epan/dissectors/packet-pdcp-lte.c

   1 /* Routines for LTE PDCP
   2  *
   3  * Martin Mathieson
   4  *
   5  * $Id$
   6  *
   7  * Wireshark - Network traffic analyzer
   8  * By Gerald Combs <gerald@wireshark.org>
   9  * Copyright 1998 Gerald Combs
  10  *
  11  * This program is free software; you can redistribute it and/or
  12  * modify it under the terms of the GNU General Public License
  13  * as published by the Free Software Foundation; either version 2
  14  * of the License, or (at your option) any later version.
  15  *
  16  * This program is distributed in the hope that it will be useful,
  17  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  18  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19  * GNU General Public License for more details.
  20  *
  21  * You should have received a copy of the GNU General Public License
  22  * along with this program; if not, write to the Free Software
  23  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  24  */
  25
  26 #include "config.h"
  27
  28 #include <string.h>
  29
  30 #include <glib.h>
  31 #include <epan/packet.h>
  32 #include <epan/prefs.h>
  33 #include <epan/expert.h>
  34 #include <epan/addr_resolv.h>
  35 #include <epan/wmem/wmem.h>
  36
  37 #include <epan/uat.h>
  38
  39 #ifdef HAVE_LIBGCRYPT
  40 #include <wsutil/wsgcrypt.h>
  41 #endif /* HAVE_LIBGCRYPT */
  42
  43 /* Define this symbol if you have a working implementation of SNOW3G f8() and f9() available */
  44 /* #define HAVE_SNOW3G */
  45 #ifdef HAVE_SNOW3G
  46 #include <epan/snow3g_algorithm.h>
  47 #endif
  48
  49 #include "packet-rlc-lte.h"
  50 #include "packet-pdcp-lte.h"
  51
  52 void proto_register_pdcp(void);
  53 void proto_reg_handoff_pdcp_lte(void);
  54
  55 /* Described in:
  56  * 3GPP TS 36.323 Evolved Universal Terrestrial Radio Access (E-UTRA)
  57  *                Packet Data Convergence Protocol (PDCP) specification v11.0.0
  58  */
  59
  60
  61 /* TODO:
  62    - More deciphering. Next steps are:
  63        - Verify MAC authentication bytes for supported protocol(s)?
  64           - code that doesn't quite work against gcrypt 1.6 is #if 0'd out...
  65    - Add Relay Node user plane data PDU dissection
  66 */
  67
  68
  69 /* Initialize the protocol and registered fields. */
  70 int proto_pdcp_lte = -1;
  71
  72 extern int proto_rlc_lte;
  73
  74 /* Configuration (info known outside of PDU) */
  75 static int hf_pdcp_lte_configuration = -1;
  76 static int hf_pdcp_lte_direction = -1;
  77 static int hf_pdcp_lte_ueid = -1;
  78 static int hf_pdcp_lte_channel_type = -1;
  79 static int hf_pdcp_lte_channel_id = -1;
  80
  81 static int hf_pdcp_lte_rohc_compression = -1;
  82 static int hf_pdcp_lte_rohc_mode = -1;
  83 static int hf_pdcp_lte_rohc_rnd = -1;
  84 static int hf_pdcp_lte_rohc_udp_checksum_present = -1;
  85 static int hf_pdcp_lte_rohc_profile = -1;
  86
  87 static int hf_pdcp_lte_no_header_pdu = -1;
  88 static int hf_pdcp_lte_plane = -1;
  89 static int hf_pdcp_lte_seqnum_length = -1;
  90 static int hf_pdcp_lte_cid_inclusion_info = -1;
  91 static int hf_pdcp_lte_large_cid_present = -1;
  92
  93 /* PDCP header fields */
  94 static int hf_pdcp_lte_control_plane_reserved = -1;
  95 static int hf_pdcp_lte_seq_num_5 = -1;
  96 static int hf_pdcp_lte_seq_num_7 = -1;
  97 static int hf_pdcp_lte_reserved3 = -1;
  98 static int hf_pdcp_lte_seq_num_12 = -1;
  99 static int hf_pdcp_lte_seq_num_15 = -1;
 100 static int hf_pdcp_lte_signalling_data = -1;
 101 static int hf_pdcp_lte_mac = -1;
 102 static int hf_pdcp_lte_data_control = -1;
 103 static int hf_pdcp_lte_user_plane_data = -1;
 104 static int hf_pdcp_lte_control_pdu_type = -1;
 105 static int hf_pdcp_lte_fms = -1;
 106 static int hf_pdcp_lte_reserved4 = -1;
 107 static int hf_pdcp_lte_fms2 = -1;
 108 static int hf_pdcp_lte_bitmap = -1;
 109
 110
 111 /* Sequence Analysis */
 112 static int hf_pdcp_lte_sequence_analysis = -1;
 113 static int hf_pdcp_lte_sequence_analysis_ok = -1;
 114 static int hf_pdcp_lte_sequence_analysis_previous_frame = -1;
 115 static int hf_pdcp_lte_sequence_analysis_next_frame = -1;
 116 static int hf_pdcp_lte_sequence_analysis_expected_sn = -1;
 117
 118 static int hf_pdcp_lte_sequence_analysis_repeated = -1;
 119 static int hf_pdcp_lte_sequence_analysis_skipped = -1;
 120
 121 /* Security Settings */
 122 static int hf_pdcp_lte_security = -1;
 123 static int hf_pdcp_lte_security_setup_frame = -1;
 124 static int hf_pdcp_lte_security_integrity_algorithm = -1;
 125 static int hf_pdcp_lte_security_ciphering_algorithm = -1;
 126
 127 static int hf_pdcp_lte_security_bearer = -1;
 128 static int hf_pdcp_lte_security_direction = -1;
 129 static int hf_pdcp_lte_security_count = -1;
 130 static int hf_pdcp_lte_security_cipher_key = -1;
 131 static int hf_pdcp_lte_security_integrity_key = -1;
 132
 133
 134
 135 /* Protocol subtree. */
 136 static int ett_pdcp = -1;
 137 static int ett_pdcp_configuration = -1;
 138 static int ett_pdcp_packet = -1;
 139 static int ett_pdcp_lte_sequence_analysis = -1;
 140 static int ett_pdcp_report_bitmap = -1;
 141 static int ett_pdcp_security = -1;
 142
 143 static expert_field ei_pdcp_lte_sequence_analysis_wrong_sequence_number = EI_INIT;
 144 static expert_field ei_pdcp_lte_reserved_bits_not_zero = EI_INIT;
 145 static expert_field ei_pdcp_lte_sequence_analysis_sn_repeated = EI_INIT;
 146 static expert_field ei_pdcp_lte_sequence_analysis_sn_missing = EI_INIT;
 147 static expert_field ei_pdcp_lte_digest_wrong = EI_INIT;
 148
 149 /*-------------------------------------
 150  * UAT for UE Keys
 151  *-------------------------------------
 152  */
 153 /* UAT entry structure. */
 154 typedef struct {
 155    guint16 ueid;
 156    gchar   *rrcCipherKeyString;
 157    gchar   *upCipherKeyString;
 158    gchar   *rrcIntegrityKeyString;
 159
 160    guint8   rrcCipherBinaryKey[16];
 161    gboolean rrcCipherKeyOK;
 162    guint8   upCipherBinaryKey[16];
 163    gboolean upCipherKeyOK;
 164    guint8   rrcIntegrityBinaryKey[16];
 165    gboolean rrcIntegrityKeyOK;
 166 } uat_ue_keys_record_t;
 167
 168 static uat_ue_keys_record_t *uat_ue_keys_records = NULL;
 169
 170 static uat_t * ue_keys_uat = NULL;
 171 static guint num_ue_keys_uat = 0;
 172
 173 /* Convert an ascii hex character into a digit.  Should only be given valid
 174    hex ascii characters */
 175 static guchar hex_ascii_to_binary(gchar c)
 176 {
 177     if ((c >= '0') && (c <= '9')) {
 178         return c - '0';
 179     }
 180     else if ((c >= 'a') && (c <= 'f')) {
 181         return 10 + c - 'a';
 182     }
 183     else if ((c >= 'A') && (c <= 'F')) {
 184         return 10 + c - 'A';
 185     }
 186     else
 187         return 0;
 188 }
 189
 190
 191 static void* uat_ue_keys_record_copy_cb(void* n, const void* o, size_t siz _U_) {
 192     uat_ue_keys_record_t* new_rec = (uat_ue_keys_record_t *)n;
 193     const uat_ue_keys_record_t* old_rec = (const uat_ue_keys_record_t *)o;
 194
 195     new_rec->ueid = old_rec->ueid;
 196     new_rec->rrcCipherKeyString = (old_rec->rrcCipherKeyString) ? g_strdup(old_rec->rrcCipherKeyString) : NULL;
 197     new_rec->upCipherKeyString = (old_rec->upCipherKeyString) ? g_strdup(old_rec->upCipherKeyString) : NULL;
 198     new_rec->rrcIntegrityKeyString = (old_rec->rrcIntegrityKeyString) ? g_strdup(old_rec->rrcIntegrityKeyString) : NULL;
 199
 200     return new_rec;
 201 }
 202
 203
 204 static gboolean check_valid_key_sring(const char* raw_string, char* checked_string)
 205 {
 206     guint n;
 207     guint written = 0;
 208     guint length = (gint)strlen(raw_string);
 209
 210     /* Can't be valid if not long enough. */
 211     if (length < 32) {
 212         return FALSE;
 213     }
 214
 215     for (n=0; (n < length) && (written < 32); n++) {
 216         char c = raw_string[n];
 217
 218         /* Skipping past allowed 'padding' characters */
 219         if ((c == ' ') || (c == '-')) {
 220             continue;
 221         }
 222
 223         /* Other characters must be hex digits, otherwise string is invalid */
 224         if (((c >= '0') && (c <= '9')) ||
 225             ((c >= 'a') && (c <= 'f')) ||
 226             ((c >= 'A') && (c <= 'F'))) {
 227             checked_string[written++] = c;
 228         }
 229         else {
 230             return FALSE;
 231         }
 232     }
 233
 234     /* Must have found exactly 32 hex ascii chars for 16-byte key */
 235     return (written == 32);
 236 }
 237
 238 static void uat_ue_keys_record_update_cb(void* record, const char** error _U_) {
 239     uat_ue_keys_record_t* rec = (uat_ue_keys_record_t *)record;
 240     int n;
 241     char cleanString[32];
 242
 243     /* Check and convert RRC key */
 244     if (!check_valid_key_sring(rec->rrcCipherKeyString, cleanString)) {
 245         rec->rrcCipherKeyOK = FALSE;
 246     }
 247     else {
 248         for (n=0; n < 32; n += 2) {
 249             rec->rrcCipherBinaryKey[n/2] = (hex_ascii_to_binary(cleanString[n]) << 4) +
 250                                             hex_ascii_to_binary(cleanString[n+1]);
 251         }
 252         rec->rrcCipherKeyOK = TRUE;
 253     }
 254
 255     /* Check and convert User-plane key */
 256     if (!check_valid_key_sring(rec->upCipherKeyString, cleanString)) {
 257         rec->upCipherKeyOK = FALSE;
 258     }
 259     else {
 260         for (n=0; n < 32; n += 2) {
 261             rec->upCipherBinaryKey[n/2] = (hex_ascii_to_binary(cleanString[n]) << 4) +
 262                                            hex_ascii_to_binary(cleanString[n+1]);
 263         }
 264         rec->upCipherKeyOK = TRUE;
 265     }
 266
 267     /* Check and convert Integrity key */
 268     if (!check_valid_key_sring(rec->rrcIntegrityKeyString, cleanString)) {
 269         rec->rrcIntegrityKeyOK = FALSE;
 270     }
 271     else {
 272         for (n=0; n < 32; n += 2) {
 273             rec->rrcIntegrityBinaryKey[n/2] = (hex_ascii_to_binary(cleanString[n]) << 4) +
 274                                                hex_ascii_to_binary(cleanString[n+1]);
 275         }
 276         rec->rrcIntegrityKeyOK = TRUE;
 277     }
 278 }
 279
 280
 281 static void uat_ue_keys_record_free_cb(void*r) {
 282     uat_ue_keys_record_t* rec = (uat_ue_keys_record_t*)r;
 283
 284     g_free(rec->rrcCipherKeyString);
 285     g_free(rec->upCipherKeyString);
 286     g_free(rec->rrcIntegrityKeyString);
 287 }
 288
 289 UAT_DEC_CB_DEF(uat_ue_keys_records, ueid, uat_ue_keys_record_t)
 290 UAT_CSTRING_CB_DEF(uat_ue_keys_records, rrcCipherKeyString, uat_ue_keys_record_t)
 291 UAT_CSTRING_CB_DEF(uat_ue_keys_records, upCipherKeyString,  uat_ue_keys_record_t)
 292 UAT_CSTRING_CB_DEF(uat_ue_keys_records, rrcIntegrityKeyString,  uat_ue_keys_record_t)
 293
 294 static gboolean global_pdcp_decipher_signalling = FALSE;
 295 static gboolean global_pdcp_decipher_userplane = FALSE;
 296 static gboolean global_pdcp_check_integrity = FALSE;
 297
 298 static const value_string direction_vals[] =
 299 {
 300     { DIRECTION_UPLINK,      "Uplink"},
 301     { DIRECTION_DOWNLINK,    "Downlink"},
 302     { 0, NULL }
 303 };
 304
 305
 306 static const value_string pdcp_plane_vals[] = {
 307     { SIGNALING_PLANE,    "Signalling" },
 308     { USER_PLANE,         "User" },
 309     { 0,   NULL }
 310 };
 311
 312 static const value_string logical_channel_vals[] = {
 313     { Channel_DCCH,  "DCCH"},
 314     { Channel_BCCH,  "BCCH"},
 315     { Channel_CCCH,  "CCCH"},
 316     { Channel_PCCH,  "PCCH"},
 317     { 0,             NULL}
 318 };
 319
 320 static const value_string rohc_mode_vals[] = {
 321     { UNIDIRECTIONAL,            "Unidirectional" },
 322     { OPTIMISTIC_BIDIRECTIONAL,  "Optimistic Bidirectional" },
 323     { RELIABLE_BIDIRECTIONAL,    "Reliable Bidirectional" },
 324     { 0,   NULL }
 325 };
 326
 327
 328 /* Values taken from:
 329    http://www.iana.org/assignments/rohc-pro-ids/rohc-pro-ids.txt */
 330 static const value_string rohc_profile_vals[] = {
 331     { 0x0000,   "ROHC uncompressed" },      /* [RFC5795] */
 332     { 0x0001,   "ROHC RTP" },               /* [RFC3095] */
 333     { 0x0101,   "ROHCv2 RTP" },             /* [RFC5225] */
 334     { 0x0002,   "ROHC UDP" },               /* [RFC3095] */
 335     { 0x0102,   "ROHCv2 UDP" },             /* [RFC5225] */
 336     { 0x0003,   "ROHC ESP" },               /* [RFC3095] */
 337     { 0x0103,   "ROHCv2 ESP" },             /* [RFC5225] */
 338     { 0x0004,   "ROHC IP" },                /* [RFC3843] */
 339     { 0x0104,   "ROHCv2 IP" },              /* [RFC5225] */
 340     { 0x0005,   "ROHC LLA" },               /* [RFC4362] */
 341     { 0x0105,   "ROHC LLA with R-mode" },   /* [RFC3408] */
 342     { 0x0006,   "ROHC TCP" },               /* [RFC4996] */
 343     { 0x0007,   "ROHC RTP/UDP-Lite" },      /* [RFC4019] */
 344     { 0x0107,   "ROHCv2 RTP/UDP-Lite" },    /* [RFC5225] */
 345     { 0x0008,   "ROHC UDP-Lite" },          /* [RFC4019] */
 346     { 0x0108,   "ROHCv2 UDP-Lite" },        /* [RFC5225] */
 347     { 0,   NULL }
 348 };
 349
 350 static const value_string pdu_type_vals[] = {
 351     { 0,   "Control PDU" },
 352     { 1,   "Data PDU" },
 353     { 0,   NULL }
 354 };
 355
 356 static const value_string control_pdu_type_vals[] = {
 357     { 0,   "PDCP Status report" },
 358     { 1,   "Header Compression Feedback Information" },
 359     { 0,   NULL }
 360 };
 361
 362 static const value_string integrity_algorithm_vals[] = {
 363     { 0,   "EIA0" },
 364     { 1,   "EIA1" },
 365     { 2,   "EIA2" },
 366     { 0,   NULL }
 367 };
 368
 369 static const value_string ciphering_algorithm_vals[] = {
 370     { 0,   "EEA0" },
 371     { 1,   "EEA1" },
 372     { 2,   "EEA2" },
 373     { 0,   NULL }
 374 };
 375
 376
 377 static dissector_handle_t ip_handle;
 378 static dissector_handle_t ipv6_handle;
 379 static dissector_handle_t rohc_handle;
 380 static dissector_handle_t data_handle;
 381
 382
 383 #define SEQUENCE_ANALYSIS_RLC_ONLY  1
 384 #define SEQUENCE_ANALYSIS_PDCP_ONLY 2
 385
 386 /* Preference variables */
 387 static gboolean global_pdcp_dissect_user_plane_as_ip = TRUE;
 388 static gboolean global_pdcp_dissect_signalling_plane_as_rrc = TRUE;
 389 static gint     global_pdcp_check_sequence_numbers = TRUE;
 390 static gboolean global_pdcp_dissect_rohc = FALSE;
 391
 392 /* Which layer info to show in the info column */
 393 enum layer_to_show {
 394     ShowRLCLayer, ShowPDCPLayer, ShowTrafficLayer
 395 };
 396 static gint     global_pdcp_lte_layer_to_show = (gint)ShowRLCLayer;
 397
 398
 399
 400 /**************************************************/
 401 /* Sequence number analysis                       */
 402
 403 /* Channel key */
 404 typedef struct
 405 {
 406     /* Using bit fields to fit into 32 bits, so avoiding the need to allocate
 407        heap memory for these structs */
 408     guint           ueId : 16;
 409     guint           plane : 2;
 410     guint           channelId : 6;
 411     guint           direction : 1;
 412     guint           notUsed : 7;
 413 } pdcp_channel_hash_key;
 414
 415 /* Channel state */
 416 typedef struct
 417 {
 418     guint16  previousSequenceNumber;
 419     guint32  previousFrameNum;
 420     guint32  hfn;
 421 } pdcp_channel_status;
 422
 423 /* The sequence analysis channel hash table.
