, Repeat Listen Interval = %d",
714 EXTRACT_U_1(p),
715 EXTRACT_U_1(p + 1),
716 EXTRACT_LE_U_2(p + 2));
717 }
718 break;
719 case 0x1c: /* DSME PAN Descriptor IE */
720 /*FALLTHROUGH*/
721 case 0x21: /* Extended DSME PAN descriptior IE */
722 if (ie_len < 2) {
723 ND_PRINT("[ERROR: Truncated DSME PAN IE]");
724 } else {
725 uint16_t ss, ptr, ulen;
726 int16_t len;
727 int hopping_present;
728
729 hopping_present = 0;
730
731 ss = EXTRACT_LE_U_2(p);
732 ieee802_15_4_print_superframe_specification(ndo, ss);
733 if (ie_len < 3) {
734 ND_PRINT("[ERROR: Truncated before pending addresses field]");
735 break;
736 }
737 ptr = 2;
738 len = ieee802_15_4_print_pending_addresses(ndo,
739 p + ptr,
740 ie_len -
741 ptr);
742 if (len < 0) {
743 break;
744 }
745 ptr += len;
746
747 if (element_id == 0x21) {
748 /* Extended version. */
749 if (ie_len < ptr + 2) {
750 ND_PRINT("[ERROR: Truncated before DSME Superframe Specification]");
751 break;
752 }
753 ss = EXTRACT_LE_U_2(p + ptr);
754 ptr += 2;
755 ND_PRINT("Multi-superframe Order = %d", ss & 0xff);
756 ND_PRINT(", %s", ((ss & 0x100) ?
757 "Channel hopping mode" :
758 "Channel adaptation mode"));
759 if (ss & 0x400) {
760 ND_PRINT(", CAP reduction enabled");
761 }
762 if (ss & 0x800) {
763 ND_PRINT(", Deferred beacon enabled");
764 }
765 if (ss & 0x1000) {
766 ND_PRINT(", Hopping Sequence Present");
767 hopping_present = 1;
768 }
769 } else {
770 if (ie_len < ptr + 1) {
771 ND_PRINT("[ERROR: Truncated before DSME Superframe Specification]");
772 break;
773 }
774 ss = EXTRACT_U_1(p + ptr);
775 ptr++;
776 ND_PRINT("Multi-superframe Order = %d",
777 ss & 0x0f);
778 ND_PRINT(", %s", ((ss & 0x10) ?
779 "Channel hopping mode" :
780 "Channel adaptation mode"));
781 if (ss & 0x40) {
782 ND_PRINT(", CAP reduction enabled");
783 }
784 if (ss & 0x80) {
785 ND_PRINT(", Deferred beacon enabled");
786 }
787 }
788 if (ie_len < ptr + 8) {
789 ND_PRINT(" [ERROR: Truncated before Time syncronization specification]");
790 break;
791 }
792 ND_PRINT("Beacon timestamp = %" PRIu64 ", offset = %d",
793 EXTRACT_LE_U_6(p + ptr),
794 EXTRACT_LE_U_2(p + ptr + 6));
795 ptr += 8;
796 if (ie_len < ptr + 4) {
797 ND_PRINT(" [ERROR: Truncated before Beacon Bitmap]");
798 break;
799 }
800
801 ulen = EXTRACT_LE_U_2(p + ptr + 2);
802 ND_PRINT("SD Index = %d, Bitmap len = %d, ",
803 EXTRACT_LE_U_2(p + ptr), ulen);
804 ptr += 4;
805 if (ie_len < ptr + ulen) {
806 ND_PRINT(" [ERROR: Truncated in SD bitmap]");
807 break;
808 }
809 ND_PRINT(" SD Bitmap = ");
810 for(i = 0; i < ulen; i++) {
811 ND_PRINT("%02x ", EXTRACT_U_1(p + ptr + i));
812 }
813 ptr += ulen;
814
815 if (ie_len < ptr + 5) {
816 ND_PRINT(" [ERROR: Truncated before Channel hopping specification]");
817 break;
818 }
819
820 ulen = EXTRACT_LE_U_2(p + ptr + 4);
821 ND_PRINT("Hopping Seq ID = %d, PAN Coordinator BSN = %d, "
822 "Channel offset = %d, Bitmap length = %d, ",
823 EXTRACT_U_1(p + ptr),
824 EXTRACT_U_1(p + ptr + 1),
825 EXTRACT_LE_U_2(p + ptr + 2),
826 ulen);
827 ptr += 5;
828 if (ie_len < ptr + ulen) {
829 ND_PRINT(" [ERROR: Truncated in Channel offset bitmap]");
830 break;
831 }
832 ND_PRINT(" Channel offset bitmap = ");
833 for(i = 0; i < ulen; i++) {
834 ND_PRINT("%02x ", EXTRACT_U_1(p + ptr + i));
835 }
836 ptr += ulen;
837 if (hopping_present) {
838 if (ie_len < ptr + 1) {
839 ND_PRINT(" [ERROR: Truncated in Hopping Sequence length]");
840 break;
841 }
842 ulen = EXTRACT_U_1(p + ptr);
843 ptr++;
844 ND_PRINT("Hopping Seq length = %d [ ", ulen);
845
846 /* The specification is not clear how the
847 hopping sequence is encoded, I assume two
848 octet unsigned integers for each channel. */
849
850 if (ie_len < ptr + ulen * 2) {
851 ND_PRINT(" [ERROR: Truncated in Channel offset bitmap]");
852 break;
853 }
854 for(i = 0; i < ulen; i++) {
855 ND_PRINT("%02x ", EXTRACT_LE_U_2(p + ptr + i * 2));
856 }
857 ND_PRINT("]");
858 ptr += ulen * 2;
859 }
860 }
861 break;
862 case 0x1d: /* Rendezvous Tome IE */
863 if (ie_len != 4) {
864 ND_PRINT("[ERROR: Length != 2]");
865 } else {
866 uint16_t r_time, w_u_interval;
867 r_time = EXTRACT_LE_U_2(p);
868 w_u_interval = EXTRACT_LE_U_2(p + 2);
869
870 ND_PRINT("Rendezvous time = %d, Wake-up Interval = %d",
871 r_time, w_u_interval);
872 }
873 break;
874 case 0x1e: /* Time correction IE */
875 if (ie_len != 2) {
876 ND_PRINT("[ERROR: Length != 2]");
877 } else {
878 uint16_t val;
879 int16_t timecorr;
880
881 val = EXTRACT_LE_U_2(p);
882 if (val & 0x8000) { ND_PRINT("Negative "); }
883 val &= 0xfff;
884 val <<= 4;
885 timecorr = val;
886 timecorr >>= 4;
887
888 ND_PRINT("Ack time correction = %d, ", timecorr);
889 }
890 break;
891 case 0x22: /* Frament Sequence Content Description IE */
892 /* XXX Not implemented */
893 case 0x23: /* Simplified Superframe Specification IE */
894 /* XXX Not implemented */
895 case 0x24: /* Simplified GTS Specification IE */
896 /* XXX Not implemented */
897 case 0x25: /* LECIM Capabilities IE */
898 /* XXX Not implemented */
899 case 0x26: /* TRLE Descriptor IE */
900 /* XXX Not implemented */
901 case 0x27: /* RCC Capabilities IE */
902 /* XXX Not implemented */
903 case 0x28: /* RCCN Descriptor IE */
904 /* XXX Not implemented */
905 case 0x29: /* Global Time IE */
906 /* XXX Not implemented */
907 case 0x2b: /* DA IE */
908 /* XXX Not implemented */
909 default:
910 ND_PRINT("IE Data = ");
911 for(i = 0; i < ie_len; i++) {
912 ND_PRINT("%02x ", EXTRACT_U_1(p + i));
913 }
914 break;
915 }
916 }
917
918 /*
919 * Parse and print Header IE list. See 7.4.2 of 802.15.4-2015 for
920 * more information.
921 *
922 * Returns number of byts consumed from the packet or -1 in case of error.
923 */
924 static int
925 ieee802_15_4_print_header_ie_list(netdissect_options *ndo,
926 const u_char *p,
927 u_int caplen,
928 int *payload_ie_present)
929 {
930 int len, ie, element_id, i;
931 uint16_t ie_len;
932
933 *payload_ie_present = 0;
934 len = 0;
935 do {
936 if (caplen < 2) {
937 ND_PRINT("[ERROR: Truncated header IE]");
938 return -1;
939 }
940 /* Extract IE Header */
941 ie = EXTRACT_LE_U_2(p);
942 if (CHECK_BIT(ie, 15)) {
943 ND_PRINT("[ERROR: Header IE with type 1] ");
944 }
945 /* Get length and Element ID */
946 ie_len = ie & 0x7f;
947 element_id = (ie >> 7) & 0xff;
948 if (element_id > 127) {
949 ND_PRINT("Reserved Element ID %02x, length = %d ",
950 element_id, ie_len);
951 } else {
952 if (ie_len == 0) {
953 ND_PRINT("\n\t%s [", h_ie_names[element_id]);
954 } else {
955 ND_PRINT("\n\t%s [ length = %d, ",
956 h_ie_names[element_id], ie_len);
957 }
958 }
959 if (caplen < ie_len) {
960 ND_PRINT("[ERROR: Truncated IE data]");
961 return -1;
962 }
963 /* Skip header */
964 p += 2;
965
966 /* Parse and print content. */
967 if (ndo->ndo_vflag > 3 && ie_len != 0) {
968 ieee802_15_4_print_header_ie(ndo, p,
969 ie_len, element_id);
970 } else {
971 if (ie_len != 0) {
972 ND_PRINT("IE Data = ");
973 for(i = 0; i < ie_len; i++) {
974 ND_PRINT("%02x ", EXTRACT_U_1(p + i));
975 }
976 }
977 }
978 ND_PRINT("] ");
979 len += 2 + ie_len;
980 p += ie_len;
981 caplen -= 2 + ie_len;
982 if (element_id == 0x7e) {
983 *payload_ie_present = 1;
984 break;
985 }
986 if (element_id == 0x7f) {
987 break;
988 }
989 } while (caplen > 0);
990 return len;
991 }
992
993 /*
994 * Print MLME ie content.
995 */
996 static void
997 ieee802_15_4_print_mlme_ie(netdissect_options *ndo,
998 const u_char *p,
999 uint16_t sub_ie_len,
1000 int sub_id)
1001 {
1002 int i, j;
1003 uint16_t len;
1004
1005 /* Note, as there is no overlap with the long and short
1006 MLME sub IDs, we can just use one switch here. */
1007 switch (sub_id) {
1008 case 0x08: /* Vendor Specific Nested IE */
1009 if (sub_ie_len < 3) {
1010 ND_PRINT("[ERROR: Vendor OUI missing]");
1011 } else {
1012 ND_PRINT("OUI = 0x%02x%02x%02x, ",
1013 EXTRACT_U_1(p),
1014 EXTRACT_U_1(p + 1),
1015 EXTRACT_U_1(p + 2));
1016 ND_PRINT("Data = ");
1017 for(i = 3; i < sub_ie_len; i++) {
1018 ND_PRINT("%02x ", EXTRACT_U_1(p + i));
1019 }
1020 }
1021 break;
1022 case 0x09: /* Channel Hopping IE */
1023 if (sub_ie_len < 1) {
1024 ND_PRINT("[ERROR: Hopping sequence ID missing]");
1025 } else if (sub_ie_len == 1) {
1026 ND_PRINT("Hopping Sequence ID = %d", EXTRACT_U_1(p));
1027 p++;
1028 sub_ie_len--;
1029 } else {
1030 uint16_t channel_page, number_of_channels;
1031
1032 ND_PRINT("Hopping Sequence ID = %d", EXTRACT_U_1(p));
1033 p++;
1034 sub_ie_len--;
1035 if (sub_ie_len < 7) {
1036 ND_PRINT("[ERROR: IE truncated]");
1037 break;
1038 }
1039 channel_page = EXTRACT_U_1(p);
1040 number_of_channels = EXTRACT_LE_U_2(p + 1);
1041 ND_PRINT("Channel Page = %d, Number of Channels = %d, ",
1042 channel_page, number_of_channels);
1043 ND_PRINT("Phy Configuration = 0x%08x, ",
1044 EXTRACT_LE_U_4(p + 3));
1045 p += 7;
1046 sub_ie_len -= 7;
1047 if (channel_page == 9 || channel_page == 10) {
1048 len = (number_of_channels + 7) / 8;
1049 if (sub_ie_len < len) {
1050 ND_PRINT("[ERROR: IE truncated]");
1051 break;
1052 }
1053 ND_PRINT("Extended bitmap = 0x");
1054 for(i = 0; i < len; i++) {
1055 ND_PRINT("%02x", EXTRACT_U_1(p + i));
1056 }
1057 ND_PRINT(", ");
1058 p += len;
1059 sub_ie_len -= len;
1060 }
1061 if (sub_ie_len < 2) {
1062 ND_PRINT("[ERROR: IE truncated]");
1063 break;
1064 }
1065 len = EXTRACT_LE_U_2(p);
1066 p += 2;
1067 sub_ie_len -= 2;
1068 ND_PRINT("Hopping Seq length = %d [ ", len);
1069
1070 if (sub_ie_len < len * 2) {
1071 ND_PRINT(" [ERROR: IE truncated]");
1072 break;
1073 }
1074 for(i = 0; i < len; i++) {
1075 ND_PRINT("%02x ", EXTRACT_LE_U_2(p + i * 2));
1076 }
1077 ND_PRINT("]");
1078 p += len * 2;
1079 sub_ie_len -= len * 2;
1080 if (sub_ie_len < 2) {
1081 ND_PRINT("[ERROR: IE truncated]");
1082 break;
1083 }
1084 ND_PRINT("Current hop = %d", EXTRACT_LE_U_2(p));
1085 }
1086
1087 break;
1088 case 0x1a: /* TSCH Syncronization IE. */
1089 if (sub_ie_len < 6) {
1090 ND_PRINT("[ERROR: Length != 6]");
1091 }
1092 ND_PRINT("ASN = %010" PRIx64 ", Join Metric = %d ",
1093 EXTRACT_LE_U_5(p), EXTRACT_U_1(p + 5));
1094 break;
1095 case 0x1b: /* TSCH Slotframe and Link IE. */
1096 {
1097 int sf_num, off, links, opts;
1098
1099 if (sub_ie_len < 1) {
1100 ND_PRINT("[ERROR: Truncated IE]");
1101 break;
1102 }
1103 sf_num = EXTRACT_U_1(p);
1104 ND_PRINT("Slotframes = %d ", sf_num);
1105 off = 1;
1106 for(i = 0; i < sf_num; i++) {
1107 if (sub_ie_len < off + 4) {
1108 ND_PRINT("[ERROR: Truncated IE before slotframes]");
1109 break;
1110 }
1111 links = EXTRACT_U_1(p + off + 3);
1112 ND_PRINT("\n\t\t\t[ Handle %d, size = %d, links = %d ",
1113 EXTRACT_U_1(p + off),
1114 EXTRACT_LE_U_2(p + off + 1),
1115 links);
1116 off += 4;
1117 for(j = 0; j < links; j++) {
1118 if (sub_ie_len < off + 5) {
1119 ND_PRINT("[ERROR: Truncated IE links]");
1120 break;
1121 }
1122 opts = EXTRACT_U_1(p + off + 4);
1123 ND_PRINT("\n\t\t\t\t[ Timeslot = %d, Offset = %d, Options = ",
1124 EXTRACT_LE_U_2(p + off),
1125 EXTRACT_LE_U_2(p + off + 2));
1126 if (opts & 0x1) { ND_PRINT("TX "); }
1127 if (opts & 0x2) { ND_PRINT("RX "); }
1128 if (opts & 0x4) { ND_PRINT("Shared "); }
1129 if (opts & 0x8) {
1130 ND_PRINT("Timekeeping ");
1131 }
1132 if (opts & 0x10) {
1133 ND_PRINT("Priority ");
1134 }
1135 off += 5;
1136 ND_PRINT("] ");
1137 }
1138 ND_PRINT("] ");
1139 }
1140 }
1141 break;
1142 case 0x1c: /* TSCH Timeslot IE. */
1143 if (sub_ie_len == 1) {
1144 ND_PRINT("Time slot ID = %d ", EXTRACT_U_1(p));
1145 } else if (sub_ie_len == 25) {
1146 ND_PRINT("Time slot ID = %d, CCA Offset = %d, CCA = %d, TX Offset = %d, RX Offset = %d, RX Ack Delay = %d, TX Ack Delay = %d, RX Wait = %d, Ack Wait = %d, RX TX = %d, Max Ack = %d, Max TX = %d, Time slot Length = %d ",
1147 EXTRACT_U_1(p),
1148 EXTRACT_LE_U_2(p + 1),
1149 EXTRACT_LE_U_2(p + 3),
1150 EXTRACT_LE_U_2(p + 5),
1151 EXTRACT_LE_U_2(p + 7),