 424    Maps key -> status */
 425 static GHashTable *pdcp_sequence_analysis_channel_hash = NULL;
 426
 427 /* Equal keys */
 428 static gint pdcp_channel_equal(gconstpointer v, gconstpointer v2)
 429 {
 430     /* Key fits in 4 bytes, so just compare pointers! */
 431     return (v == v2);
 432 }
 433
 434 /* Compute a hash value for a given key. */
 435 static guint pdcp_channel_hash_func(gconstpointer v)
 436 {
 437     /* Just use pointer, as the fields are all in this value */
 438     return GPOINTER_TO_UINT(v);
 439 }
 440
 441
 442 /* Hash table types & functions for frame reports */
 443
 444 typedef struct {
 445     guint32         frameNumber;
 446     guint32         SN :       15;
 447     guint32         plane :    2;
 448     guint32         channelId: 5;
 449     guint32         direction: 1;
 450     guint32         notUsed :  9;
 451 } pdcp_result_hash_key;
 452
 453 static gint pdcp_result_hash_equal(gconstpointer v, gconstpointer v2)
 454 {
 455     const pdcp_result_hash_key* val1 = (const pdcp_result_hash_key *)v;
 456     const pdcp_result_hash_key* val2 = (const pdcp_result_hash_key *)v2;
 457
 458     /* All fields must match */
 459     return (memcmp(val1, val2, sizeof(pdcp_result_hash_key)) == 0);
 460 }
 461
 462 /* Compute a hash value for a given key. */
 463 static guint pdcp_result_hash_func(gconstpointer v)
 464 {
 465     const pdcp_result_hash_key* val1 = (const pdcp_result_hash_key *)v;
 466
 467     /* TODO: This is a bit random.  */
 468     return val1->frameNumber + (val1->channelId<<13) +
 469                                (val1->plane<<5) +
 470                                (val1->SN<<18) +
 471                                (val1->direction<<9);
 472 }
 473
 474 /* pdcp_channel_hash_key fits into the pointer, so just copy the value into
 475    a guint, cast to apointer and return that as the key */
 476 static gpointer get_channel_hash_key(pdcp_channel_hash_key *key)
 477 {
 478     guint  asInt = 0;
 479     /* TODO: assert that sizeof(pdcp_channel_hash_key) <= sizeof(guint) ? */
 480     memcpy(&asInt, key, sizeof(pdcp_channel_hash_key));
 481     return GUINT_TO_POINTER(asInt);
 482 }
 483
 484 /* Convenience function to get a pointer for the hash_func to work with */
 485 static gpointer get_report_hash_key(guint16 SN, guint32 frameNumber,
 486                                     pdcp_lte_info *p_pdcp_lte_info,
 487                                     gboolean do_persist)
 488 {
 489     static pdcp_result_hash_key  key;
 490     pdcp_result_hash_key        *p_key;
 491
 492     /* Only allocate a struct when will be adding entry */
 493     if (do_persist) {
 494         p_key = wmem_new(wmem_file_scope(), pdcp_result_hash_key);
 495     }
 496     else {
 497         memset(&key, 0, sizeof(pdcp_result_hash_key));
 498         p_key = &key;
 499     }
 500
 501     /* Fill in details, and return pointer */
 502     p_key->frameNumber = frameNumber;
 503     p_key->SN = SN;
 504     p_key->plane = (guint8)p_pdcp_lte_info->plane;
 505     p_key->channelId = p_pdcp_lte_info->channelId;
 506     p_key->direction = p_pdcp_lte_info->direction;
 507     p_key->notUsed = 0;
 508
 509     return p_key;
 510 }
 511
 512
 513 /* Info to attach to frame when first read, recording what to show about sequence */
 514 typedef enum
 515 {
 516     SN_OK, SN_Repeated, SN_MAC_Retx, SN_Retx, SN_Missing
 517 } sequence_state;
 518 typedef struct
 519 {
 520     gboolean sequenceExpectedCorrect;
 521     guint16  sequenceExpected;
 522     guint32  previousFrameNum;
 523     guint32  nextFrameNum;
 524
 525     guint16  firstSN;
 526     guint16  lastSN;
 527     guint32  hfn;
 528
 529     sequence_state state;
 530 } pdcp_sequence_report_in_frame;
 531
 532 /* The sequence analysis frame report hash table.
 533    Maps pdcp_result_hash_key* -> pdcp_sequence_report_in_frame* */
 534 static GHashTable *pdcp_lte_sequence_analysis_report_hash = NULL;
 535
 536 /* Gather together security settings in order to be able to do deciphering */
 537 typedef struct pdu_security_settings_t
 538 {
 539     enum security_ciphering_algorithm_e ciphering;
 540     enum security_integrity_algorithm_e integrity;
 541     guint8* cipherKey;
 542     guint8* integrityKey;
 543     gboolean cipherKeyValid;
 544     gboolean integrityKeyValid;
 545     guint32 count;
 546     guint8  bearer;
 547     guint8  direction;
 548 } pdu_security_settings_t;
 549
 550
 551 /* Add to the tree values associated with sequence analysis for this frame */
 552 static void addChannelSequenceInfo(pdcp_sequence_report_in_frame *p,
 553                                    pdcp_lte_info *p_pdcp_lte_info,
 554                                    guint16   sequenceNumber,
 555                                    packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb,
 556                                    proto_tree *security_tree,
 557                                    pdu_security_settings_t *pdu_security)
 558 {
 559     proto_tree *seqnum_tree;
 560     proto_item *seqnum_ti;
 561     proto_item *ti_expected_sn;
 562     proto_item *ti;
 563
 564     /* Create subtree */
 565     seqnum_ti = proto_tree_add_string_format(tree,
 566                                              hf_pdcp_lte_sequence_analysis,
 567                                              tvb, 0, 0,
 568                                              "", "Sequence Analysis");
 569     seqnum_tree = proto_item_add_subtree(seqnum_ti,
 570                                          ett_pdcp_lte_sequence_analysis);
 571     PROTO_ITEM_SET_GENERATED(seqnum_ti);
 572
 573
 574     /* Previous channel frame */
 575     if (p->previousFrameNum != 0) {
 576         proto_tree_add_uint(seqnum_tree, hf_pdcp_lte_sequence_analysis_previous_frame,
 577                             tvb, 0, 0, p->previousFrameNum);
 578     }
 579
 580     /* Expected sequence number */
 581     ti_expected_sn = proto_tree_add_uint(seqnum_tree, hf_pdcp_lte_sequence_analysis_expected_sn,
 582                                          tvb, 0, 0, p->sequenceExpected);
 583     PROTO_ITEM_SET_GENERATED(ti_expected_sn);
 584
 585     /* Make sure we have recognised SN length */
 586     switch (p_pdcp_lte_info->seqnum_length) {
 587         case PDCP_SN_LENGTH_5_BITS:
 588         case PDCP_SN_LENGTH_7_BITS:
 589         case PDCP_SN_LENGTH_12_BITS:
 590         case PDCP_SN_LENGTH_15_BITS:
 591             break;
 592         default:
 593             DISSECTOR_ASSERT_NOT_REACHED();
 594             break;
 595     }
 596
 597     switch (p->state) {
 598         case SN_OK:
 599             PROTO_ITEM_SET_HIDDEN(ti_expected_sn);
 600             ti = proto_tree_add_boolean(seqnum_tree, hf_pdcp_lte_sequence_analysis_ok,
 601                                         tvb, 0, 0, TRUE);
 602             PROTO_ITEM_SET_GENERATED(ti);
 603             proto_item_append_text(seqnum_ti, " - OK");
 604
 605             /* Link to next SN in channel (if known) */
 606             if (p->nextFrameNum != 0) {
 607                 proto_tree_add_uint(seqnum_tree, hf_pdcp_lte_sequence_analysis_next_frame,
 608                                     tvb, 0, 0, p->nextFrameNum);
 609             }
 610
 611             /* May also be able to add key inputs to security tree here */
 612             if ((pdu_security->ciphering != eea0) ||
 613                 (pdu_security->integrity != eia0)) {
 614                 guint32              hfn_multiplier;
 615                 guint32              count;
 616                 gchar                *cipher_key = NULL;
 617                 gchar                *integrity_key = NULL;
 618                 guint                record_id;
 619
 620                 /* BEARER */
 621                 ti = proto_tree_add_uint(security_tree, hf_pdcp_lte_security_bearer,
 622                                          tvb, 0, 0, p_pdcp_lte_info->channelId-1);
 623                 PROTO_ITEM_SET_GENERATED(ti);
 624                 pdu_security->bearer = p_pdcp_lte_info->channelId-1;
 625
 626                 /* DIRECTION */
 627                 ti = proto_tree_add_uint(security_tree, hf_pdcp_lte_security_direction,
 628                                          tvb, 0, 0, p_pdcp_lte_info->direction);
 629                 PROTO_ITEM_SET_GENERATED(ti);
 630
 631                 /* COUNT (HFN * snLength^2 + SN) */
 632                 switch (p_pdcp_lte_info->seqnum_length) {
 633                     case PDCP_SN_LENGTH_5_BITS:
 634                         hfn_multiplier = 32;
 635                         break;
 636                     case PDCP_SN_LENGTH_7_BITS:
 637                         hfn_multiplier = 128;
 638                         break;
 639                     case PDCP_SN_LENGTH_12_BITS:
 640                         hfn_multiplier = 2048;
 641                         break;
 642                     case PDCP_SN_LENGTH_15_BITS:
 643                         hfn_multiplier = 32768;
 644                         break;
 645                     default:
 646                         DISSECTOR_ASSERT_NOT_REACHED();
 647                         break;
 648                 }
 649                 count = (p->hfn * hfn_multiplier) + sequenceNumber;
 650                 ti = proto_tree_add_uint(security_tree, hf_pdcp_lte_security_count,
 651                                          tvb, 0, 0, count);
 652                 PROTO_ITEM_SET_GENERATED(ti);
 653                 pdu_security->count = count;
 654
 655                 /* KEY.  Look this UE up among UEs that have keys configured */
 656                 for (record_id=0; record_id < num_ue_keys_uat; record_id++) {
 657                     if (uat_ue_keys_records[record_id].ueid == p_pdcp_lte_info->ueid) {
 658                         if (p_pdcp_lte_info->plane == SIGNALING_PLANE) {
 659                             /* Get RRC ciphering key */
 660                             if (uat_ue_keys_records[record_id].rrcCipherKeyOK) {
 661                                 cipher_key = uat_ue_keys_records[record_id].rrcCipherKeyString;
 662                                 pdu_security->cipherKey = &(uat_ue_keys_records[record_id].rrcCipherBinaryKey[0]);
 663                                 pdu_security->cipherKeyValid = TRUE;
 664                             }
 665                             /* Get RRC integrity key */
 666                             if (uat_ue_keys_records[record_id].rrcIntegrityKeyOK) {
 667                                 integrity_key = uat_ue_keys_records[record_id].rrcIntegrityKeyString;
 668                                 pdu_security->integrityKey = &(uat_ue_keys_records[record_id].rrcIntegrityBinaryKey[0]);
 669                                 pdu_security->integrityKeyValid = TRUE;
 670                             }
 671                         }
 672                         else {
 673                             /* Get userplane ciphering key */
 674                             if (uat_ue_keys_records[record_id].upCipherKeyOK) {
 675                                 cipher_key = uat_ue_keys_records[record_id].upCipherKeyString;
 676                                 pdu_security->cipherKey = &(uat_ue_keys_records[record_id].upCipherBinaryKey[0]);
 677                                 pdu_security->cipherKeyValid = TRUE;
 678                             }
 679                         }
 680
 681                         /* Show keys where known and valid */
 682                         if (cipher_key != NULL) {
 683                             ti = proto_tree_add_string(security_tree, hf_pdcp_lte_security_cipher_key,
 684                                                        tvb, 0, 0, cipher_key);
 685                             PROTO_ITEM_SET_GENERATED(ti);
 686                         }
 687                         if (integrity_key != NULL) {
 688                             ti = proto_tree_add_string(security_tree, hf_pdcp_lte_security_integrity_key,
 689                                                        tvb, 0, 0, integrity_key);
 690                             PROTO_ITEM_SET_GENERATED(ti);
 691                         }
 692                         break;
 693                     }
 694                 }
 695                 pdu_security->direction = p_pdcp_lte_info->direction;
 696             }
 697             break;
 698
 699         case SN_Missing:
 700             ti = proto_tree_add_boolean(seqnum_tree, hf_pdcp_lte_sequence_analysis_ok,
 701                                         tvb, 0, 0, FALSE);
 702             PROTO_ITEM_SET_GENERATED(ti);
 703             ti = proto_tree_add_boolean(seqnum_tree, hf_pdcp_lte_sequence_analysis_skipped,
 704                                         tvb, 0, 0, TRUE);
 705             PROTO_ITEM_SET_GENERATED(ti);
 706             if (p->lastSN != p->firstSN) {
 707                 expert_add_info_format(pinfo, ti, &ei_pdcp_lte_sequence_analysis_sn_missing,
 708                                        "PDCP SNs (%u to %u) missing for %s on UE %u (%s-%u)",
 709                                        p->firstSN, p->lastSN,
 710                                        val_to_str_const(p_pdcp_lte_info->direction, direction_vals, "Unknown"),
 711                                        p_pdcp_lte_info->ueid,
 712                                        val_to_str_const(p_pdcp_lte_info->channelType, logical_channel_vals, "Unknown"),