1152 EXTRACT_LE_U_2(p + 9),
1153 EXTRACT_LE_U_2(p + 11),
1154 EXTRACT_LE_U_2(p + 13),
1155 EXTRACT_LE_U_2(p + 15),
1156 EXTRACT_LE_U_2(p + 17),
1157 EXTRACT_LE_U_2(p + 19),
1158 EXTRACT_LE_U_2(p + 21),
1159 EXTRACT_LE_U_2(p + 23));
1160 } else if (sub_ie_len == 27) {
1161 ND_PRINT("Time slot ID = %d, CCA Offset = %d, CCA = %d, TX Offset = %d, RX Offset = %d, RX Ack Delay = %d, TX Ack Delay = %d, RX Wait = %d, Ack Wait = %d, RX TX = %d, Max Ack = %d, Max TX = %d, Time slot Length = %d ",
1162 EXTRACT_U_1(p),
1163 EXTRACT_LE_U_2(p + 1),
1164 EXTRACT_LE_U_2(p + 3),
1165 EXTRACT_LE_U_2(p + 5),
1166 EXTRACT_LE_U_2(p + 7),
1167 EXTRACT_LE_U_2(p + 9),
1168 EXTRACT_LE_U_2(p + 11),
1169 EXTRACT_LE_U_2(p + 13),
1170 EXTRACT_LE_U_2(p + 15),
1171 EXTRACT_LE_U_2(p + 17),
1172 EXTRACT_LE_U_2(p + 19),
1173 EXTRACT_LE_U_3(p + 21),
1174 EXTRACT_LE_U_3(p + 24));
1175 } else {
1176 ND_PRINT("[ERROR: Length not 1, 25, or 27]");
1177 ND_PRINT("\n\t\t\tIE Data = ");
1178 for(i = 0; i < sub_ie_len; i++) {
1179 ND_PRINT("%02x ", EXTRACT_U_1(p + i));
1180 }
1181 }
1182 break;
1183 case 0x1d: /* Hopping timing IE */
1184 /* XXX Not implemented */
1185 case 0x1e: /* Enhanced Beacon Filter IE */
1186 /* XXX Not implemented */
1187 case 0x1f: /* MAC Metrics IE */
1188 /* XXX Not implemented */
1189 case 0x20: /* All MAC Metrics IE */
1190 /* XXX Not implemented */
1191 case 0x21: /* Coexistence Specification IE */
1192 /* XXX Not implemented */
1193 case 0x22: /* SUN Device Capabilities IE */
1194 /* XXX Not implemented */
1195 case 0x23: /* SUN FSK Generic PHY IE */
1196 /* XXX Not implemented */
1197 case 0x24: /* Mode Switch Parameter IE */
1198 /* XXX Not implemented */
1199 case 0x25: /* PHY Parameter Change IE */
1200 /* XXX Not implemented */
1201 case 0x26: /* O-QPSK PHY Mode IE */
1202 /* XXX Not implemented */
1203 case 0x27: /* PCA Allocation IE */
1204 /* XXX Not implemented */
1205 case 0x28: /* LECIM DSSS Operating Mode IE */
1206 /* XXX Not implemented */
1207 case 0x29: /* LECIM FSK Operating Mode IE */
1208 /* XXX Not implemented */
1209 case 0x2b: /* TVWS PHY Operating Mode Description IE */
1210 /* XXX Not implemented */
1211 case 0x2c: /* TVWS Device Capabilities IE */
1212 /* XXX Not implemented */
1213 case 0x2d: /* TVWS Device Catagory IE */
1214 /* XXX Not implemented */
1215 case 0x2e: /* TVWS Device Identification IE */
1216 /* XXX Not implemented */
1217 case 0x2f: /* TVWS Device Location IE */
1218 /* XXX Not implemented */
1219 case 0x30: /* TVWS Channel Information Query IE */
1220 /* XXX Not implemented */
1221 case 0x31: /* TVWS Channel Information Source IE */
1222 /* XXX Not implemented */
1223 case 0x32: /* CTM IE */
1224 /* XXX Not implemented */
1225 case 0x33: /* Timestamp IE */
1226 /* XXX Not implemented */
1227 case 0x34: /* Timestamp Difference IE */
1228 /* XXX Not implemented */
1229 case 0x35: /* TMCTP Specification IE */
1230 /* XXX Not implemented */
1231 case 0x36: /* TCC PHY Operating Mode IE */
1232 /* XXX Not implemented */
1233 default:
1234 ND_PRINT("IE Data = ");
1235 for(i = 0; i < sub_ie_len; i++) {
1236 ND_PRINT("%02x ", EXTRACT_U_1(p + i));
1237 }
1238 break;
1239 }
1240 }
1241
1242 /*
1243 * MLME IE list parsing and printing. See 7.4.3.2 of 802.15.4-2015
1244 * for more information.
1245 */
1246 static void
1247 ieee802_15_4_print_mlme_ie_list(netdissect_options *ndo,
1248 const u_char *p,
1249 uint16_t ie_len)
1250 {
1251 int ie, sub_id, i, type;
1252 uint16_t sub_ie_len;
1253
1254 do {
1255 if (ie_len < 2) {
1256 ND_PRINT("[ERROR: Truncated MLME IE]");
1257 return;
1258 }
1259 /* Extract IE header */
1260 ie = EXTRACT_LE_U_2(p);
1261 type = CHECK_BIT(ie, 15);
1262 if (type) {
1263 /* Long type */
1264 sub_ie_len = ie & 0x3ff;
1265 sub_id = (ie >> 11) & 0x0f;
1266 } else {
1267 sub_ie_len = ie & 0xff;
1268 sub_id = (ie >> 8) & 0x7f;
1269 }
1270
1271 /* Skip the IE header */
1272 p += 2;
1273
1274 if (type == 0) {
1275 ND_PRINT("\n\t\t%s [ length = %d, ",
1276 p_mlme_short_names[sub_id], sub_ie_len);
1277 } else {
1278 ND_PRINT("\n\t\t%s [ length = %d, ",
1279 p_mlme_long_names[sub_id], sub_ie_len);
1280 }
1281
1282 if (ie_len < sub_ie_len) {
1283 ND_PRINT("[ERROR: Truncated IE data]");
1284 return;
1285 }
1286 if (sub_ie_len != 0) {
1287 if (ndo->ndo_vflag > 3) {
1288 ieee802_15_4_print_mlme_ie(ndo, p, sub_ie_len, sub_id);
1289 } else if (ndo->ndo_vflag > 2) {
1290 ND_PRINT("IE Data = ");
1291 for(i = 0; i < sub_ie_len; i++) {
1292 ND_PRINT("%02x ", EXTRACT_U_1(p + i));
1293 }
1294 }
1295 }
1296 ND_PRINT("] ");
1297 p += sub_ie_len;
1298 ie_len -= 2 + sub_ie_len;
1299 } while (ie_len > 0);
1300 return;
1301 }
1302
1303 /*
1304 * Multiplexd IE (802.15.9) parsing and printing.
1305 *
1306 * Returns number of bytes consumed from packet or -1 in case of error.
1307 */
1308 static void
1309 ieee802_15_4_print_mpx_ie(netdissect_options *ndo,
1310 const u_char *p,
1311 uint16_t ie_len)
1312 {
1313 int transfer_type, tid;
1314 int fragment_number, data_start;
1315 int i;
1316
1317 data_start = 0;
1318 if (ie_len < 1) {
1319 ND_PRINT("[ERROR: Transaction control byte missing]");
1320 return;
1321 }
1322
1323 transfer_type = EXTRACT_U_1(p) & 0x7;
1324 tid = EXTRACT_U_1(p) >> 3;
1325 switch (transfer_type) {
1326 case 0x00: /* Full upper layer frame. */
1327 case 0x01: /* Full upper layer frame with small Multiplex ID. */
1328 ND_PRINT("Type = Full upper layer fragment%s, ",
1329 (transfer_type == 0x01 ?
1330 " with small Multiplex ID" : ""));
1331 if (transfer_type == 0x00) {
1332 if (ie_len < 3) {
1333 ND_PRINT("[ERROR: Multiplex ID missing]");
1334 return;
1335 }
1336 data_start = 3;
1337 ND_PRINT("tid = 0x%02x, Multiplex ID = 0x%04x, ",
1338 tid, EXTRACT_LE_U_2(p + 1));
1339 } else {
1340 data_start = 1;
1341 ND_PRINT("Multiplex ID = 0x%04x, ", tid);
1342 }
1343 break;
1344 case 0x02: /* First, or middle, Fragments */
1345 case 0x04: /* Last fragment */
1346 if (ie_len < 2) {
1347 ND_PRINT("[ERROR: fragment number missing]");
1348 return;
1349 }
1350
1351 fragment_number = EXTRACT_U_1(p + 1);
1352 ND_PRINT("Type = %s, tid = 0x%02x, fragment = 0x%02x, ",
1353 (transfer_type == 0x02 ?