 713                                        p_pdcp_lte_info->channelId);
 714                 proto_item_append_text(seqnum_ti, " - SNs missing (%u to %u)",
 715                                        p->firstSN, p->lastSN);
 716             }
 717             else {
 718                 expert_add_info_format(pinfo, ti, &ei_pdcp_lte_sequence_analysis_sn_missing,
 719                                        "PDCP SN (%u) missing for %s on UE %u (%s-%u)",
 720                                        p->firstSN,
 721                                        val_to_str_const(p_pdcp_lte_info->direction, direction_vals, "Unknown"),
 722                                        p_pdcp_lte_info->ueid,
 723                                        val_to_str_const(p_pdcp_lte_info->channelType, logical_channel_vals, "Unknown"),
 724                                        p_pdcp_lte_info->channelId);
 725                 proto_item_append_text(seqnum_ti, " - SN missing (%u)",
 726                                        p->firstSN);
 727             }
 728             break;
 729
 730         case SN_Repeated:
 731             ti = proto_tree_add_boolean(seqnum_tree, hf_pdcp_lte_sequence_analysis_ok,
 732                                         tvb, 0, 0, FALSE);
 733             PROTO_ITEM_SET_GENERATED(ti);
 734             ti = proto_tree_add_boolean(seqnum_tree, hf_pdcp_lte_sequence_analysis_repeated,
 735                                         tvb, 0, 0, TRUE);
 736             PROTO_ITEM_SET_GENERATED(ti);
 737             expert_add_info_format(pinfo, ti, &ei_pdcp_lte_sequence_analysis_sn_repeated,
 738                                    "PDCP SN (%u) repeated for %s for UE %u (%s-%u)",
 739                                    p->firstSN,
 740                                    val_to_str_const(p_pdcp_lte_info->direction, direction_vals, "Unknown"),
 741                                    p_pdcp_lte_info->ueid,
 742                                    val_to_str_const(p_pdcp_lte_info->channelType, logical_channel_vals, "Unknown"),
 743                                    p_pdcp_lte_info->channelId);
 744             proto_item_append_text(seqnum_ti, "- SN %u Repeated",
 745                                    p->firstSN);
 746             break;
 747
 748         default:
 749             /* Incorrect sequence number */
 750             expert_add_info_format(pinfo, ti_expected_sn, &ei_pdcp_lte_sequence_analysis_wrong_sequence_number,
 751                                    "Wrong Sequence Number for %s on UE %u (%s-%u) - got %u, expected %u",
 752                                    val_to_str_const(p_pdcp_lte_info->direction, direction_vals, "Unknown"),
 753                                    p_pdcp_lte_info->ueid,
 754                                    val_to_str_const(p_pdcp_lte_info->channelType, logical_channel_vals, "Unknown"),
 755                                    p_pdcp_lte_info->channelId,
 756                                    sequenceNumber, p->sequenceExpected);
 757             break;
 758     }
 759 }
 760
 761
 762 /* Update the channel status and set report for this frame */
 763 static void checkChannelSequenceInfo(packet_info *pinfo, tvbuff_t *tvb,
 764                                      pdcp_lte_info *p_pdcp_lte_info,
 765                                      guint16 sequenceNumber,
 766                                      proto_tree *tree,
 767                                      proto_tree *security_tree,
 768                                      pdu_security_settings_t *pdu_security)
 769 {
 770     pdcp_channel_hash_key          channel_key;
 771     pdcp_channel_status           *p_channel_status;
 772     pdcp_sequence_report_in_frame *p_report_in_frame      = NULL;
 773     gboolean                       createdChannel         = FALSE;
 774     guint16                        expectedSequenceNumber = 0;
 775     guint16                        snLimit                = 0;
 776
 777     /* If find stat_report_in_frame already, use that and get out */
 778     if (pinfo->fd->flags.visited) {
 779         p_report_in_frame =
 780             (pdcp_sequence_report_in_frame*)g_hash_table_lookup(pdcp_lte_sequence_analysis_report_hash,
 781                                                                 get_report_hash_key(sequenceNumber,
 782                                                                                     pinfo->fd->num,
 783                                                                                     p_pdcp_lte_info, FALSE));
 784         if (p_report_in_frame != NULL) {
 785             addChannelSequenceInfo(p_report_in_frame, p_pdcp_lte_info,
 786                                    sequenceNumber,
 787                                    pinfo, tree, tvb, security_tree, pdu_security);
 788             return;
 789         }
 790         else {
 791             /* Give up - we must have tried already... */
 792             return;
 793         }
 794     }
 795
 796
 797     /**************************************************/
 798     /* Create or find an entry for this channel state */
 799     channel_key.ueId = p_pdcp_lte_info->ueid;
 800     channel_key.plane = p_pdcp_lte_info->plane;
 801     channel_key.channelId = p_pdcp_lte_info->channelId;
 802     channel_key.direction = p_pdcp_lte_info->direction;
 803     channel_key.notUsed = 0;
 804
 805     /* Do the table lookup */
 806     p_channel_status = (pdcp_channel_status*)g_hash_table_lookup(pdcp_sequence_analysis_channel_hash,
 807                                                                  get_channel_hash_key(&channel_key));
 808
 809     /* Create table entry if necessary */
 810     if (p_channel_status == NULL) {
 811         createdChannel = TRUE;
 812
 813         /* Allocate a new value and duplicate key contents */
 814         p_channel_status = wmem_new0(wmem_file_scope(), pdcp_channel_status);
 815
 816         /* Add entry */
 817         g_hash_table_insert(pdcp_sequence_analysis_channel_hash,
 818                             get_channel_hash_key(&channel_key), p_channel_status);
 819     }
 820
 821     /* Create space for frame state_report */
 822     p_report_in_frame = wmem_new(wmem_file_scope(), pdcp_sequence_report_in_frame);
 823     p_report_in_frame->nextFrameNum = 0;
 824
 825     switch (p_pdcp_lte_info->seqnum_length) {
 826         case PDCP_SN_LENGTH_5_BITS:
 827             snLimit = 32;
 828             break;
 829         case PDCP_SN_LENGTH_7_BITS:
 830             snLimit = 128;
 831             break;
 832         case PDCP_SN_LENGTH_12_BITS:
 833             snLimit = 4096;
 834             break;
 835         case PDCP_SN_LENGTH_15_BITS:
 836             snLimit = 32768;
 837             break;
 838         default:
 839             DISSECTOR_ASSERT_NOT_REACHED();
 840             break;
 841     }
 842
 843     /* Work out expected sequence number */
 844     if (!createdChannel) {
 845         expectedSequenceNumber = (p_channel_status->previousSequenceNumber + 1) % snLimit;
 846     }
 847     else {
 848         expectedSequenceNumber = sequenceNumber;
 849     }
 850
 851     /* Set report for this frame */
 852     /* For PDCP, sequence number is always expectedSequence number */
 853     p_report_in_frame->sequenceExpectedCorrect = (sequenceNumber == expectedSequenceNumber);
 854     p_report_in_frame->hfn = p_channel_status->hfn;
 855
 856     /* For wrong sequence number... */
 857     if (!p_report_in_frame->sequenceExpectedCorrect) {
 858
 859         /* Frames are not missing if we get an earlier sequence number again */
 860         if (((snLimit + expectedSequenceNumber - sequenceNumber) % snLimit) > 15) {
 861             p_report_in_frame->state = SN_Missing;
 862             p_report_in_frame->firstSN = expectedSequenceNumber;
 863             p_report_in_frame->lastSN = (snLimit + sequenceNumber - 1) % snLimit;
 864
 865             p_report_in_frame->sequenceExpected = expectedSequenceNumber;
 866             p_report_in_frame->previousFrameNum = p_channel_status->previousFrameNum;
 867
 868             /* Update channel status to remember *this* frame */
 869             p_channel_status->previousFrameNum = pinfo->fd->num;
 870             p_channel_status->previousSequenceNumber = sequenceNumber;
 871         }
 872         else {
 873             /* An SN has been repeated */
 874             p_report_in_frame->state = SN_Repeated;
 875             p_report_in_frame->firstSN = sequenceNumber;
 876
 877             p_report_in_frame->sequenceExpected = expectedSequenceNumber;
 878             p_report_in_frame->previousFrameNum = p_channel_status->previousFrameNum;
 879         }
 880     }
 881     else {
 882         /* SN was OK */
 883         p_report_in_frame->state = SN_OK;
 884         p_report_in_frame->sequenceExpected = expectedSequenceNumber;
 885         p_report_in_frame->previousFrameNum = p_channel_status->previousFrameNum;
 886         /* SN has rolled around, inc hfn! */
 887         if (!createdChannel && (sequenceNumber == 0)) {
 888             /* TODO: not worrying about HFN rolling over for now! */
 889             p_channel_status->hfn++;
 890             p_report_in_frame->hfn = p_channel_status->hfn;
 891         }
 892
 893         /* Update channel status to remember *this* frame */
 894         p_channel_status->previousFrameNum = pinfo->fd->num;
 895         p_channel_status->previousSequenceNumber = sequenceNumber;
 896
 897         if (p_report_in_frame->previousFrameNum != 0) {
 898             /* Get report for previous frame */
 899             pdcp_sequence_report_in_frame *p_previous_report;
 900             p_previous_report = (pdcp_sequence_report_in_frame*)g_hash_table_lookup(pdcp_lte_sequence_analysis_report_hash,
 901                                                                                     get_report_hash_key((sequenceNumber+32767) % 32768,
 902                                                                                                         p_report_in_frame->previousFrameNum,
 903                                                                                                         p_pdcp_lte_info,
 904                                                                                                         FALSE));
 905             /* It really shouldn't be NULL... */
 906             if (p_previous_report != NULL) {
 907                 /* Point it forward to this one */
 908                 p_previous_report->nextFrameNum = pinfo->fd->num;
 909             }
 910         }
 911     }
 912
 913     /* Associate with this frame number */
 914     g_hash_table_insert(pdcp_lte_sequence_analysis_report_hash,
 915                         get_report_hash_key(sequenceNumber, pinfo->fd->num,
 916                                             p_pdcp_lte_info, TRUE),
 917                         p_report_in_frame);
 918
 919     /* Add state report for this frame into tree */
 920     addChannelSequenceInfo(p_report_in_frame, p_pdcp_lte_info, sequenceNumber,
 921                            pinfo, tree, tvb, security_tree, pdu_security);
 922 }
 923
 924
 925
 926 /* Hash table for security state for a UE
 927    Maps UEId -> pdcp_security_info_t*  */
 928 static gint pdcp_lte_ueid_hash_equal(gconstpointer v, gconstpointer v2)
 929 {
 930     return (v == v2);
 931 }
 932 static guint pdcp_lte_ueid_hash_func(gconstpointer v)
 933 {
 934     return GPOINTER_TO_UINT(v);
 935 }
 936 static GHashTable *pdcp_security_hash = NULL;
 937
 938 /* Result is (ueid, framenum) -> pdcp_security_info_t*  */
 939 typedef struct  ueid_frame_t {
 940     guint32 framenum;
 941     guint16 ueid;
 942 } ueid_frame_t;
 943
 944 /* Convenience function to get a pointer for the hash_func to work with */
 945 static gpointer get_ueid_frame_hash_key(guint16 ueid, guint32 frameNumber,
 946                                         gboolean do_persist)
 947 {
 948     static ueid_frame_t  key;
 949     ueid_frame_t        *p_key;
 950
 951     /* Only allocate a struct when will be adding entry */
 952     if (do_persist) {
 953         p_key = wmem_new(wmem_file_scope(), ueid_frame_t);
 954     }
 955     else {
 956         memset(&key, 0, sizeof(ueid_frame_t));
 957         p_key = &key;
 958     }
 959
 960     /* Fill in details, and return pointer */
 961     p_key->framenum = frameNumber;
 962     p_key->ueid = ueid;
 963
 964     return p_key;
 965 }
 966
 967 static gint pdcp_lte_ueid_frame_hash_equal(gconstpointer v, gconstpointer v2)
 968 {
 969     const ueid_frame_t *ueid_frame_1 = (const ueid_frame_t *)v;
 970     const ueid_frame_t *ueid_frame_2 = (const ueid_frame_t *)v2;
 971     return ((ueid_frame_1->framenum == ueid_frame_2->framenum) && (ueid_frame_1->ueid == ueid_frame_2->ueid));
 972 }
 973 static guint pdcp_lte_ueid_frame_hash_func(gconstpointer v)
 974 {
 975     const ueid_frame_t *ueid_frame = (const ueid_frame_t *)v;
 976     return ueid_frame->framenum + 100*ueid_frame->ueid;
 977 }
 978 static GHashTable *pdcp_security_result_hash = NULL;
 979
 980
 981
 982
 983 /* Write the given formatted text to:
 984    - the info column
 985    - the top-level RLC PDU item */
 986 static void write_pdu_label_and_info(proto_item *pdu_ti,
 987                                      packet_info *pinfo, const char *format, ...)
 988 {
 989     #define MAX_INFO_BUFFER 256
 990     static char info_buffer[MAX_INFO_BUFFER];
 991
 992     va_list ap;
 993
 994     va_start(ap, format);
 995     g_vsnprintf(info_buffer, MAX_INFO_BUFFER, format, ap);
 996     va_end(ap);
 997
 998     /* Add to indicated places */
 999     col_append_str(pinfo->cinfo, COL_INFO, info_buffer);
1000     proto_item_append_text(pdu_ti, "%s", info_buffer);
1001 }
1002
1003
1004
1005 /***************************************************************/
1006
1007
1008
1009 /* Show in the tree the config info attached to this frame, as generated fields */
1010 static void show_pdcp_config(packet_info *pinfo, tvbuff_t *tvb, proto_tree *tree,
1011                              pdcp_lte_info *p_pdcp_info)
1012 {
1013     proto_item *ti;
1014     proto_tree *configuration_tree;
1015     proto_item *configuration_ti = proto_tree_add_item(tree,
1016                                                        hf_pdcp_lte_configuration,
1017                                                        tvb, 0, 0, ENC_ASCII|ENC_NA);
1018     configuration_tree = proto_item_add_subtree(configuration_ti, ett_pdcp_configuration);
1019
1020     /* Direction */
1021     ti = proto_tree_add_uint(configuration_tree, hf_pdcp_lte_direction, tvb, 0, 0,
1022                              p_pdcp_info->direction);
1023     PROTO_ITEM_SET_GENERATED(ti);
1024
1025     /* Plane */
1026     ti = proto_tree_add_uint(configuration_tree, hf_pdcp_lte_plane, tvb, 0, 0,
1027                              p_pdcp_info->plane);
1028     PROTO_ITEM_SET_GENERATED(ti);
1029
1030     /* UEId */
1031     if (p_pdcp_info->ueid != 0) {
1032         ti = proto_tree_add_uint(configuration_tree, hf_pdcp_lte_ueid, tvb, 0, 0,
1033                                  p_pdcp_info->ueid);
1034         PROTO_ITEM_SET_GENERATED(ti);
1035     }
1036
1037     /* Channel type */
1038     ti = proto_tree_add_uint(configuration_tree, hf_pdcp_lte_channel_type, tvb, 0, 0,
1039                              p_pdcp_info->channelType);
1040     PROTO_ITEM_SET_GENERATED(ti);
1041     if (p_pdcp_info->channelId != 0) {
1042         /* Channel type */
1043         ti = proto_tree_add_uint(configuration_tree, hf_pdcp_lte_channel_id, tvb, 0, 0,
1044                                  p_pdcp_info->channelId);
1045         PROTO_ITEM_SET_GENERATED(ti);
1046     }
1047
1048
1049     /* User-plane-specific fields */
1050     if (p_pdcp_info->plane == USER_PLANE) {
1051
1052         /* No Header PDU */
1053         ti = proto_tree_add_uint(configuration_tree, hf_pdcp_lte_no_header_pdu, tvb, 0, 0,
1054                                  p_pdcp_info->no_header_pdu);
1055         PROTO_ITEM_SET_GENERATED(ti);
1056
1057         if (!p_pdcp_info->no_header_pdu) {
1058
1059             /* Seqnum length */
1060             ti = proto_tree_add_uint(configuration_tree, hf_pdcp_lte_seqnum_length, tvb, 0, 0,
1061                                      p_pdcp_info->seqnum_length);
1062             PROTO_ITEM_SET_GENERATED(ti);
1063         }
1064     }
1065
1066     /* ROHC compression */
1067     ti = proto_tree_add_boolean(configuration_tree, hf_pdcp_lte_rohc_compression, tvb, 0, 0,
1068                                 p_pdcp_info->rohc.rohc_compression);
1069     PROTO_ITEM_SET_GENERATED(ti);
1070
1071     /* ROHC-specific settings */
1072     if (p_pdcp_info->rohc.rohc_compression) {
1073
1074         /* Show ROHC mode */
1075         ti = proto_tree_add_uint(configuration_tree, hf_pdcp_lte_rohc_mode, tvb, 0, 0,
1076                                  p_pdcp_info->rohc.mode);
1077         PROTO_ITEM_SET_GENERATED(ti);
1078
1079         /* Show RND */
1080         ti = proto_tree_add_uint(configuration_tree, hf_pdcp_lte_rohc_rnd, tvb, 0, 0,
1081                                  p_pdcp_info->rohc.rnd);
1082         PROTO_ITEM_SET_GENERATED(ti);
1083
1084         /* UDP Checksum */
1085         ti = proto_tree_add_uint(configuration_tree, hf_pdcp_lte_rohc_udp_checksum_present, tvb, 0, 0,
1086                                  p_pdcp_info->rohc.udp_checksum_present);
1087         PROTO_ITEM_SET_GENERATED(ti);
1088
1089         /* ROHC profile */
1090         ti = proto_tree_add_uint(configuration_tree, hf_pdcp_lte_rohc_profile, tvb, 0, 0,
1091                                  p_pdcp_info->rohc.profile);
1092         PROTO_ITEM_SET_GENERATED(ti);
1093
1094         /* CID Inclusion Info */
1095         ti = proto_tree_add_uint(configuration_tree, hf_pdcp_lte_cid_inclusion_info, tvb, 0, 0,
1096                                  p_pdcp_info->rohc.cid_inclusion_info);
1097         PROTO_ITEM_SET_GENERATED(ti);
1098
1099         /* Large CID */
1100         ti = proto_tree_add_uint(configuration_tree, hf_pdcp_lte_large_cid_present, tvb, 0, 0,
1101                                  p_pdcp_info->rohc.large_cid_present);
1102         PROTO_ITEM_SET_GENERATED(ti);
1103     }
1104
1105     /* Append summary to configuration root */
1106     proto_item_append_text(configuration_ti, "(direction=%s, plane=%s",
1107                            val_to_str_const(p_pdcp_info->direction, direction_vals, "Unknown"),
1108                            val_to_str_const(p_pdcp_info->plane, pdcp_plane_vals, "Unknown"));
1109
1110     if (p_pdcp_info->rohc.rohc_compression) {
1111         const char *mode = val_to_str_const(p_pdcp_info->rohc.mode, rohc_mode_vals, "Error");
1112         proto_item_append_text(configuration_ti, ", mode=%c, profile=%s",
1113                                mode[0],
1114                                val_to_str_const(p_pdcp_info->rohc.profile, rohc_profile_vals, "Unknown"));
1115     }
1116     proto_item_append_text(configuration_ti, ")");
1117     PROTO_ITEM_SET_GENERATED(configuration_ti);
1118
1119     /* Show plane in info column */
1120     col_append_fstr(pinfo->cinfo, COL_INFO, " %s: ",
1121                     val_to_str_const(p_pdcp_info->plane, pdcp_plane_vals, "Unknown"));
1122
1123 }
1124
1125
1126 /* Look for an RRC dissector for signalling data (using channel type and direction) */
1127 static dissector_handle_t lookup_rrc_dissector_handle(struct pdcp_lte_info  *p_pdcp_info)
1128 {
1129     dissector_handle_t rrc_handle = 0;
1130
1131     switch (p_pdcp_info->channelType)
1132     {
1133         case Channel_CCCH:
1134             if (p_pdcp_info->direction == DIRECTION_UPLINK) {
1135                 rrc_handle = find_dissector("lte_rrc.ul_ccch");
1136             }
1137             else {
1138                 rrc_handle = find_dissector("lte_rrc.dl_ccch");
1139             }
1140             break;
1141         case Channel_PCCH:
1142             rrc_handle = find_dissector("lte_rrc.pcch");
1143             break;
1144         case Channel_BCCH:
1145             switch (p_pdcp_info->BCCHTransport) {
1146                 case BCH_TRANSPORT:
1147                     rrc_handle = find_dissector("lte_rrc.bcch_bch");
1148                     break;
1149                 case DLSCH_TRANSPORT:
1150                     rrc_handle = find_dissector("lte_rrc.bcch_dl_sch");
1151                     break;
1152             }
1153             break;
1154         case Channel_DCCH:
1155             if (p_pdcp_info->direction == DIRECTION_UPLINK) {
1156                 rrc_handle = find_dissector("lte_rrc.ul_dcch");
1157             }
1158             else {
1159                 rrc_handle = find_dissector("lte_rrc.dl_dcch");
1160             }
1161             break;
1162
1163
1164         default:
1165             break;
1166     }
1167
1168     return rrc_handle;
1169 }
1170
1171
1172 /* Forwad declarations */
1173 static void dissect_pdcp_lte(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree);
1174
1175 /* Heuristic dissection */
1176 static gboolean global_pdcp_lte_heur = FALSE;
1177
1178 /* Heuristic dissector looks for supported framing protocol (see wiki page)  */
1179 static gboolean dissect_pdcp_lte_heur(tvbuff_t *tvb, packet_info *pinfo,
1180                                      proto_tree *tree, void *data _U_)
1181 {
1182     gint                  offset                 = 0;
1183     struct pdcp_lte_info *p_pdcp_lte_info;
1184     tvbuff_t             *pdcp_tvb;
1185     guint8                tag                    = 0;
1186     gboolean              infoAlreadySet         = FALSE;
1187     gboolean              seqnumLengthTagPresent = FALSE;
1188
1189     /* This is a heuristic dissector, which means we get all the UDP
1190      * traffic not sent to a known dissector and not claimed by
1191      * a heuristic dissector called before us!
1192      */
1193
1194     if (!global_pdcp_lte_heur) {
1195         return FALSE;
1196     }
1197
1198     /* Do this again on re-dissection to re-discover offset of actual PDU */
1199
1200     /* Needs to be at least as long as:
1201        - the signature string
1202        - fixed header bytes
1203        - tag for data
1204        - at least one byte of PDCP PDU payload */
1205     if (tvb_length_remaining(tvb, offset) < (gint)(strlen(PDCP_LTE_START_STRING)+3+2)) {
1206         return FALSE;
1207     }
1208
1209     /* OK, compare with signature string */
1210     if (tvb_strneql(tvb, offset, PDCP_LTE_START_STRING, strlen(PDCP_LTE_START_STRING)) != 0) {
1211         return FALSE;
1212     }
1213     offset += (gint)strlen(PDCP_LTE_START_STRING);
1214
1215
1216     /* If redissecting, use previous info struct (if available) */
1217     p_pdcp_lte_info = (pdcp_lte_info *)p_get_proto_data(wmem_file_scope(), pinfo, proto_pdcp_lte, 0);
1218     if (p_pdcp_lte_info == NULL) {
1219         /* Allocate new info struct for this frame */
1220         p_pdcp_lte_info = wmem_new0(wmem_file_scope(), pdcp_lte_info);
1221         infoAlreadySet = FALSE;
1222     }
1223     else {
1224         infoAlreadySet = TRUE;
1225     }
1226
1227
1228     /* Read fixed fields */
1229     p_pdcp_lte_info->no_header_pdu = (gboolean)tvb_get_guint8(tvb, offset++);
1230     p_pdcp_lte_info->plane = (enum pdcp_plane)tvb_get_guint8(tvb, offset++);
1231     if (p_pdcp_lte_info->plane == SIGNALING_PLANE) {
1232         p_pdcp_lte_info->seqnum_length = PDCP_SN_LENGTH_5_BITS;
1233     }
1234     p_pdcp_lte_info->rohc.rohc_compression = (gboolean)tvb_get_guint8(tvb, offset++);
1235
1236     /* Read optional fields */
1237     while (tag != PDCP_LTE_PAYLOAD_TAG) {
1238         /* Process next tag */
1239         tag = tvb_get_guint8(tvb, offset++);
1240         switch (tag) {
1241             case PDCP_LTE_SEQNUM_LENGTH_TAG:
1242                 p_pdcp_lte_info->seqnum_length = tvb_get_guint8(tvb, offset);
1243                 offset++;
1244                 seqnumLengthTagPresent = TRUE;
1245                 break;
1246             case PDCP_LTE_DIRECTION_TAG:
1247                 p_pdcp_lte_info->direction = tvb_get_guint8(tvb, offset);
1248                 offset++;
1249                 break;
1250             case PDCP_LTE_LOG_CHAN_TYPE_TAG:
1251                 p_pdcp_lte_info->channelType = (LogicalChannelType)tvb_get_guint8(tvb, offset);
1252                 offset++;
1253                 break;
1254             case PDCP_LTE_BCCH_TRANSPORT_TYPE_TAG:
1255                 p_pdcp_lte_info->BCCHTransport = (BCCHTransportType)tvb_get_guint8(tvb, offset);
1256                 offset++;
1257                 break;
1258             case PDCP_LTE_ROHC_IP_VERSION_TAG:
1259                 p_pdcp_lte_info->rohc.rohc_ip_version = tvb_get_ntohs(tvb, offset);
1260                 offset += 2;
1261                 break;
1262             case PDCP_LTE_ROHC_CID_INC_INFO_TAG:
1263                 p_pdcp_lte_info->rohc.cid_inclusion_info = tvb_get_guint8(tvb, offset);
1264                 offset++;
1265                 break;
1266             case PDCP_LTE_ROHC_LARGE_CID_PRES_TAG:
1267                 p_pdcp_lte_info->rohc.large_cid_present = tvb_get_guint8(tvb, offset);
1268                 offset++;
1269                 break;
1270             case PDCP_LTE_ROHC_MODE_TAG:
1271                 p_pdcp_lte_info->rohc.mode = (enum rohc_mode)tvb_get_guint8(tvb, offset);
1272                 offset++;
1273                 break;
1274             case PDCP_LTE_ROHC_RND_TAG:
1275                 p_pdcp_lte_info->rohc.rnd = tvb_get_guint8(tvb, offset);
1276                 offset++;
1277                 break;
1278             case PDCP_LTE_ROHC_UDP_CHECKSUM_PRES_TAG:
1279                 p_pdcp_lte_info->rohc.udp_checksum_present = tvb_get_guint8(tvb, offset);
1280                 offset++;
1281                 break;
1282             case PDCP_LTE_ROHC_PROFILE_TAG:
1283                 p_pdcp_lte_info->rohc.profile = tvb_get_ntohs(tvb, offset);
1284                 offset += 2;
1285                 break;
1286             case PDCP_LTE_CHANNEL_ID_TAG:
1287                 p_pdcp_lte_info->channelId = tvb_get_ntohs(tvb, offset);
1288                 offset += 2;
1289                 break;
1290             case PDCP_LTE_UEID_TAG:
1291                 p_pdcp_lte_info->ueid = tvb_get_ntohs(tvb, offset);
1292                 offset += 2;
1293                 break;
1294
1295             case PDCP_LTE_PAYLOAD_TAG:
1296                 /* Have reached data, so get out of loop */
1297                 continue;
1298
1299             default:
1300                 /* It must be a recognised tag */
1301                 return FALSE;
1302         }
1303     }
1304
1305     if ((p_pdcp_lte_info->plane == USER_PLANE) && (seqnumLengthTagPresent == FALSE)) {
1306         /* Conditional field is not present */
1307         return FALSE;
1308     }
1309
1310     if (!infoAlreadySet) {
1311         /* Store info in packet */
1312         p_add_proto_data(wmem_file_scope(), pinfo, proto_pdcp_lte, 0, p_pdcp_lte_info);
1313     }
1314
1315     /**************************************/
1316     /* OK, now dissect as PDCP LTE        */
1317
1318     /* Create tvb that starts at actual PDCP PDU */
1319     pdcp_tvb = tvb_new_subset_remaining(tvb, offset);
1320     dissect_pdcp_lte(pdcp_tvb, pinfo, tree);
1321     return TRUE;
1322 }
1323
1324 /* Called from control protocol to configure security algorithms for the given UE */
1325 void set_pdcp_lte_security_algorithms(guint16 ueid, pdcp_security_info_t *security_info)
1326 {
1327     /* Use for this frame so can check integrity on SecurityCommandRequest frame */
1328     /* N.B. won't work for internal, non-RRC signalling methods... */
1329     pdcp_security_info_t *p_frame_security;
1330
1331     /* Copy security struct */
1332     pdcp_security_info_t *p_security = wmem_new(wmem_file_scope(), pdcp_security_info_t);
1333     *p_security = *security_info;
1334
1335     /* And add into security table */