1354 (fragment_number == 0 ?
1355 "First fragment" : "Middle fragment") :
1356 "Last fragment"), tid,
1357 fragment_number);
1358 data_start = 2;
1359 if (fragment_number == 0) {
1360 int total_size, multiplex_id;
1361
1362 if (ie_len < 6) {
1363 ND_PRINT("[ERROR: Total upper layer size or multiplex ID missing]");
1364 return;
1365 }
1366 total_size = EXTRACT_LE_U_2(p + 2);
1367 multiplex_id = EXTRACT_LE_U_2(p + 4);
1368 ND_PRINT("Total upper layer size = 0x%04x, Multiplex ID = 0x%04x, ",
1369 total_size, multiplex_id);
1370 data_start = 6;
1371 }
1372 break;
1373 case 0x06: /* Abort code */
1374 if (ie_len == 1) {
1375 ND_PRINT("Type = Abort, tid = 0x%02x, no max size given",
1376 tid);
1377 } else if (ie_len == 3) {
1378 ND_PRINT("Type = Abort, tid = 0x%02x, max size = 0x%04x",
1379 tid, EXTRACT_LE_U_2(p + 1));
1380 } else {
1381 ND_PRINT("Type = Abort, tid = 0x%02x, invalid length = %d (not 1 or 3)",
1382 tid, ie_len);
1383 ND_PRINT("Abort data = ");
1384 for(i = 1; i < ie_len; i++) {
1385 ND_PRINT("%02x ", EXTRACT_U_1(p + i));
1386 }
1387 }
1388 return;
1389 /* NOTREACHED */
1390 break;
1391 case 0x03: /* Reserved */
1392 case 0x05: /* Reserved */
1393 case 0x07: /* Reserved */
1394 ND_PRINT("Type = %d (Reserved), tid = 0x%02x, ",
1395 transfer_type, tid);
1396 data_start = 1;
1397 break;
1398 }
1399
1400 ND_PRINT("Upper layer data = ");
1401 for(i = data_start; i < ie_len; i++) {
1402 ND_PRINT("%02x ", EXTRACT_U_1(p + i));
1403 }
1404 }
1405
1406 /*
1407 * Payload IE list parsing and printing. See 7.4.3 of 802.15.4-2015
1408 * for more information.
1409 *
1410 * Returns number of byts consumed from the packet or -1 in case of error.
1411 */
1412 static int
1413 ieee802_15_4_print_payload_ie_list(netdissect_options *ndo,
1414 const u_char *p,
1415 u_int caplen)
1416 {
1417 int len, ie, group_id, i;
1418 uint16_t ie_len;
1419
1420 len = 0;
1421 do {
1422 if (caplen < 2) {
1423 ND_PRINT("[ERROR: Truncated header IE]");
1424 return -1;
1425 }
1426 /* Extract IE header */
1427 ie = EXTRACT_LE_U_2(p);
1428 if ((CHECK_BIT(ie, 15)) == 0) {
1429 ND_PRINT("[ERROR: Payload IE with type 0] ");
1430 }
1431 ie_len = ie & 0x3ff;
1432 group_id = (ie >> 11) & 0x0f;
1433
1434 /* Skip the IE header */
1435 p += 2;
1436 if (ie_len == 0) {
1437 ND_PRINT("\n\t%s [", p_ie_names[group_id]);
1438 } else {
1439 ND_PRINT("\n\t%s [ length = %d, ",
1440 p_ie_names[group_id], ie_len);
1441 }
1442 if (caplen < ie_len) {
1443 ND_PRINT("[ERROR: Truncated IE data]");
1444 return -1;
1445 }
1446 if (ndo->ndo_vflag > 3 && ie_len != 0) {
1447 switch (group_id) {
1448 case 0x1: /* MLME IE */
1449 ieee802_15_4_print_mlme_ie_list(ndo, p, ie_len);
1450 break;
1451 case 0x2: /* Vendor Specific Nested IE */
1452 if (ie_len < 3) {
1453 ND_PRINT("[ERROR: Vendor OUI missing]");
1454 } else {
1455 ND_PRINT("OUI = 0x%02x%02x%02x, ",
1456 EXTRACT_U_1(p),
1457 EXTRACT_U_1(p + 1),
1458 EXTRACT_U_1(p + 2));
1459 ND_PRINT("Data = ");
1460 for(i = 3; i < ie_len; i++) {
1461 ND_PRINT("%02x ",
1462 EXTRACT_U_1(p + i));
1463 }
1464 }
1465 break;
1466 case 0x3: /* Multiplexed IE (802.15.9) */
1467 ieee802_15_4_print_mpx_ie(ndo, p, ie_len);
1468 break;
1469 case 0x5: /* IETF IE */
1470 if (ie_len < 1) {
1471 ND_PRINT("[ERROR: Subtype ID missing]");
1472 } else {
1473 ND_PRINT("Subtype ID = 0x%02x, Subtype content = ",
1474 EXTRACT_U_1(p));
1475 for(i = 1; i < ie_len; i++) {
1476 ND_PRINT("%02x ", EXTRACT_U_1(p + i));
1477 }
1478 }
1479 break;
1480 default:
1481 ND_PRINT("IE Data = ");
1482 for(i = 0; i < ie_len; i++) {
1483 ND_PRINT("%02x ", EXTRACT_U_1(p + i));
1484 }
1485 break;
1486 }
1487 } else {
1488 if (ie_len != 0) {
1489 ND_PRINT("IE Data = ");
1490 for(i = 0; i < ie_len; i++) {
1491 ND_PRINT("%02x ", EXTRACT_U_1(p + i));
1492 }
1493 }
1494 }
1495 ND_PRINT("]\n\t");
1496 len += 2 + ie_len;
1497 p += ie_len;
1498 caplen -= 2 + ie_len;
1499 if (group_id == 0xf) {
1500 break;
1501 }
1502 } while (caplen > 0);
1503 return len;
1504 }
1505
1506 /*
1507 * Parse and print auxiliary security header.
1508 *
1509 * Returns number of byts consumed from the packet or -1 in case of error.
1510 */
1511 static int
1512 ieee802_15_4_print_aux_sec_header(netdissect_options *ndo,
1513 const u_char *p,
1514 u_int caplen,
1515 int *security_level)
1516 {
1517 int sc, key_id_mode, len;
1518
1519 if (caplen < 1) {
1520 ND_PRINT("[ERROR: Truncated before Aux Security Header]");
1521 return -1;
1522 }
1523 sc = EXTRACT_U_1(p);
1524 len = 1;
1525 *security_level = sc & 0x7;
1526 key_id_mode = (sc >> 3) & 0x3;
1527
1528 caplen -= 1;
1529 p += 1;
1530
1531 if (ndo->ndo_vflag > 0) {
1532 ND_PRINT("\n\tSecurity Level %d, Key Id Mode %d, ",
1533 *security_level, key_id_mode);
1534 }
1535 if ((CHECK_BIT(sc, 5)) == 0) {
1536 if (caplen < 4) {
1537 ND_PRINT("[ERROR: Truncated before Frame Counter]");
1538 return -1;
1539 }
1540 len += 4;
1541 caplen -= 4;
1542 p += 4;
1543 if (ndo->ndo_vflag > 1) {
1544 ND_PRINT("Frame Counter 0x%08x ",
1545 EXTRACT_LE_U_4(p + 1));
1546 }
1547 }
1548 switch (key_id_mode) {
1549 case 0x00: /* Implicit. */
1550 if (ndo->ndo_vflag > 1) {
1551 ND_PRINT("Implicit");
1552 }
1553 return len;
1554 break;
1555 case 0x01: /* Key Index, nothing to print here. */
1556 break;
1557 case 0x02: /* PAN and Short address Key Source, and Key Index. */
1558 if (caplen < 4) {
1559 ND_PRINT("[ERROR: Truncated before Key Source]");
1560 return -1;
1561 }
1562 if (ndo->ndo_vflag > 1) {
1563 ND_PRINT("KeySource 0x%04x:%0x4x, ",
1564 EXTRACT_LE_U_2(p), EXTRACT_LE_U_2(p + 2));
1565 }
1566 p += 4;
1567 caplen -= 4;
1568 len += 4;
1569 break;
1570 case 0x03: /* Extended address and Key Index. */
1571 if (caplen < 8) {
1572 ND_PRINT("[ERROR: Truncated before Key Source]");
1573 return -1;
1574 }
1575 if (ndo->ndo_vflag > 1) {
1576 ND_PRINT("KeySource %s, ", le64addr_string(ndo, p));
1577 }
1578 p += 4;
1579 caplen -= 4;
1580 len += 4;
1581 break;
1582 }
1583 if (caplen < 1) {
1584 ND_PRINT("[ERROR: Truncated before Key Index]");
1585 return -1;
1586 }
1587 if (ndo->ndo_vflag > 1) {
1588 ND_PRINT("KeyIndex 0x%02x, ", EXTRACT_U_1(p));
1589 }
1590 caplen -= 1;
1591 p += 1;
1592 len += 1;
1593 return len;
1594 }
1595
1596 /*
1597 * Print command data.