1336     g_hash_table_insert(pdcp_security_hash, GUINT_TO_POINTER((guint)ueid), p_security);
1337
1338     /* Add an entry for this PDU already to use these settings, as otherwise it won't be present
1339        when we query it on the first pass. */
1340     p_frame_security = wmem_new(wmem_file_scope(), pdcp_security_info_t);
1341     *p_frame_security = *p_security;
1342     g_hash_table_insert(pdcp_security_result_hash,
1343                         get_ueid_frame_hash_key(ueid, security_info->configuration_frame, TRUE),
1344                         p_frame_security);
1345 }
1346
1347 /* Decipher payload if algorithm is supported and plausible inputs are available */
1348 static tvbuff_t *decipher_payload(tvbuff_t *tvb, packet_info *pinfo, int *offset,
1349                                   pdu_security_settings_t *pdu_security_settings,
1350                                   enum pdcp_plane plane, gboolean will_be_deciphered,
1351                                   gboolean *deciphered)
1352 {
1353     guint8* decrypted_data;
1354     gint payload_length;
1355     tvbuff_t *decrypted_tvb;
1356
1357     /* Nothing to do if NULL ciphering */
1358     if (pdu_security_settings->ciphering == eea0) {
1359         return tvb;
1360     }
1361
1362     /* Nothing to do if don't have valid cipher key */
1363     if (!pdu_security_settings->cipherKeyValid) {
1364         return tvb;
1365     }
1366
1367     /* Check whether algorithm supported (only drop through and process if we do) */
1368     if (pdu_security_settings->ciphering == eea1) {
1369 #ifndef HAVE_SNOW3G
1370         return tvb;
1371 #endif
1372     }
1373     else
1374     if (pdu_security_settings->ciphering == eea2) {
1375 #ifndef HAVE_LIBGCRYPT
1376         return tvb;
1377 #endif
1378     }
1379     else {
1380         /* An algorithm we don't support at all! */
1381         return tvb;
1382     }
1383
1384     /* Don't decipher if turned off in preferences */
1385     if (((plane == SIGNALING_PLANE) &&  !global_pdcp_decipher_signalling) ||
1386         ((plane == USER_PLANE) &&       !global_pdcp_decipher_userplane)) {
1387         return tvb;
1388     }
1389
1390     /* Don't decipher if not yet past SecurityModeResponse */
1391     if (!will_be_deciphered) {
1392         return tvb;
1393     }
1394
1395 #ifdef HAVE_LIBGCRYPT
1396     /* AES */
1397     if (pdu_security_settings->ciphering == eea2) {
1398         unsigned char ctr_block[16];
1399         gcry_cipher_hd_t cypher_hd;
1400         int gcrypt_err;
1401
1402         /* Set CTR */
1403         memset(ctr_block, 0, 16);
1404         /* Only first 5 bytes set */
1405         ctr_block[0] = (pdu_security_settings->count & 0xff000000) >> 24;
1406         ctr_block[1] = (pdu_security_settings->count & 0x00ff0000) >> 16;
1407         ctr_block[2] = (pdu_security_settings->count & 0x0000ff00) >> 8;
1408         ctr_block[3] = (pdu_security_settings->count & 0x000000ff);
1409         ctr_block[4] = (pdu_security_settings->bearer << 3) + (pdu_security_settings->direction << 2);
1410
1411         /* Open gcrypt handle */
1412         gcrypt_err = gcry_cipher_open(&cypher_hd, GCRY_CIPHER_AES128, GCRY_CIPHER_MODE_CTR, 0);
1413         if (gcrypt_err != 0) {
1414             return tvb;
1415         }
1416
1417         /* Set the key */
1418         gcrypt_err = gcry_cipher_setkey(cypher_hd, pdu_security_settings->cipherKey, 16);
1419         if (gcrypt_err != 0) {
1420             gcry_cipher_close(cypher_hd);
1421             return tvb;
1422         }
1423
1424         /* Set the CTR */
1425         gcrypt_err = gcry_cipher_setctr(cypher_hd, ctr_block, 16);
1426         if (gcrypt_err != 0) {
1427             gcry_cipher_close(cypher_hd);
1428             return tvb;
1429         }
1430
1431         /* Extract the encrypted data into a buffer */
1432         payload_length = tvb_length_remaining(tvb, *offset);
1433         decrypted_data = (guint8 *)g_malloc0(payload_length);
1434         tvb_memcpy(tvb, decrypted_data, *offset, payload_length);
1435
1436         /* Decrypt the actual data */
1437         gcrypt_err = gcry_cipher_decrypt(cypher_hd,
1438                                          decrypted_data, payload_length,
1439                                          NULL, 0);
1440         if (gcrypt_err != 0) {
1441             gcry_cipher_close(cypher_hd);
1442             g_free(decrypted_data);
1443             return tvb;
1444         }
1445
1446         /* Close gcrypt handle */
1447         gcry_cipher_close(cypher_hd);
1448     }
1449 #endif
1450
1451 #ifdef HAVE_SNOW3G
1452     /* SNOW-3G */
1453     if (pdu_security_settings->ciphering == eea1) {
1454         /* Extract the encrypted data into a buffer */
1455         payload_length = tvb_length_remaining(tvb, *offset);
1456         decrypted_data = (guint8 *)g_malloc0(payload_length+4);
1457         tvb_memcpy(tvb, decrypted_data, *offset, payload_length);
1458
1459         /* Do the algorithm */
1460         snow3g_f8(pdu_security_settings->cipherKey,
1461                   pdu_security_settings->count,
1462                   pdu_security_settings->bearer,
1463                   pdu_security_settings->direction,
1464                   decrypted_data, payload_length*8);
1465     }
1466 #endif
1467
1468     /* Create tvb for resulting deciphered sdu */
1469     decrypted_tvb = tvb_new_child_real_data(tvb, decrypted_data, payload_length, payload_length);
1470     tvb_set_free_cb(decrypted_tvb, g_free);
1471     add_new_data_source(pinfo, decrypted_tvb, "Deciphered Payload");
1472
1473     /* Return deciphered data, i.e. beginning of new tvb */
1474     *offset = 0;
1475     *deciphered = TRUE;
1476     return decrypted_tvb;
1477 }
1478
1479
1480 /* Try to calculate digest to compare with that found in frame. */
1481 static guint32 calculate_digest(pdu_security_settings_t *pdu_security_settings, guint8 header _U_,
1482                                 tvbuff_t *tvb _U_, gint offset _U_, gboolean *calculated)
1483 {
1484     *calculated = FALSE;
1485
1486     if (pdu_security_settings->integrity == eia0) {
1487         /* Should be zero in this case */
1488         *calculated = TRUE;
1489         return 0;
1490     }
1491
1492     /* Can't calculate if don't have valid integrity key */
1493     if (!pdu_security_settings->integrityKeyValid) {
1494         return 0;
1495     }
1496
1497     /* Can only do if indicated in preferences */
1498     if (!global_pdcp_check_integrity) {
1499         return 0;
1500     }
1501
1502     switch (pdu_security_settings->integrity) {
1503
1504 #ifdef HAVE_SNOW3G
1505         case eia1:
1506             {
1507                 guint8  *mac;
1508                 gint message_length = tvb_length_remaining(tvb, offset) - 4;
1509                 guint8 *message_data = (guint8 *)g_malloc0(message_length+5);
1510                 message_data[0] = header;
1511                 tvb_memcpy(tvb, message_data+1, offset, message_length);
1512
1513                 mac = (u8*)snow3g_f9(pdu_security_settings->integrityKey,
1514                                      pdu_security_settings->count,
1515                                      pdu_security_settings->bearer << 27,
1516                                      pdu_security_settings->direction,
1517                                      message_data,
1518                                      (message_length+1)*8);
1519
1520                 *calculated = TRUE;
1521                 g_free(message_data);
1522                 return ((mac[0] << 24) | (mac[1] << 16) | (mac[2] << 8) | mac[3]);
1523             }
1524 #endif
1525
1526 #if (defined GCRYPT_VERSION_NUMBER) && (GCRYPT_VERSION_NUMBER >= 0x010600)
1527         case eia2:
1528             {
1529                 gcry_mac_hd_t mac_hd;
1530                 int gcrypt_err;
1531                 gint message_length;
1532                 guint8 *message_data;
1533                 guint8  mac[4];
1534                 ssize_t read_digest_length = 4;
1535
1536                 /* Open gcrypt handle */
1537                 /* N.B. Unfortunately GCRY_MAC_CMAC_AES is not available in currently used version of gcrypt! */
1538                 gcrypt_err = gcry_mac_open(&mac_hd, GCRY_MAC_CMAC_AES, 0, NULL);
1539                 if (gcrypt_err != 0) {
1540                     return 0;
1541                 }
1542
1543                 /* Set the key */
1544                 gcrypt_err = gcry_mac_setkey(mac_hd, pdu_security_settings->integrityKey, 16);
1545                 if (gcrypt_err != 0) {
1546                     gcry_mac_close(mac_hd);
1547                     return 0;
1548                 }
1549
1550                 /* Extract the encrypted data into a buffer */
1551                 message_length = tvb_length_remaining(tvb, offset) - 4;
1552                 message_data = (guint8 *)g_malloc0(message_length+9);
1553                 message_data[0] = (pdu_security_settings->count & 0xff000000) >> 24;
1554                 message_data[1] = (pdu_security_settings->count & 0x00ff0000) >> 16;
1555                 message_data[2] = (pdu_security_settings->count & 0x0000ff00) >> 8;
1556                 message_data[3] = (pdu_security_settings->count & 0x000000ff);
1557                 message_data[4] = (pdu_security_settings->bearer << 3) + (pdu_security_settings->direction << 2);
1558                 /* rest of first 8 bytes are left as zeroes... */
1559                 message_data[8] = header;
1560                 tvb_memcpy(tvb, message_data+9, offset, message_length);
1561
1562                 /* Pass in the message */
1563                 gcrypt_err = gcry_mac_write(mac_hd, message_data, message_length+9);
1564                 if (gcrypt_err != 0) {
1565                     gcry_mac_close(mac_hd);
1566                     g_free(message_data);
1567                     return 0;
1568                 }
1569
1570                 /* Read out the digest */
1571                 gcrypt_err = gcry_mac_read(mac_hd, mac, &read_digest_length);
1572                 if (gcrypt_err != 0) {
1573                     gcry_mac_close(mac_hd);
1574                     g_free(message_data);
1575                     return 0;
1576                 }
1577
1578                 /* Now close the mac handle */
1579                 gcry_mac_close(mac_hd);
1580
1581                 g_free(message_data);
1582
1583                 *calculated = TRUE;
1584                 return ((mac[0] << 24) | (mac[1] << 16) | (mac[2] << 8) | mac[3]);
1585             }
1586 #endif
1587
1588         default:
1589             /* Can't calculate */
1590             *calculated = FALSE;
1591             return 0;
1592     }
1593 }
1594
1595
1596
1597 /******************************/
1598 /* Main dissection function.  */
1599 static void dissect_pdcp_lte(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
1600 {
1601     const char           *mode;
1602     proto_tree           *pdcp_tree           = NULL;
1603     proto_item           *root_ti             = NULL;
1604     gint                  offset              = 0;
1605     gint                  rohc_offset;
1606     struct pdcp_lte_info *p_pdcp_info;
1607     tvbuff_t             *rohc_tvb            = NULL;
1608
1609     pdcp_security_info_t *current_security = NULL;   /* current security for this UE */
1610     pdcp_security_info_t *pdu_security;              /* security in place for this PDU */
1611     proto_tree *security_tree = NULL;
1612     proto_item *security_ti;
1613     tvbuff_t *payload_tvb;
1614     pdu_security_settings_t  pdu_security_settings;
1615     gboolean payload_deciphered = FALSE;
1616
1617     /* Initialise security settings */
1618     memset(&pdu_security_settings, 0, sizeof(pdu_security_settings));
1619
1620     /* Set protocol name. */
1621     col_set_str(pinfo->cinfo, COL_PROTOCOL, "PDCP-LTE");
1622
1623     /* Look for attached packet info! */
1624     p_pdcp_info = (struct pdcp_lte_info *)p_get_proto_data(wmem_file_scope(), pinfo, proto_pdcp_lte, 0);
1625     /* Can't dissect anything without it... */
1626     if (p_pdcp_info == NULL) {
1627         return;
1628     }
1629
1630     /* Don't want to overwrite the RLC Info column if configured not to */
1631     if ((global_pdcp_lte_layer_to_show == ShowRLCLayer) &&
1632         (p_get_proto_data(wmem_file_scope(), pinfo, proto_rlc_lte, 0) != NULL)) {
1633
1634         col_set_writable(pinfo->cinfo, FALSE);
1635     }
1636     else {
1637         /* TODO: won't help with multiple PDCP-or-traffic PDUs / frame... */
1638         col_clear(pinfo->cinfo, COL_INFO);
1639         col_set_writable(pinfo->cinfo, TRUE);
1640     }
1641
1642     /* Create pdcp tree. */
1643     if (tree) {
1644         root_ti = proto_tree_add_item(tree, proto_pdcp_lte, tvb, offset, -1, ENC_NA);
1645         pdcp_tree = proto_item_add_subtree(root_ti, ett_pdcp);
1646     }
1647
1648     /* Set mode string */
1649     mode = val_to_str_const(p_pdcp_info->rohc.mode, rohc_mode_vals, "Error");
1650
1651     /*****************************************************/
1652     /* Show configuration (attached packet) info in tree */
1653     if (pdcp_tree) {
1654         show_pdcp_config(pinfo, tvb, pdcp_tree, p_pdcp_info);
1655     }
1656
1657     /* Show ROHC mode */
1658     if (p_pdcp_info->rohc.rohc_compression) {
1659         col_append_fstr(pinfo->cinfo, COL_INFO, " (mode=%c)", mode[0]);
1660     }
1661
1662     /***************************************/
1663     /* UE security algorithms              */
1664     if (!pinfo->fd->flags.visited) {
1665         /* Look up current state by UEID */
1666         current_security = (pdcp_security_info_t*)g_hash_table_lookup(pdcp_security_hash,
1667                                                                       GUINT_TO_POINTER((guint)p_pdcp_info->ueid));
1668         if (current_security != NULL) {
1669             /* Store any result for this frame in the result table */
1670             pdcp_security_info_t *security_to_store = wmem_new(wmem_file_scope(), pdcp_security_info_t);
1671             /* Take a deep copy of the settings */
1672             *security_to_store = *current_security;
1673             g_hash_table_insert(pdcp_security_result_hash,
1674                                 get_ueid_frame_hash_key(p_pdcp_info->ueid, pinfo->fd->num, TRUE),
1675                                 security_to_store);
1676         }
1677     }
1678
1679     /* Show security settings for this PDU */
1680     pdu_security = (pdcp_security_info_t*)g_hash_table_lookup(pdcp_security_result_hash, get_ueid_frame_hash_key(p_pdcp_info->ueid, pinfo->fd->num, FALSE));
1681     if (pdu_security != NULL) {
1682         proto_item *ti;
1683
1684         /* Create subtree */
1685         security_ti = proto_tree_add_string_format(pdcp_tree,
1686                                                    hf_pdcp_lte_security,
1687                                                    tvb, 0, 0,
1688                                                    "", "UE Security");
1689         security_tree = proto_item_add_subtree(security_ti, ett_pdcp_security);
1690         PROTO_ITEM_SET_GENERATED(security_ti);
1691
1692         /* Setup frame */
1693         ti = proto_tree_add_uint(security_tree, hf_pdcp_lte_security_setup_frame,
1694                                  tvb, 0, 0, pdu_security->configuration_frame);
1695         PROTO_ITEM_SET_GENERATED(ti);
1696
1697         /* Ciphering */
1698         ti = proto_tree_add_uint(security_tree, hf_pdcp_lte_security_ciphering_algorithm,
1699                                  tvb, 0, 0, pdu_security->ciphering);
1700         PROTO_ITEM_SET_GENERATED(ti);
1701
1702         /* Integrity */
1703         ti = proto_tree_add_uint(security_tree, hf_pdcp_lte_security_integrity_algorithm,
1704                                  tvb, 0, 0, pdu_security->integrity);
1705         PROTO_ITEM_SET_GENERATED(ti);
1706
1707         proto_item_append_text(security_ti, " (ciphering=%s, integrity=%s)",
1708                                val_to_str_const(pdu_security->ciphering, ciphering_algorithm_vals, "Unknown"),
1709                                val_to_str_const(pdu_security->integrity, integrity_algorithm_vals, "Unknown"));
1710
1711         pdu_security_settings.ciphering = pdu_security->ciphering;
1712         pdu_security_settings.integrity = pdu_security->integrity;
1713     }
1714
1715
1716     /***********************************/
1717     /* Handle PDCP header (if present) */
1718     if (!p_pdcp_info->no_header_pdu) {
1719
1720         /* TODO: shouldn't need to initialise this one!! */
1721         guint16  seqnum = 0;
1722         gboolean seqnum_set = FALSE;
1723
1724         guint8  first_byte = tvb_get_guint8(tvb, offset);
1725
1726         /*****************************/
1727         /* Signalling plane messages */
1728         if (p_pdcp_info->plane == SIGNALING_PLANE) {
1729             /* Verify 3 reserved bits are 0 */
1730             guint8 reserved = (first_byte & 0xe0) >> 5;
1731             proto_item *ti = proto_tree_add_item(pdcp_tree, hf_pdcp_lte_control_plane_reserved,
1732                                                  tvb, offset, 1, ENC_BIG_ENDIAN);
1733             if (reserved != 0) {
1734                 expert_add_info_format(pinfo, ti, &ei_pdcp_lte_reserved_bits_not_zero,
1735                                        "PDCP signalling header reserved bits not zero");
1736             }
1737
1738             /* 5-bit sequence number */
1739             seqnum = first_byte & 0x1f;
1740             seqnum_set = TRUE;
1741             proto_tree_add_item(pdcp_tree, hf_pdcp_lte_seq_num_5, tvb, offset, 1, ENC_BIG_ENDIAN);
1742             write_pdu_label_and_info(root_ti, pinfo, " sn=%-2u ", seqnum);
1743             offset++;
1744
1745             if (tvb_length_remaining(tvb, offset) == 0) {
1746                 /* Only PDCP header was captured, stop dissection here */
1747                 return;
1748             }
1749         }
1750         else if (p_pdcp_info->plane == USER_PLANE) {
1751
1752             /**********************************/
1753             /* User-plane messages            */
1754             gboolean pdu_type = (first_byte & 0x80) >> 7;
1755
1756             /* Data/Control flag */
1757             proto_tree_add_item(pdcp_tree, hf_pdcp_lte_data_control, tvb, offset, 1, ENC_BIG_ENDIAN);
1758
1759             if (pdu_type == 1) {
1760                 /*****************************/
1761                 /* Use-plane Data            */
1762
1763                 /* Number of sequence number bits depends upon config */
1764                 switch (p_pdcp_info->seqnum_length) {
1765                     case PDCP_SN_LENGTH_7_BITS:
1766                         seqnum = first_byte & 0x7f;
1767                         seqnum_set = TRUE;
1768                         proto_tree_add_item(pdcp_tree, hf_pdcp_lte_seq_num_7, tvb, offset, 1, ENC_BIG_ENDIAN);
1769                         offset++;
1770                         break;
1771                     case PDCP_SN_LENGTH_12_BITS:
1772                         {
1773                             proto_item *ti;
1774                             guint8 reserved_value;
1775
1776                             /* 3 reserved bits */
1777                             ti = proto_tree_add_item(pdcp_tree, hf_pdcp_lte_reserved3, tvb, offset, 1, ENC_BIG_ENDIAN);
1778                             reserved_value = (first_byte & 0x70) >> 4;
1779
1780                             /* Complain if not 0 */
1781                             if (reserved_value != 0) {
1782                                 expert_add_info_format(pinfo, ti, &ei_pdcp_lte_reserved_bits_not_zero,
1783                                                        "Reserved bits have value 0x%x - should be 0x0",
1784                                                        reserved_value);
1785                             }
1786
1787                             /* 12-bit sequence number */
1788                             seqnum = tvb_get_ntohs(tvb, offset) & 0x0fff;
1789                             seqnum_set = TRUE;
1790                             proto_tree_add_item(pdcp_tree, hf_pdcp_lte_seq_num_12, tvb, offset, 2, ENC_BIG_ENDIAN);
1791                             offset += 2;
1792                         }
1793                         break;
1794                     case PDCP_SN_LENGTH_15_BITS:
1795                         seqnum = tvb_get_ntohs(tvb, offset) & 0x7fff;
1796                         seqnum_set = TRUE;
1797                         proto_tree_add_item(pdcp_tree, hf_pdcp_lte_seq_num_15, tvb, offset, 2, ENC_BIG_ENDIAN);
1798                         offset += 2;
1799                         break;
1800                     default:
1801                         /* Not a recognised data format!!!!! */
1802                         return;
1803                 }
1804
1805                 write_pdu_label_and_info(root_ti, pinfo, " (SN=%u)", seqnum);
1806             }
1807             else {
1808                 /*******************************/
1809                 /* User-plane Control messages */
1810                 guint8 control_pdu_type = (first_byte & 0x70) >> 4;
1811                 proto_tree_add_item(pdcp_tree, hf_pdcp_lte_control_pdu_type, tvb, offset, 1, ENC_BIG_ENDIAN);
1812
1813                 switch (control_pdu_type) {
1814                     case 0:    /* PDCP status report */
1815                         {
1816                             guint8  bits;
1817                             guint16 fms;
1818                             guint16 modulo;
1819                             guint   not_received = 0;
1820                             guint   sn, i, j, l;
1821                             guint32 len, bit_offset;
1822                             proto_tree *bitmap_tree;
1823                             proto_item *bitmap_ti = NULL;
1824                             gchar  *buff = NULL;
1825                             #define BUFF_SIZE 49
1826
1827                             if (p_pdcp_info->seqnum_length == PDCP_SN_LENGTH_12_BITS) {
1828                                 /* First-Missing-Sequence SN */
1829                                 fms = tvb_get_ntohs(tvb, offset) & 0x0fff;
1830                                 sn = (fms + 1) % 4096;
1831                                 proto_tree_add_item(pdcp_tree, hf_pdcp_lte_fms, tvb,
1832                                                     offset, 2, ENC_BIG_ENDIAN);
1833                                 offset += 2;
1834                                 modulo = 4096;
1835                             } else {
1836                                 proto_item *ti;
1837                                 guint8 reserved_value;
1838
1839                                 /* 5 reserved bits */
1840                                 ti = proto_tree_add_item(pdcp_tree, hf_pdcp_lte_reserved4, tvb, offset, 2, ENC_BIG_ENDIAN);
1841                                 reserved_value = (tvb_get_ntohs(tvb, offset) & 0x0f80)>>7;
1842                                 offset++;
1843
1844                                 /* Complain if not 0 */
1845                                 if (reserved_value != 0) {
1846                                     expert_add_info_format(pinfo, ti, &ei_pdcp_lte_reserved_bits_not_zero,
1847                                                            "Reserved bits have value 0x%x - should be 0x0",
1848                                                            reserved_value);
1849                                 }
1850
1851                                 /* First-Missing-Sequence SN */
1852                                 fms = tvb_get_ntohs(tvb, offset) & 0x7fff;
1853                                 sn = (fms + 1) % 32768;
1854                                 proto_tree_add_item(pdcp_tree, hf_pdcp_lte_fms2, tvb,
1855                                                     offset, 2, ENC_BIG_ENDIAN);
1856                                 offset += 2;
1857                                 modulo = 32768;
1858                             }
1859
1860                             /* Bitmap tree */
1861                             if (tvb_length_remaining(tvb, offset) > 0) {
1862                                 bitmap_ti = proto_tree_add_item(pdcp_tree, hf_pdcp_lte_bitmap, tvb,
1863                                                                 offset, -1, ENC_NA);
1864                                 bitmap_tree = proto_item_add_subtree(bitmap_ti, ett_pdcp_report_bitmap);
1865
1866                                  buff = (gchar *)wmem_alloc(wmem_packet_scope(), BUFF_SIZE);
1867                                  len = tvb_length_remaining(tvb, offset);
1868                                  bit_offset = offset<<3;
1869                                 /* For each byte... */
1870                                 for (i=0; i<len; i++) {
1871                                     bits = tvb_get_bits8(tvb, bit_offset, 8);
1872                                     for (l=0, j=0; l<8; l++) {
1873                                         if ((bits << l) & 0x80) {
1874                                             j += g_snprintf(&buff[j], BUFF_SIZE-j, "%5u,", (unsigned)(sn+(8*i)+l)%modulo);
1875                                         } else {
1876                                             j += g_snprintf(&buff[j], BUFF_SIZE-j, "     ,");
1877                                             not_received++;
1878                                         }
1879                                     }
1880                                     proto_tree_add_text(bitmap_tree, tvb, bit_offset/8, 1, "%s", buff);
1881                                     bit_offset += 8;
1882                                 }
1883                             }
1884
1885                             if (bitmap_ti != NULL) {
1886                                 proto_item_append_text(bitmap_ti, " (%u SNs not received)", not_received);
1887                             }
1888                             write_pdu_label_and_info(root_ti, pinfo, " Status Report (fms=%u) not-received=%u",
1889                                                     fms, not_received);
1890                         }
1891                         return;
1892
1893                     case 1:     /* ROHC Feedback */
1894                         offset++;
1895                         break;  /* Drop-through to dissect feedback */
1896
1897                     default:    /* Reserved */
1898                         return;
1899                 }
1900             }
1901         }
1902         else {
1903             /* Invalid plane setting...! */
1904             write_pdu_label_and_info(root_ti, pinfo, " - INVALID PLANE (%u)",
1905                                      p_pdcp_info->plane);
1906             return;
1907         }
1908
1909         /* Do sequence analysis if configured to. */
1910         if (seqnum_set) {
1911             gboolean do_analysis = FALSE;
1912
1913             switch (global_pdcp_check_sequence_numbers) {
1914                 case FALSE:
1915                     break;
1916                 case SEQUENCE_ANALYSIS_RLC_ONLY:
1917                     if ((p_get_proto_data(wmem_file_scope(), pinfo, proto_rlc_lte, 0) != NULL) &&
1918                         !p_pdcp_info->is_retx) {
1919                         do_analysis = TRUE;
1920                     }
1921                     break;
1922                 case SEQUENCE_ANALYSIS_PDCP_ONLY:
1923                     if (p_get_proto_data(wmem_file_scope(), pinfo, proto_rlc_lte, 0) == NULL) {
1924                         do_analysis = TRUE;
1925                     }
1926                     break;
1927             }
1928
1929             if (do_analysis) {
1930                 checkChannelSequenceInfo(pinfo, tvb, p_pdcp_info,
1931                                          (guint16)seqnum, pdcp_tree, security_tree,
1932                                          &pdu_security_settings);
1933             }
1934         }
1935     }
1936     else {
1937         /* Show that it's a no-header PDU */
1938         write_pdu_label_and_info(root_ti, pinfo, " No-Header ");
1939     }
1940
1941     /*******************************************************/
1942     /* Now deal with the payload                           */
1943     /*******************************************************/
1944
1945     /* Check pdu_security_settings - may need to do deciphering before calling
1946        further dissectors on payload */
1947     payload_tvb = decipher_payload(tvb, pinfo, &offset, &pdu_security_settings, p_pdcp_info->plane,
1948                                    pdu_security ? pdu_security->seen_next_ul_pdu: FALSE, &payload_deciphered);
1949
1950     if (p_pdcp_info->plane == SIGNALING_PLANE) {
1951         guint32 data_length;
1952         guint32 mac;
1953         proto_item *mac_ti;
1954         guint32  calculated_digest = 0;
1955         gboolean digest_was_calculated = FALSE;
1956
1957         /* Try to calculate digest so we can check it */
1958         if (global_pdcp_check_integrity) {
1959             calculated_digest = calculate_digest(&pdu_security_settings, tvb_get_guint8(tvb, 0), payload_tvb,
1960                                                  offset, &digest_was_calculated);
1961         }
1962
1963         /* RRC data is all but last 4 bytes.