1598 *
1599 * Returns number of byts consumed from the packet or -1 in case of error.
1600 */
1601 static int
1602 ieee802_15_4_print_command_data(netdissect_options *ndo,
1603 uint8_t command_id,
1604 const u_char *p,
1605 u_int caplen)
1606 {
1607 u_int i;
1608
1609 switch (command_id) {
1610 case 0x01: /* Assocation Request */
1611 if (caplen != 1) {
1612 ND_PRINT("Invalid Assocation request command length");
1613 return -1;
1614 } else {
1615 uint8_t cap_info;
1616 cap_info = EXTRACT_U_1(p);
1617 ND_PRINT("%s%s%s%s%s%s",
1618 ((cap_info & 0x02) ?
1619 "FFD, " : "RFD, "),
1620 ((cap_info & 0x04) ?
1621 "AC powered, " : ""),
1622 ((cap_info & 0x08) ?
1623 "Receiver on when idle, " : ""),
1624 ((cap_info & 0x10) ?
1625 "Fast association, " : ""),
1626 ((cap_info & 0x40) ?
1627 "Security supported, " : ""),
1628 ((cap_info & 0x80) ?
1629 "Allocate address, " : ""));
1630 return caplen;
1631 }
1632 break;
1633 case 0x02: /* Assocation Response */
1634 if (caplen != 3) {
1635 ND_PRINT("Invalid Assocation response command length");
1636 return -1;
1637 } else {
1638 ND_PRINT("Short address = ");
1639 ieee802_15_4_print_addr(ndo, p, 2);
1640 switch (EXTRACT_U_1(p + 2)) {
1641 case 0x00:
1642 ND_PRINT(", Association successful");
1643 break;
1644 case 0x01:
1645 ND_PRINT(", PAN at capacity");
1646 break;
1647 case 0x02:
1648 ND_PRINT(", PAN access denied");
1649 break;
1650 case 0x03:
1651 ND_PRINT(", Hooping sequence offset duplication");
1652 break;
1653 case 0x80:
1654 ND_PRINT(", Fast association successful");
1655 break;
1656 default:
1657 ND_PRINT(", Status = 0x%02x",
1658 EXTRACT_U_1(p + 2));
1659 break;
1660 }
1661 return caplen;
1662 }
1663 break;
1664 case 0x03: /* Diassociation Notification command */
1665 if (caplen != 1) {
1666 ND_PRINT("Invalid Disassociation Notification command length");
1667 return -1;
1668 } else {
1669 switch (EXTRACT_U_1(p)) {
1670 case 0x00:
1671 ND_PRINT("Reserved");
1672 break;
1673 case 0x01:
1674 ND_PRINT("Reason = The coordinator wishes the device to leave PAN");
1675 break;
1676 case 0x02:
1677 ND_PRINT("Reason = The device wishes to leave the PAN");
1678 break;
1679 default:
1680 ND_PRINT("Reason = 0x%02x", EXTRACT_U_1(p + 2));
1681 break;
1682 }
1683 return caplen;
1684 }
1685
1686 /* Following ones do not have any data. */
1687 case 0x04: /* Data Request command */
1688 case 0x05: /* PAN ID Conflict Notification command */
1689 case 0x06: /* Orphan Notification command */
1690 case 0x07: /* Beacon Request command */
1691 /* Should not have any data. */
1692 return 0;
1693 case 0x08: /* Coordinator Realignment command */
1694 if (caplen < 7 || caplen > 8) {
1695 ND_PRINT("Invalid Coordinator Realignment command length");
1696 return -1;
1697 } else {
1698 uint16_t channel, page;
1699
1700 ND_PRINT("Pan ID = 0x%04x, Coordinator short address = ",
1701 EXTRACT_LE_U_2(p));
1702 ieee802_15_4_print_addr(ndo, p + 2, 2);
1703 channel = EXTRACT_U_1(p + 4);
1704
1705 if (caplen == 8) {
1706 page = EXTRACT_U_1(p + 7);
1707 } else {
1708 page = 0x80;
1709 }
1710 if (CHECK_BIT(page, 7)) {
1711 /* No page present, instead we have msb of
1712 channel in the page. */
1713 channel |= (page & 0x7f) << 8;
1714 ND_PRINT(", Channel Number = %d", channel);
1715 } else {
1716 ND_PRINT(", Channel Number = %d, page = %d",
1717 channel, page);
1718 }
1719 ND_PRINT(", Short address = ");
1720 ieee802_15_4_print_addr(ndo, p + 5, 2);
1721 return caplen;
1722 }
1723 break;
1724 case 0x09: /* GTS Request command */
1725 if (caplen != 1) {
1726 ND_PRINT("Invalid GTS Request command length");
1727 return -1;
1728 } else {
1729 uint8_t gts;
1730
1731 gts = EXTRACT_U_1(p);
1732 ND_PRINT("GTS Length = %d, %s, %s",
1733 gts & 0xf,
1734 (CHECK_BIT(gts, 4) ?
1735 "Receive-only GTS" : "Transmit-only GTS"),
1736 (CHECK_BIT(gts, 5) ?
1737 "GTS allocation" : "GTS deallocations"));
1738 return caplen;
1739 }
1740 break;
1741 case 0x13: /* DSME Association Request command */
1742 /* XXX Not implemented */
1743 case 0x14: /* DSME Association Response command */
1744 /* XXX Not implemented */
1745 case 0x15: /* DSME GTS Request command */
1746 /* XXX Not implemented */
1747 case 0x16: /* DSME GTS Response command */
1748 /* XXX Not implemented */
1749 case 0x17: /* DSME GTS GTS Notify command */
1750 /* XXX Not implemented */
1751 case 0x18: /* DSME Information Request command */
1752 /* XXX Not implemented */
1753 case 0x19: /* DSME Information Response command */
1754 /* XXX Not implemented */
1755 case 0x1a: /* DSME Beacon Allocation Notification command */
1756 /* XXX Not implemented */
1757 case 0x1b: /* DSME Beacon Collision Notification command */
1758 /* XXX Not implemented */
1759 case 0x1c: /* DSME Link Report command */
1760 /* XXX Not implemented */
1761 case 0x20: /* RIT Data Request command */
1762 /* XXX Not implemented */
1763 case 0x21: /* DBS Request command */
1764 /* XXX Not implemented */
1765 case 0x22: /* DBS Response command */
1766 /* XXX Not implemented */
1767 case 0x23: /* RIT Data Response command */
1768 /* XXX Not implemented */
1769 case 0x24: /* Vendor Specific command */
1770 /* XXX Not implemented */
1771 case 0x0a: /* TRLE Management Request command */
1772 /* XXX Not implemented */
1773 case 0x0b: /* TRLE Management Response command */
1774 /* XXX Not implemented */
1775 default:
1776 ND_PRINT("Command Data = ");
1777 for(i = 0; i < caplen; i++) {
1778 ND_PRINT("%02x ", EXTRACT_U_1(p + i));
1779 }
1780 break;
1781 }
1782 return 0;
1783 }
1784
1785 /*
1786 * Parse and print frames folloing standard format.
1787 *
1788 * Returns FALSE in case of error.