1964            Call lte-rrc dissector (according to direction and channel type) if we have valid data */
1965         if ((global_pdcp_dissect_signalling_plane_as_rrc) &&
1966             ((pdu_security == NULL) || (pdu_security->ciphering == 0) || payload_deciphered || !pdu_security->seen_next_ul_pdu)){
1967             /* Get appropriate dissector handle */
1968             dissector_handle_t rrc_handle = lookup_rrc_dissector_handle(p_pdcp_info);
1969
1970             if (rrc_handle != 0) {
1971                 /* Call RRC dissector if have one */
1972                 tvbuff_t *rrc_payload_tvb = tvb_new_subset(payload_tvb, offset,
1973                                                            tvb_length_remaining(payload_tvb, offset) - 4,
1974                                                            tvb_length_remaining(payload_tvb, offset) - 4);
1975                 gboolean was_writable = col_get_writable(pinfo->cinfo);
1976
1977                 /* We always want to see this in the info column */
1978                 col_set_writable(pinfo->cinfo, TRUE);
1979
1980                 call_dissector_only(rrc_handle, rrc_payload_tvb, pinfo, pdcp_tree, NULL);
1981
1982                 /* Restore to whatever it was */
1983                 col_set_writable(pinfo->cinfo, was_writable);
1984             }
1985             else {
1986                  /* Just show data */
1987                     proto_tree_add_item(pdcp_tree, hf_pdcp_lte_signalling_data, payload_tvb, offset,
1988                                         tvb_length_remaining(tvb, offset) - 4, ENC_NA);
1989             }
1990
1991             if (!pinfo->fd->flags.visited &&
1992                 (current_security != NULL) && !current_security->seen_next_ul_pdu &&
1993                 p_pdcp_info->direction == DIRECTION_UPLINK)
1994             {
1995                 /* i.e. we have already seen SecurityModeResponse! */
1996                 current_security->seen_next_ul_pdu = TRUE;
1997             }
1998
1999         }
2000         else {
2001             /* Just show as unparsed data */
2002             proto_tree_add_item(pdcp_tree, hf_pdcp_lte_signalling_data, payload_tvb, offset,
2003                                 tvb_length_remaining(tvb, offset) - 4, ENC_NA);
2004         }
2005
2006         data_length = tvb_length_remaining(payload_tvb, offset) - 4;
2007         offset += data_length;
2008
2009         /* Last 4 bytes are MAC */
2010         mac = tvb_get_ntohl(payload_tvb, offset);
2011         mac_ti = proto_tree_add_item(pdcp_tree, hf_pdcp_lte_mac, payload_tvb, offset, 4, ENC_BIG_ENDIAN);
2012         offset += 4;
2013
2014         if (digest_was_calculated) {
2015             /* Compare what was found with calculated value! */
2016             if (mac != calculated_digest) {
2017                 expert_add_info_format(pinfo, mac_ti, &ei_pdcp_lte_digest_wrong,
2018                                        "MAC-I Digest wrong expected %08x but found %08x",
2019                                        calculated_digest, mac);
2020             }
2021             else {
2022                 proto_item_append_text(mac_ti, " [Matches calculated result]");
2023             }
2024         }
2025
2026         col_append_fstr(pinfo->cinfo, COL_INFO, " MAC=0x%08x (%u bytes data)",
2027                         mac, data_length);
2028     }
2029     else {
2030         /* User-plane payload here */
2031
2032         /* If not compressed with ROHC, show as user-plane data */
2033         if (!p_pdcp_info->rohc.rohc_compression) {
2034             gint payload_length = tvb_length_remaining(payload_tvb, offset);
2035             if (payload_length > 0) {
2036                 if (p_pdcp_info->plane == USER_PLANE) {
2037
2038                     /* Not attempting to decode payload if ciphering is enabled
2039                        (and NULL ciphering is not being used) */
2040                     if (global_pdcp_dissect_user_plane_as_ip &&
2041                         ((pdu_security == NULL) || (pdu_security->ciphering == 0) || payload_deciphered))
2042                     {
2043                         tvbuff_t *ip_payload_tvb = tvb_new_subset_remaining(payload_tvb, offset);
2044
2045                         /* Don't update info column for ROHC unless configured to */
2046                         if (global_pdcp_lte_layer_to_show != ShowTrafficLayer) {
2047                             col_set_writable(pinfo->cinfo, FALSE);
2048                         }
2049
2050                         switch (tvb_get_guint8(ip_payload_tvb, offset) & 0xf0) {
2051                             case 0x40:
2052                                 call_dissector_only(ip_handle, ip_payload_tvb, pinfo, pdcp_tree, NULL);
2053                                 break;
2054                             case 0x60:
2055                                 call_dissector_only(ipv6_handle, ip_payload_tvb, pinfo, pdcp_tree, NULL);
2056                                 break;
2057                             default:
2058                                 call_dissector_only(data_handle, ip_payload_tvb, pinfo, pdcp_tree, NULL);
2059                                 break;
2060                         }
2061
2062                         /* Freeze the columns again because we don't want other layers writing to info */
2063                         if (global_pdcp_lte_layer_to_show == ShowTrafficLayer) {
2064                             col_set_writable(pinfo->cinfo, FALSE);
2065                         }
2066
2067                     }
2068                     else {
2069                         proto_tree_add_item(pdcp_tree, hf_pdcp_lte_user_plane_data, payload_tvb, offset, -1, ENC_NA);
2070                     }
2071                 }
2072
2073                 write_pdu_label_and_info(root_ti, pinfo, "(%u bytes data)",
2074                                          payload_length);
2075             }
2076
2077             /* (there will be no signalling data left at this point) */
2078
2079             /* Let RLC write to columns again */
2080             col_set_writable(pinfo->cinfo, global_pdcp_lte_layer_to_show == ShowRLCLayer);
2081
2082             /* DROPPING OUT HERE IF NOT DOING ROHC! */
2083             return;
2084         }
2085         else {
2086             /***************************/
2087             /* ROHC packets            */
2088             /***************************/
2089
2090             /* Only attempt ROHC if configured to */
2091             if (!global_pdcp_dissect_rohc) {
2092                 col_append_fstr(pinfo->cinfo, COL_PROTOCOL, "|ROHC(%s)",
2093                                 val_to_str_const(p_pdcp_info->rohc.profile, rohc_profile_vals, "Unknown"));
2094                 return;
2095             }
2096
2097             rohc_offset = offset;
2098             rohc_tvb = tvb_new_subset_remaining(payload_tvb, rohc_offset);
2099
2100             /* Only enable writing to column if configured to show ROHC */
2101             if (global_pdcp_lte_layer_to_show != ShowTrafficLayer) {
2102                 col_set_writable(pinfo->cinfo, FALSE);
2103             }
2104             else {
2105                 col_clear(pinfo->cinfo, COL_INFO);
2106             }
2107
2108             /* Call the ROHC dissector */
2109             call_dissector_with_data(rohc_handle, rohc_tvb, pinfo, tree, &p_pdcp_info->rohc);
2110
2111             /* Let RLC write to columns again */
2112             col_set_writable(pinfo->cinfo, global_pdcp_lte_layer_to_show == ShowRLCLayer);
2113         }
2114     }
2115 }
2116
2117 /* Initializes the hash tables each time a new
2118  * file is loaded or re-loaded in wireshark */
2119 static void pdcp_lte_init_protocol(void)
2120 {
2121     /* Destroy any existing hashes. */
2122     if (pdcp_sequence_analysis_channel_hash) {
2123         g_hash_table_destroy(pdcp_sequence_analysis_channel_hash);
2124     }
2125     if (pdcp_lte_sequence_analysis_report_hash) {
2126         g_hash_table_destroy(pdcp_lte_sequence_analysis_report_hash);
2127     }
2128     if (pdcp_security_hash) {
2129         g_hash_table_destroy(pdcp_security_hash);
2130     }
2131     if (pdcp_security_result_hash) {
2132         g_hash_table_destroy(pdcp_security_result_hash);
2133     }
2134
2135     /* Now create them over */
2136     pdcp_sequence_analysis_channel_hash = g_hash_table_new(pdcp_channel_hash_func, pdcp_channel_equal);
2137     pdcp_lte_sequence_analysis_report_hash = g_hash_table_new(pdcp_result_hash_func, pdcp_result_hash_equal);
2138     pdcp_security_hash = g_hash_table_new(pdcp_lte_ueid_hash_func, pdcp_lte_ueid_hash_equal);
2139     pdcp_security_result_hash = g_hash_table_new(pdcp_lte_ueid_frame_hash_func, pdcp_lte_ueid_frame_hash_equal);
2140 }
2141
2142
2143
2144 void proto_register_pdcp(void)
2145 {
2146     static hf_register_info hf[] =
2147     {
2148         { &hf_pdcp_lte_configuration,
2149             { "Configuration",
2150               "pdcp-lte.configuration", FT_STRING, BASE_NONE, NULL, 0x0,
2151               "Configuration info passed into dissector", HFILL
2152             }
2153         },
2154
2155         { &hf_pdcp_lte_rohc_compression,
2156             { "ROHC Compression",
2157               "pdcp-lte.rohc.compression", FT_BOOLEAN, BASE_NONE, NULL, 0x0,
2158               NULL, HFILL
2159             }
2160         },
2161         { &hf_pdcp_lte_rohc_mode,
2162             { "ROHC Mode",
2163               "pdcp-lte.rohc.mode", FT_UINT8, BASE_DEC, VALS(rohc_mode_vals), 0x0,
2164               NULL, HFILL
2165             }
2166         },
2167         { &hf_pdcp_lte_rohc_rnd,
2168             { "RND",
2169               "pdcp-lte.rohc.rnd", FT_UINT8, BASE_DEC, NULL, 0x0,
2170               "RND of outer ip header", HFILL
2171             }
2172         },
2173         { &hf_pdcp_lte_rohc_udp_checksum_present,
2174             { "UDP Checksum",
2175               "pdcp-lte.rohc.checksum-present", FT_UINT8, BASE_DEC, NULL, 0x0,
2176               "UDP Checksum present", HFILL
2177             }
2178         },
2179         { &hf_pdcp_lte_direction,
2180             { "Direction",
2181               "pdcp-lte.direction", FT_UINT8, BASE_DEC, VALS(direction_vals), 0x0,
2182               "Direction of message", HFILL
2183             }
2184         },
2185         { &hf_pdcp_lte_ueid,
2186             { "UE",
2187               "pdcp-lte.ueid", FT_UINT16, BASE_DEC, 0, 0x0,
2188               "UE Identifier", HFILL
2189             }
2190         },
2191         { &hf_pdcp_lte_channel_type,
2192             { "Channel type",
2193               "pdcp-lte.channel-type", FT_UINT8, BASE_DEC, VALS(logical_channel_vals), 0x0,
2194               NULL, HFILL
2195             }
2196         },
2197         { &hf_pdcp_lte_channel_id,
2198             { "Channel Id",
2199               "pdcp-lte.channel-id", FT_UINT8, BASE_DEC, 0, 0x0,
2200               NULL, HFILL
2201             }
2202         },
2203         { &hf_pdcp_lte_rohc_profile,
2204             { "ROHC profile",
2205               "pdcp-lte.rohc.profile", FT_UINT8, BASE_DEC, VALS(rohc_profile_vals), 0x0,
2206               "ROHC Mode", HFILL
2207             }
2208         },
2209         { &hf_pdcp_lte_no_header_pdu,
2210             { "No Header PDU",
2211               "pdcp-lte.no-header_pdu", FT_UINT8, BASE_DEC, NULL, 0x0,
2212               NULL, HFILL
2213             }
2214         },
2215         { &hf_pdcp_lte_plane,
2216             { "Plane",
2217               "pdcp-lte.plane", FT_UINT8, BASE_DEC, VALS(pdcp_plane_vals), 0x0,
2218               NULL, HFILL
2219             }
2220         },
2221         { &hf_pdcp_lte_seqnum_length,
2222             { "Seqnum length",
2223               "pdcp-lte.seqnum_length", FT_UINT8, BASE_DEC, NULL, 0x0,
2224               "Sequence Number Length", HFILL
2225             }
2226         },
2227
2228
2229         { &hf_pdcp_lte_cid_inclusion_info,
2230             { "CID Inclusion Info",
2231               "pdcp-lte.cid-inclusion-info", FT_UINT8, BASE_DEC, NULL, 0x0,
2232               NULL, HFILL
2233             }
2234         },
2235         { &hf_pdcp_lte_large_cid_present,
2236             { "Large CID Present",
2237               "pdcp-lte.large-cid-present", FT_UINT8, BASE_DEC, NULL, 0x0,
2238               NULL, HFILL
2239             }
2240         },
2241
2242         { &hf_pdcp_lte_control_plane_reserved,
2243             { "Reserved",
2244               "pdcp-lte.reserved", FT_UINT8, BASE_DEC, NULL, 0xe0,
2245               NULL, HFILL
2246             }
2247         },
2248         { &hf_pdcp_lte_seq_num_5,
2249             { "Seq Num",
2250               "pdcp-lte.seq-num", FT_UINT8, BASE_DEC, NULL, 0x1f,
2251               "PDCP Seq num", HFILL
2252             }
2253         },
2254         { &hf_pdcp_lte_seq_num_7,
2255             { "Seq Num",
2256               "pdcp-lte.seq-num", FT_UINT8, BASE_DEC, NULL, 0x7f,
2257               "PDCP Seq num", HFILL
2258             }
2259         },
2260         { &hf_pdcp_lte_reserved3,
2261             { "Reserved",
2262               "pdcp-lte.reserved3", FT_UINT8, BASE_HEX, NULL, 0x70,
2263               "3 reserved bits", HFILL
2264             }
2265         },
2266         { &hf_pdcp_lte_seq_num_12,
2267             { "Seq Num",
2268               "pdcp-lte.seq-num", FT_UINT16, BASE_DEC, NULL, 0x0fff,
2269               "PDCP Seq num", HFILL
2270             }
2271         },
2272         { &hf_pdcp_lte_seq_num_15,
2273             { "Seq Num",
2274               "pdcp-lte.seq-num", FT_UINT16, BASE_DEC, NULL, 0x7fff,
2275               "PDCP Seq num", HFILL
2276             }
2277         },
2278         { &hf_pdcp_lte_signalling_data,
2279             { "Signalling Data",
2280               "pdcp-lte.signalling-data", FT_BYTES, BASE_NONE, NULL, 0x0,
2281               NULL, HFILL