1789 */
1790 static u_int
1791 ieee802_15_4_std_frames(netdissect_options *ndo,
1792 const u_char *p, u_int caplen,
1793 uint16_t fc)
1794 {
1795 int len, frame_version, pan_id_comp;
1796 int frame_type;
1797 int src_pan, dst_pan, src_addr_len, dst_addr_len;
1798 int security_level, miclen = 0;
1799 int payload_ie_present;
1800 uint8_t seq;
1801 uint32_t fcs, crc_check;
1802 const u_char *mic_start = NULL;
1803
1804 payload_ie_present = 0;
1805
1806 crc_check = 0;
1807 /* Assume 2 octet FCS, the FCS length depends on the PHY, and we do not
1808 know about that. */
1809 if (caplen < 4) {
1810 /* Cannot have FCS, assume no FCS. */
1811 fcs = 0;
1812 } else {
1813 /* Test for 4 octet FCS. */
1814 fcs = EXTRACT_LE_U_4(p + caplen - 4);
1815 crc_check = ieee802_15_4_crc32(p, caplen - 4);
1816 if (crc_check == fcs) {
1817 /* Remove FCS */
1818 caplen -= 4;
1819 } else {
1820 /* Test for 2 octet FCS. */
1821 fcs = EXTRACT_LE_U_2(p + caplen - 2);
1822 crc_check = ieee802_15_4_crc16(p, caplen - 2);
1823 if (crc_check == fcs) {
1824 /* Remove FCS */
1825 caplen -= 2;
1826 } else {
1827 /* Wrong FCS, FCS might not be included in the
1828 captured frame, do not remove it. */
1829 }
1830 }
1831 }
1832
1833 /* Frame version. */
1834 frame_version = FC_FRAME_VERSION(fc);
1835 frame_type = FC_FRAME_TYPE(fc);
1836 ND_PRINT("v%d ", frame_version);
1837
1838 if (ndo->ndo_vflag > 2) {
1839 if (CHECK_BIT(fc, 3)) { ND_PRINT("Security Enabled, "); }
1840 if (CHECK_BIT(fc, 4)) { ND_PRINT("Frame Pending, "); }
1841 if (CHECK_BIT(fc, 5)) { ND_PRINT("AR, "); }
1842 if (CHECK_BIT(fc, 6)) { ND_PRINT("PAN ID Compression, "); }
1843 if (CHECK_BIT(fc, 8)) { ND_PRINT("Sequence Number Suppression, "); }
1844 if (CHECK_BIT(fc, 9)) { ND_PRINT("IE present, "); }
1845 }
1846
1847 /* Check for the sequence number supression. */
1848 if (CHECK_BIT(fc, 8)) {
1849 /* Sequence number is suppressed. */
1850 if (frame_version < 2) {
1851 /* Sequence number can only be supressed for frame
1852 version 2 or higher, this is invalid frame. */
1853 ND_PRINT("[ERROR: Sequence number suppressed on frames where version < 2]");
1854 }
1855 if (ndo->ndo_vflag)
1856 ND_PRINT("seq suppressed ");
1857 p += 2;
1858 caplen -= 2;
1859 } else {
1860 seq = EXTRACT_U_1(p + 2);
1861 p += 3;
1862 caplen -= 3;
1863 if (ndo->ndo_vflag)
1864 ND_PRINT("seq %02x ", seq);
1865 }
1866
1867 /* See which parts of addresses we have. */
1868 dst_addr_len = ieee802_15_4_addr_len((fc >> 10) & 0x3);
1869 src_addr_len = ieee802_15_4_addr_len((fc >> 14) & 0x3);
1870 if (src_addr_len < 0) {
1871 ND_PRINT("[ERROR: Invalid src address mode]");
1872 return 0;
1873 }
1874 if (dst_addr_len < 0) {
1875 ND_PRINT("[ERROR: Invalid dst address mode]");
1876 return 0;
1877 }
1878 src_pan = 0;
1879 dst_pan = 0;
1880 pan_id_comp = CHECK_BIT(fc, 6);
1881
1882 /* The PAN ID Compression rules are complicated. */
1883
1884 /* First check old versions, where the rules are simple. */
1885 if (frame_version < 2) {
1886 if (pan_id_comp) {
1887 src_pan = 0;
1888 dst_pan = 1;
1889 if (dst_addr_len <= 0 || src_addr_len <= 0) {
1890 /* Invalid frame, PAN ID Compression must be 0
1891 if only one address in the frame. */
1892 ND_PRINT("[ERROR: PAN ID Compression != 0, and only one address with frame version < 2]");
1893 }
1894 } else {
1895 src_pan = 1;
1896 dst_pan = 1;
1897 }
1898 if (dst_addr_len <= 0) {
1899 dst_pan = 0;
1900 }
1901 if (src_addr_len <= 0) {
1902 src_pan = 0;
1903 }
1904 } else {
1905 /* Frame version 2 rules are more complicated, and they depend
1906 on the address modes of the frame, generic rules are same,
1907 but then there are some special cases. */
1908 if (pan_id_comp) {
1909 src_pan = 0;
1910 dst_pan = 1;
1911 } else {
1912 src_pan = 1;
1913 dst_pan = 1;
1914 }
1915 if (dst_addr_len <= 0) {
1916 dst_pan = 0;
1917 }
1918 if (src_addr_len <= 0) {
1919 src_pan = 0;
1920 }
1921 if (pan_id_comp) {
1922 if (src_addr_len == 0 &&
1923 dst_addr_len == 0) {
1924 /* Both addresses are missing, but PAN ID
1925 compression set, special case we have
1926 destination PAN but no addresses. */
1927 dst_pan = 1;
1928 } else if ((src_addr_len == 0 &&
1929 dst_addr_len > 0) ||
1930 (src_addr_len > 0 &&
1931 dst_addr_len == 0)) {
1932 /* Only one address present, and PAN ID
1933 compression is set, we do not have PAN id at
1934 all. */
1935 dst_pan = 0;
1936 src_pan = 0;
1937 } else if (src_addr_len == 8 &&
1938 dst_addr_len == 8) {
1939 /* Both addresses are Extended, and PAN ID
1940 compression set, we do not have PAN ID at
1941 all. */
1942 dst_pan = 0;
1943 src_pan = 0;
1944 }
1945 } else {
1946 /* Special cases where PAN ID Compression is not set. */
1947 if (src_addr_len == 8 &&
1948 dst_addr_len == 8) {
1949 /* Both addresses are Extended, and PAN ID
1950 compression not set, we do have only one PAN
1951 ID (destination). */
1952 dst_pan = 1;
1953 src_pan = 0;
1954 }
1955 #ifdef BROKEN_6TISCH_PAN_ID_COMPRESSION
1956 if (src_addr_len == 8 &&
1957 dst_addr_len == 2) {
1958 /* Special case for the broken 6tisch
1959 implementations. */
1960 src_pan = 0;
1961 }
1962 #endif /* BROKEN_6TISCH_PAN_ID_COMPRESSION */
1963 }
1964 }
1965
1966 /* Print dst PAN and address. */
1967 if (dst_pan) {
1968 if (caplen < 2) {
1969 ND_PRINT("[ERROR: Truncated before dst_pan]");
1970 return 0;
1971 }
1972 ND_PRINT("%04x:", EXTRACT_LE_U_2(p));
1973 p += 2;
1974 caplen -= 2;
1975 } else {
1976 ND_PRINT("-:");
1977 }
1978 if (caplen < (u_int) dst_addr_len) {
1979 ND_PRINT("[ERROR: Truncated before dst_addr]");
1980 return 0;
1981 }
1982 ieee802_15_4_print_addr(ndo, p, dst_addr_len);
1983 p += dst_addr_len;
1984 caplen -= dst_addr_len;
1985
1986 ND_PRINT(" < ");
1987
1988 /* Print src PAN and address. */
1989 if (src_pan) {
1990 if (caplen < 2) {
1991 ND_PRINT("[ERROR: Truncated before dst_pan]");
1992 return 0;
1993 }
1994 ND_PRINT("%04x:", EXTRACT_LE_U_2(p));
1995 p += 2;
1996 caplen -= 2;
1997 } else {
1998 ND_PRINT("-:");
1999 }
2000 if (caplen < (u_int) src_addr_len) {
2001 ND_PRINT("[ERROR: Truncated before dst_addr]");
2002 return 0;
2003 }
2004 ieee802_15_4_print_addr(ndo, p, src_addr_len);
2005 ND_PRINT(" ");
2006 p += src_addr_len;
2007 caplen -= src_addr_len;
2008 if (CHECK_BIT(fc, 3)) {
2009 len = ieee802_15_4_print_aux_sec_header(ndo, p, caplen,
2010 &security_level);
2011 if (len < 0) {
2012 return 0;
2013 }
2014 p += len;
2015 caplen -= len;
2016 } else {
2017 security_level = 0;
2018 }
2019
2020 switch (security_level) {
2021 case 0: /*FALLTHOUGH */
2022 case 4:
2023 miclen = 0;
2024 break;
2025 case 1: /*FALLTHOUGH */
2026 case 5:
2027 miclen = 4;
2028 break;
2029 case 2: /*FALLTHOUGH */
2030 case 6:
2031 miclen = 8;
2032 break;
2033 case 3: /*FALLTHOUGH */
2034 case 7:
2035 miclen = 16;
2036 break;
2037 }
2038
2039 /* Remove MIC */
2040 if (miclen > 0) {
2041 if (caplen < (u_int) miclen) {
2042 ND_PRINT("[ERROR: Truncated before MIC]");
2043 return 0;
2044 }
2045 caplen -= miclen;
2046 mic_start = p + caplen;
2047 }
2048
2049 /* Parse Information elements if present */
2050 if (CHECK_BIT(fc, 9)) {
2051 /* Yes we have those. */
2052 len = ieee802_15_4_print_header_ie_list(ndo, p, caplen,
2053 &payload_ie_present);
2054 if (len < 0) {
2055 return 0;
2056 }
2057 p += len;
2058 caplen -= len;
2059 }
2060
2061 if (payload_ie_present) {
2062 if (security_level >= 4) {
2063 ND_PRINT("Payload IEs present, but encrypted, cannot print ");
2064 } else {
2065 len = ieee802_15_4_print_payload_ie_list(ndo, p, caplen);
2066 if (len < 0) {
2067 return 0;
2068 }
2069 p += len;
2070 caplen -= len;
2071 }
2072 }
2073
2074 /* Print MIC */
2075 if (ndo->ndo_vflag > 2 && miclen != 0) {
2076 ND_PRINT("\n\tMIC ");
2077
2078 for(len = 0; len < miclen; len++) {
2079 ND_PRINT("%02x", EXTRACT_U_1(mic_start + len));
2080 }
2081 ND_PRINT(" ");
2082 }
2083
2084 /* Print FCS */
2085 if (ndo->ndo_vflag > 2) {
2086 if (crc_check == fcs) {
2087 ND_PRINT("FCS %x ", fcs);
2088 } else {
2089 ND_PRINT("wrong FCS %x vs %x (assume no FCS stored) ",
2090 fcs, crc_check);
2091 }
2092 }
2093
2094 /* Payload print */
2095 switch (frame_type) {
2096 case 0x00: /* Beacon */
2097 if (frame_version < 2) {
2098 if (caplen < 2) {
2099 ND_PRINT("[ERROR: Truncated before beacon information]");
2100 break;
2101 } else {
2102 uint16_t ss;
2103
2104 ss = EXTRACT_LE_U_2(p);
2105 ieee802_15_4_print_superframe_specification(ndo, ss);
2106 p += 2;
2107 caplen -= 2;
2108
2109 /* GTS */
2110 if (caplen < 1) {
2111 ND_PRINT("[ERROR: Truncated before GTS info]");
2112 break;
2113 }
2114
2115 len = ieee802_15_4_print_gts_info(ndo, p, caplen);
2116 if (len < 0) {
2117 break;
2118 }
2119
2120 p += len;
2121 caplen -= len;
2122
2123 /* Pending Addresses */
2124 if (caplen < 1) {
2125 ND_PRINT("[ERROR: Truncated before pending addresses]");
2126 break;
2127 }
2128 len = ieee802_15_4_print_pending_addresses(ndo, p, caplen);
2129 if (len < 0) {
2130 break;
2131 }
2132 p += len;
2133 caplen -= len;
2134 }
2135 }
2136 if (!ndo->ndo_suppress_default_print)
2137 ND_DEFAULTPRINT(p, caplen);
2138
2139 break;
2140 case 0x01: /* Data */
2141 case 0x02: /* Acknowledgement */
2142 if (!ndo->ndo_suppress_default_print)
2143 ND_DEFAULTPRINT(p, caplen);
2144 break;
2145 case 0x03: /* MAC Command */
2146 if (caplen < 1) {
2147 ND_PRINT("[ERROR: Truncated before Command ID]");
2148 } else {
2149 uint8_t command_id;
2150
2151 command_id = EXTRACT_U_1(p);
2152 if (command_id >= 0x30) {
2153 ND_PRINT("Command ID = Reserved 0x%02x ",
2154 command_id);
2155 } else {
2156 ND_PRINT("Command ID = %s ",
2157 mac_c_names[command_id]);
2158 }
2159 p++;
2160 caplen--;
2161 if (caplen != 0) {
2162 len = ieee802_15_4_print_command_data(ndo, command_id, p, caplen);
2163 if (len >= 0) {
2164 p += len;
2165 caplen -= len;
2166 }
2167 }
2168 }
2169 if (!ndo->ndo_suppress_default_print)
2170 ND_DEFAULTPRINT(p, caplen);
2171 break;
2172 }
2173 return 1;
2174 }
2175
2176 /*
2177 * Print and parse Multipurpose frames.
2178 *
2179 * Returns FALSE in case of error.
2180 */
2181 static u_int
2182 ieee802_15_4_mp_frame(netdissect_options *ndo,
2183 const u_char *p, u_int caplen,
2184 uint16_t fc)
2185 {
2186 int len, frame_version, pan_id_present;
2187 int src_addr_len, dst_addr_len;
2188 int security_level, miclen = 0;
2189 int ie_present, payload_ie_present, security_enabled;
2190 uint8_t seq;
2191 uint32_t fcs, crc_check;
2192 const u_char *mic_start = NULL;
2193
2194 pan_id_present = 0;
2195 ie_present = 0;
2196 payload_ie_present = 0;
2197 security_enabled = 0;
2198 crc_check = 0;
2199
2200 /* Assume 2 octet FCS, the FCS length depends on the PHY, and we do not
2201 know about that. */
2202 if (caplen < 3) {
2203 /* Cannot have FCS, assume no FCS. */
2204 fcs = 0;
2205 } else {
2206 if (caplen > 4) {
2207 /* Test for 4 octet FCS. */
2208 fcs = EXTRACT_LE_U_4(p + caplen - 4);
2209 crc_check = ieee802_15_4_crc32(p, caplen - 4);
2210 if (crc_check == fcs) {
2211 /* Remove FCS */
2212 caplen -= 4;
2213 } else {
2214 fcs = EXTRACT_LE_U_2(p + caplen - 2);
2215 crc_check = ieee802_15_4_crc16(p, caplen - 2);
2216 if (crc_check == fcs) {
2217 /* Remove FCS */
2218 caplen -= 2;
2219 }
2220 }
2221 } else {
2222 fcs = EXTRACT_LE_U_2(p + caplen - 2);
2223 crc_check = ieee802_15_4_crc16(p, caplen - 2);
2224 if (crc_check == fcs) {
2225 /* Remove FCS */
2226 caplen -= 2;
2227 }
2228 }
2229 }
2230
2231 if (CHECK_BIT(fc, 3)) {
2232 /* Long Frame Control */
2233
2234 /* Frame version. */
2235 frame_version = FC_FRAME_VERSION(fc);
2236 ND_PRINT("v%d ", frame_version);
2237
2238 pan_id_present = CHECK_BIT(fc, 8);
2239 ie_present = CHECK_BIT(fc, 15);
2240 security_enabled = CHECK_BIT(fc, 9);
2241
2242 if (ndo->ndo_vflag > 2) {
2243 if (security_enabled) { ND_PRINT("Security Enabled, "); }
2244 if (CHECK_BIT(fc, 11)) { ND_PRINT("Frame Pending, "); }
2245 if (CHECK_BIT(fc, 14)) { ND_PRINT("AR, "); }
2246 if (pan_id_present) { ND_PRINT("PAN ID Present, "); }
2247 if (CHECK_BIT(fc, 10)) {
2248 ND_PRINT("Sequence Number Suppression, ");
2249 }
2250 if (ie_present) { ND_PRINT("IE present, "); }
2251 }
2252
2253 /* Check for the sequence number supression. */
2254 if (CHECK_BIT(fc, 10)) {
2255 /* Sequence number is suppressed, but long version. */
2256 p += 2;
2257 caplen -= 2;
2258 } else {
2259 seq = EXTRACT_U_1(p + 2);
2260 p += 3;
2261 caplen -= 3;
2262 if (ndo->ndo_vflag)
2263 ND_PRINT("seq %02x ", seq);
2264 }
2265 } else {
2266 /* Short format of header, but with seq no */
2267 seq = EXTRACT_U_1(p + 1);
2268 p += 2;
2269 caplen -= 2;
2270 if (ndo->ndo_vflag)