2282             }
2283         },
2284         { &hf_pdcp_lte_mac,
2285             { "MAC",
2286               "pdcp-lte.mac", FT_UINT32, BASE_HEX_DEC, NULL, 0x0,
2287               NULL, HFILL
2288             }
2289         },
2290         { &hf_pdcp_lte_data_control,
2291             { "PDU Type",
2292               "pdcp-lte.pdu-type", FT_UINT8, BASE_HEX, VALS(pdu_type_vals), 0x80,
2293               NULL, HFILL
2294             }
2295         },
2296         { &hf_pdcp_lte_user_plane_data,
2297             { "User-Plane Data",
2298               "pdcp-lte.user-data", FT_BYTES, BASE_NONE, NULL, 0x0,
2299               NULL, HFILL
2300             }
2301         },
2302         { &hf_pdcp_lte_control_pdu_type,
2303             { "Control PDU Type",
2304               "pdcp-lte.control-pdu-type", FT_UINT8, BASE_HEX, VALS(control_pdu_type_vals), 0x70,
2305               NULL, HFILL
2306             }
2307         },
2308         { &hf_pdcp_lte_fms,
2309             { "First Missing Sequence Number",
2310               "pdcp-lte.fms", FT_UINT16, BASE_DEC, NULL, 0x0fff,
2311               "First Missing PDCP Sequence Number", HFILL
2312             }
2313         },
2314         { &hf_pdcp_lte_reserved4,
2315             { "Reserved",
2316               "pdcp-lte.reserved4", FT_UINT16, BASE_HEX, NULL, 0x0f80,
2317               "5 reserved bits", HFILL
2318             }
2319         },
2320         { &hf_pdcp_lte_fms2,
2321             { "First Missing Sequence Number",
2322               "pdcp-lte.fms", FT_UINT16, BASE_DEC, NULL, 0x07fff,
2323               "First Missing PDCP Sequence Number", HFILL
2324             }
2325         },
2326         { &hf_pdcp_lte_bitmap,
2327             { "Bitmap",
2328               "pdcp-lte.bitmap", FT_NONE, BASE_NONE, NULL, 0x0,
2329               "Status report bitmap (0=error, 1=OK)", HFILL
2330             }
2331         },
2332
2333
2334         { &hf_pdcp_lte_sequence_analysis,
2335             { "Sequence Analysis",
2336               "pdcp-lte.sequence-analysis", FT_STRING, BASE_NONE, 0, 0x0,
2337               NULL, HFILL
2338             }
2339         },
2340         { &hf_pdcp_lte_sequence_analysis_ok,
2341             { "OK",
2342               "pdcp-lte.sequence-analysis.ok", FT_BOOLEAN, BASE_NONE, 0, 0x0,
2343               NULL, HFILL
2344             }
2345         },
2346         { &hf_pdcp_lte_sequence_analysis_previous_frame,
2347             { "Previous frame for channel",
2348               "pdcp-lte.sequence-analysis.previous-frame", FT_FRAMENUM, BASE_NONE, 0, 0x0,
2349               NULL, HFILL
2350             }
2351         },
2352         { &hf_pdcp_lte_sequence_analysis_next_frame,
2353             { "Next frame for channel",
2354               "pdcp-lte.sequence-analysis.next-frame", FT_FRAMENUM, BASE_NONE, 0, 0x0,
2355               NULL, HFILL
2356             }
2357         },
2358         { &hf_pdcp_lte_sequence_analysis_expected_sn,
2359             { "Expected SN",
2360               "pdcp-lte.sequence-analysis.expected-sn", FT_UINT16, BASE_DEC, 0, 0x0,
2361               NULL, HFILL
2362             }
2363         },
2364         { &hf_pdcp_lte_sequence_analysis_skipped,
2365             { "Skipped frames",
2366               "pdcp-lte.sequence-analysis.skipped-frames", FT_BOOLEAN, BASE_NONE, 0, 0x0,
2367               NULL, HFILL
2368             }
2369         },
2370         { &hf_pdcp_lte_sequence_analysis_repeated,
2371             { "Repeated frame",
2372               "pdcp-lte.sequence-analysis.repeated-frame", FT_BOOLEAN, BASE_NONE, 0, 0x0,
2373               NULL, HFILL
2374             }
2375         },
2376
2377         { &hf_pdcp_lte_security,
2378             { "Security Config",
2379               "pdcp-lte.security-cofig", FT_STRING, BASE_NONE, 0, 0x0,
2380               NULL, HFILL
2381             }
2382         },
2383         { &hf_pdcp_lte_security_setup_frame,
2384             { "Configuration frame",
2385               "pdcp-lte.security-config.setup-frame", FT_FRAMENUM, BASE_NONE, 0, 0x0,
2386               NULL, HFILL
2387             }
2388         },
2389         { &hf_pdcp_lte_security_integrity_algorithm,
2390             { "Integrity Algorithm",
2391               "pdcp-lte.security-config.integrity", FT_UINT16, BASE_DEC, VALS(integrity_algorithm_vals), 0x0,
2392               NULL, HFILL
2393             }
2394         },
2395         { &hf_pdcp_lte_security_ciphering_algorithm,
2396             { "Ciphering Algorithm",
2397               "pdcp-lte.security-config.ciphering", FT_UINT16, BASE_DEC, VALS(ciphering_algorithm_vals), 0x0,
2398               NULL, HFILL
2399             }
2400         },
2401         { &hf_pdcp_lte_security_bearer,
2402             { "BEARER",
2403               "pdcp-lte.security-config.bearer", FT_UINT8, BASE_DEC, NULL, 0x0,
2404               NULL, HFILL
2405             }
2406         },
2407         { &hf_pdcp_lte_security_direction,
2408             { "DIRECTION",
2409               "pdcp-lte.security-config.direction", FT_UINT8, BASE_DEC, VALS(direction_vals), 0x0,
2410               NULL, HFILL
2411             }
2412         },
2413         { &hf_pdcp_lte_security_count,
2414             { "COUNT",
2415               "pdcp-lte.security-config.count", FT_UINT32, BASE_DEC, NULL, 0x0,
2416               NULL, HFILL
2417             }
2418         },
2419         { &hf_pdcp_lte_security_cipher_key,
2420             { "CIPHER KEY",
2421               "pdcp-lte.security-config.cipher-key", FT_STRING, BASE_NONE, NULL, 0x0,
2422               NULL, HFILL
2423             }
2424         },
2425         { &hf_pdcp_lte_security_integrity_key,
2426             { "INTEGRITY KEY",
2427               "pdcp-lte.security-config.integrity-key", FT_STRING, BASE_NONE, NULL, 0x0,
2428               NULL, HFILL
2429             }
2430         },
2431     };
2432
2433     static gint *ett[] =
2434     {
2435         &ett_pdcp,
2436         &ett_pdcp_configuration,
2437         &ett_pdcp_packet,
2438         &ett_pdcp_lte_sequence_analysis,
2439         &ett_pdcp_report_bitmap,
2440         &ett_pdcp_security
2441     };
2442
2443     static ei_register_info ei[] = {
2444         { &ei_pdcp_lte_sequence_analysis_sn_missing, { "pdcp-lte.sequence-analysis.sn-missing", PI_SEQUENCE, PI_WARN, "PDCP SN missing", EXPFILL }},
2445         { &ei_pdcp_lte_sequence_analysis_sn_repeated, { "pdcp-lte.sequence-analysis.sn-repeated", PI_SEQUENCE, PI_WARN, "PDCP SN repeated", EXPFILL }},
2446         { &ei_pdcp_lte_sequence_analysis_wrong_sequence_number, { "pdcp-lte.sequence-analysis.wrong-sequence-number", PI_SEQUENCE, PI_WARN, "Wrong Sequence Number", EXPFILL }},
2447         { &ei_pdcp_lte_reserved_bits_not_zero, { "pdcp-lte.reserved-bits-not-zero", PI_MALFORMED, PI_ERROR, "Reserved bits not zero", EXPFILL }},
2448         { &ei_pdcp_lte_digest_wrong, { "pdcp-lte.maci-wrong", PI_SEQUENCE, PI_ERROR, "MAC-I doesn't match expected value", EXPFILL }}
2449     };
2450
2451     static const enum_val_t sequence_analysis_vals[] = {
2452         {"no-analysis", "No-Analysis",      FALSE},
2453         {"rlc-only",    "Only-RLC-frames",  SEQUENCE_ANALYSIS_RLC_ONLY},
2454         {"pdcp-only",   "Only-PDCP-frames", SEQUENCE_ANALYSIS_PDCP_ONLY},
2455         {NULL, NULL, -1}
2456     };
2457
2458     static const enum_val_t show_info_col_vals[] = {
2459         {"show-rlc", "RLC Info", ShowRLCLayer},
2460         {"show-pdcp", "PDCP Info", ShowPDCPLayer},
2461         {"show-traffic", "Traffic Info", ShowTrafficLayer},
2462         {NULL, NULL, -1}
2463     };
2464
2465   static uat_field_t ue_keys_uat_flds[] = {
2466       UAT_FLD_DEC(uat_ue_keys_records, ueid, "UEId", "UE Identifier of UE associated with keys"),
2467       UAT_FLD_CSTRING(uat_ue_keys_records, rrcCipherKeyString, "RRC Cipher Key",        "Key for deciphering signalling messages"),
2468       UAT_FLD_CSTRING(uat_ue_keys_records, upCipherKeyString,  "User-Plane Cipher Key", "Key for deciphering user-plane messages"),
2469       UAT_FLD_CSTRING(uat_ue_keys_records, rrcIntegrityKeyString,  "RRC Integrity Key", "Key for deciphering user-plane messages"),
2470       UAT_END_FIELDS
2471     };
2472
2473     module_t *pdcp_lte_module;
2474     expert_module_t* expert_pdcp_lte;
2475
2476     /* Register protocol. */
2477     proto_pdcp_lte = proto_register_protocol("PDCP-LTE", "PDCP-LTE", "pdcp-lte");
2478     proto_register_field_array(proto_pdcp_lte, hf, array_length(hf));
2479     proto_register_subtree_array(ett, array_length(ett));
2480     expert_pdcp_lte = expert_register_protocol(proto_pdcp_lte);
2481     expert_register_field_array(expert_pdcp_lte, ei, array_length(ei));
2482
2483     /* Allow other dissectors to find this one by name. */
2484     register_dissector("pdcp-lte", dissect_pdcp_lte, proto_pdcp_lte);
2485
2486     pdcp_lte_module = prefs_register_protocol(proto_pdcp_lte, NULL);
2487
2488     /* Obsolete preferences */
2489     prefs_register_obsolete_preference(pdcp_lte_module, "show_feedback_option_tag_length");
2490
2491
2492     /* Dissect uncompressed user-plane data as IP */
2493     prefs_register_bool_preference(pdcp_lte_module, "show_user_plane_as_ip",
2494         "Show uncompressed User-Plane data as IP",
2495         "Show uncompressed User-Plane data as IP",
2496         &global_pdcp_dissect_user_plane_as_ip);
2497
2498     /* Dissect unciphered signalling data as RRC */
2499     prefs_register_bool_preference(pdcp_lte_module, "show_signalling_plane_as_rrc",
2500         "Show unciphered Signalling-Plane data as RRC",
2501         "Show unciphered Signalling-Plane data as RRC",
2502         &global_pdcp_dissect_signalling_plane_as_rrc);
2503
2504     /* Check for missing sequence numbers */
2505     prefs_register_enum_preference(pdcp_lte_module, "check_sequence_numbers",
2506         "Do sequence number analysis",
2507         "Do sequence number analysis",
2508         &global_pdcp_check_sequence_numbers, sequence_analysis_vals, FALSE);
2509
2510     /* Attempt to dissect ROHC messages */
2511     prefs_register_bool_preference(pdcp_lte_module, "dissect_rohc",
2512         "Attempt to decode ROHC data",
2513         "Attempt to decode ROHC data",
2514         &global_pdcp_dissect_rohc);
2515
2516     prefs_register_bool_preference(pdcp_lte_module, "heuristic_pdcp_lte_over_udp",
2517         "Try Heuristic LTE-PDCP over UDP framing",
2518         "When enabled, use heuristic dissector to find PDCP-LTE frames sent with "
2519         "UDP framing",
2520         &global_pdcp_lte_heur);
2521
2522     prefs_register_enum_preference(pdcp_lte_module, "layer_to_show",
2523         "Which layer info to show in Info column",
2524         "Can show RLC, PDCP or Traffic layer info in Info column",
2525         &global_pdcp_lte_layer_to_show, show_info_col_vals, FALSE);
2526
2527     ue_keys_uat = uat_new("PDCP UE security keys",
2528               sizeof(uat_ue_keys_record_t),    /* record size */
2529               "pdcp_lte_ue_keys",              /* filename */
2530               TRUE,                            /* from_profile */
2531               (void**) &uat_ue_keys_records,   /* data_ptr */
2532               &num_ue_keys_uat,                /* numitems_ptr */
2533               UAT_AFFECTS_DISSECTION,          /* affects dissection of packets, but not set of named fields */
2534               NULL,                            /* help */
2535               uat_ue_keys_record_copy_cb,      /* copy callback */
2536               uat_ue_keys_record_update_cb,    /* update callback */
2537               uat_ue_keys_record_free_cb,      /* free callback */
2538               NULL,                            /* post update callback */
2539               ue_keys_uat_flds);               /* UAT field definitions */
2540
2541     prefs_register_uat_preference(pdcp_lte_module,
2542                                   "ue_keys_table",
2543                                   "PDCP UE Keys",
2544                                   "Preconfigured PDCP keys",
2545                                   ue_keys_uat);
2546
2547     /* Attempt to decipher RRC messages */
2548     prefs_register_bool_preference(pdcp_lte_module, "decipher_signalling",
2549         "Attempt to decipher Signalling (RRC) SDUs",
2550         "N.B. only possible if build with algorithm support, and have key available and configured",
2551         &global_pdcp_decipher_signalling);
2552
2553     /* Attempt to decipher user-plane messages */
2554     prefs_register_bool_preference(pdcp_lte_module, "decipher_userplane",
2555         "Attempt to decipher User-plane (IP) SDUs",
2556         "N.B. only possible if build with algorithm support, and have key available and configured",
2557         &global_pdcp_decipher_userplane);
2558
2559     /* Attempt to verify RRC integrity/authentication digest */
2560     prefs_register_bool_preference(pdcp_lte_module, "verify_integrity",
2561         "Attempt to check integrity calculation",
2562         "N.B. only possible if build with algorithm support, and have key available and configured",
2563         &global_pdcp_check_integrity);
2564
2565     register_init_routine(&pdcp_lte_init_protocol);
2566 }
2567
2568 void proto_reg_handoff_pdcp_lte(void)
2569 {
2570     /* Add as a heuristic UDP dissector */
2571     heur_dissector_add("udp", dissect_pdcp_lte_heur, proto_pdcp_lte);
2572
2573     ip_handle   = find_dissector("ip");
2574     ipv6_handle = find_dissector("ipv6");
2575     rohc_handle = find_dissector("rohc");
2576     data_handle = find_dissector("data");
2577 }
2578
2579 /*
2580  * Editor modelines
2581  *
2582  * Local Variables:
2583  * c-basic-offset: 4
2584  * tab-width: 8
2585  * indent-tabs-mode: nil
2586  * End:
2587  *
2588  * ex: set shiftwidth=4 tabstop=8 expandtab:
2589  * :indentSize=4:tabSize=8:noTabs=true:
2590  */