2271 ND_PRINT("seq %02x ", seq);
2272 }
2273
2274 /* See which parts of addresses we have. */
2275 dst_addr_len = ieee802_15_4_addr_len((fc >> 4) & 0x3);
2276 src_addr_len = ieee802_15_4_addr_len((fc >> 6) & 0x3);
2277 if (src_addr_len < 0) {
2278 ND_PRINT("[ERROR: Invalid src address mode]");
2279 return 0;
2280 }
2281 if (dst_addr_len < 0) {
2282 ND_PRINT("[ERROR: Invalid dst address mode]");
2283 return 0;
2284 }
2285
2286 /* Print dst PAN and address. */
2287 if (pan_id_present) {
2288 if (caplen < 2) {
2289 ND_PRINT("[ERROR: Truncated before dst_pan]");
2290 return 0;
2291 }
2292 ND_PRINT("%04x:", EXTRACT_LE_U_2(p));
2293 p += 2;
2294 caplen -= 2;
2295 } else {
2296 ND_PRINT("-:");
2297 }
2298 if (caplen < (u_int) dst_addr_len) {
2299 ND_PRINT("[ERROR: Truncated before dst_addr]");
2300 return 0;
2301 }
2302 ieee802_15_4_print_addr(ndo, p, dst_addr_len);
2303 p += dst_addr_len;
2304 caplen -= dst_addr_len;
2305
2306 ND_PRINT(" < ");
2307
2308 /* Print src PAN and address. */
2309 ND_PRINT(" -:");
2310 if (caplen < (u_int) src_addr_len) {
2311 ND_PRINT("[ERROR: Truncated before dst_addr]");
2312 return 0;
2313 }
2314 ieee802_15_4_print_addr(ndo, p, src_addr_len);
2315 ND_PRINT(" ");
2316 p += src_addr_len;
2317 caplen -= src_addr_len;
2318
2319 if (security_enabled) {
2320 len = ieee802_15_4_print_aux_sec_header(ndo, p, caplen,
2321 &security_level);
2322 if (len < 0) {
2323 return 0;
2324 }
2325 p += len;
2326 caplen -= len;
2327 } else {
2328 security_level = 0;
2329 }
2330
2331 switch (security_level) {
2332 case 0: /*FALLTHOUGH */
2333 case 4:
2334 miclen = 0;
2335 break;
2336 case 1: /*FALLTHOUGH */
2337 case 5:
2338 miclen = 4;
2339 break;
2340 case 2: /*FALLTHOUGH */
2341 case 6:
2342 miclen = 8;
2343 break;
2344 case 3: /*FALLTHOUGH */
2345 case 7:
2346 miclen = 16;
2347 break;
2348 }
2349
2350 /* Remove MIC */
2351 if (miclen > 0) {
2352 if (caplen < (u_int) miclen) {
2353 ND_PRINT("[ERROR: Truncated before MIC]");
2354 return 0;
2355 }
2356 caplen -= miclen;
2357 mic_start = p + caplen;
2358 }
2359
2360 /* Parse Information elements if present */
2361 if (ie_present) {
2362 /* Yes we have those. */
2363 len = ieee802_15_4_print_header_ie_list(ndo, p, caplen,
2364 &payload_ie_present);
2365 if (len < 0) {
2366 return 0;
2367 }
2368 p += len;
2369 caplen -= len;
2370 }
2371
2372 if (payload_ie_present) {
2373 if (security_level >= 4) {
2374 ND_PRINT("Payload IEs present, but encrypted, cannot print ");
2375 } else {
2376 len = ieee802_15_4_print_payload_ie_list(ndo, p,
2377 caplen);
2378 if (len < 0) {
2379 return 0;
2380 }
2381 p += len;
2382 caplen -= len;
2383 }
2384 }
2385
2386 /* Print MIC */
2387 if (ndo->ndo_vflag > 2 && miclen != 0) {
2388 ND_PRINT("\n\tMIC ");
2389
2390 for(len = 0; len < miclen; len++) {
2391 ND_PRINT("%02x", EXTRACT_U_1(mic_start + len));
2392 }
2393 ND_PRINT(" ");
2394 }
2395
2396
2397 /* Print FCS */
2398 if (ndo->ndo_vflag > 2) {
2399 if (crc_check == fcs) {
2400 ND_PRINT("FCS %x ", fcs);
2401 } else {
2402 ND_PRINT("wrong FCS %x vs %x (assume no FCS stored) ",
2403 fcs, crc_check);
2404 }
2405 }
2406
2407 if (!ndo->ndo_suppress_default_print)
2408 ND_DEFAULTPRINT(p, caplen);
2409
2410 return 1;
2411 }
2412
2413 /*
2414 * Print frag frame.
2415 *
2416 * Returns FALSE in case of error.
2417 */
2418 static u_int
2419 ieee802_15_4_frag_frame(netdissect_options *ndo _U_,
2420 const u_char *p _U_,
2421 u_int caplen _U_,
2422 uint16_t fc _U_)
2423 {
2424 /* Not implement yet, might be bit hard to implement, as the
2425 * information to set up the fragment is coming in the previous frame
2426 * in the Fragment Sequence Context Description IE, thus we need to
2427 * store information from there, so we can use it here. */
2428 return 0;
2429 }
2430
2431 /*
2432 * Interal call to dissector taking packet + len instead of pcap_pkthdr.
2433 *
2434 * Returns FALSE in case of error.
2435 */
2436 u_int
2437 ieee802_15_4_print(netdissect_options *ndo,
2438 const u_char *p, u_int caplen)
2439 {
2440 int frame_type;
2441 uint16_t fc;
2442
2443 ndo->ndo_protocol ="802.15.4";
2444
2445 if (caplen < 2) {
2446 nd_print_trunc(ndo);
2447 return caplen;
2448 }
2449
2450 fc = EXTRACT_LE_U_2(p);
2451
2452 /* First we need to check the frame type to know how to parse the rest
2453 of the FC. Frame type is the first 3 bit of the frame control field.
2454 */
2455
2456 frame_type = FC_FRAME_TYPE(fc);
2457 ND_PRINT("IEEE 802.15.4 %s packet ", ftypes[frame_type]);
2458
2459 switch (frame_type) {
2460 case 0x00: /* Beacon */
2461 case 0x01: /* Data */
2462 case 0x02: /* Acknowledgement */
2463 case 0x03: /* MAC Command */
2464 return ieee802_15_4_std_frames(ndo, p, caplen, fc);
2465 break;
2466 case 0x04: /* Reserved */
2467 return 0;
2468 break;
2469 case 0x05: /* Multipurpose */
2470 return ieee802_15_4_mp_frame(ndo, p, caplen, fc);
2471 break;
2472 case 0x06: /* Fragment or Frak */
2473 return ieee802_15_4_frag_frame(ndo, p, caplen, fc);
2474 break;
2475 case 0x07: /* Extended */
2476 return 0;
2477 break;
2478 }
2479 return 0;
2480 }
2481
2482 /*
2483 * Main function to print packets.
2484 */
2485
2486 u_int
2487 ieee802_15_4_if_print(netdissect_options *ndo,
2488 const struct pcap_pkthdr *h, const u_char *p)
2489 {
2490 u_int caplen = h->caplen;
2491 ndo->ndo_protocol ="802.15.4_if";
2492 return ieee802_15_4_print(ndo, p, caplen);
2493 }
2494
2495 /* For DLT_IEEE802_15_4_TAP */
2496 /* https://github.com/jkcko/ieee802.15.4-tap */
2497 u_int
2498 ieee802_15_4_tap_if_print(netdissect_options *ndo,
2499 const struct pcap_pkthdr *h, const u_char *p)
2500 {
2501 uint8_t version;
2502 uint16_t length;
2503
2504 ndo->ndo_protocol = "802.15.4_tap";
2505 if (h->caplen < 4) {
2506 nd_print_trunc(ndo);
2507 return h->caplen;
2508 }
2509
2510 version = EXTRACT_U_1(p);
2511 length = EXTRACT_LE_U_2(p+2);
2512 if (version != 0 || length < 4) {
2513 nd_print_invalid(ndo);
2514 return 0;
2515 }
2516
2517 if (h->caplen < length) {
2518 nd_print_trunc(ndo);
2519 return h->caplen;
2520 }
2521
2522 return ieee802_15_4_print(ndo, p+length, h->caplen-length) + length;
2523 }
2524
2525 /*
2526 * Local Variables:
2527 * c-style: whitesmith
2528 * c-basic-offset: 8
2529 * End:
2530 */
2531
[mirror] the TCPdump network dissector