Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.
Wireshark logo

Ethereal-dev: [Ethereal-dev] new dissector: BACnet/IP

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Hartmut Mueller <hartmut@xxxxxxxxxxxxxxxxx>
Date: Fri, 30 Mar 2001 14:34:34 +0200
Hi,

I wrote three dissectors for the Building Automation and Control Network 
protocol. It was developed by ASHRAE and is now an American national 
standard, a European pre-standard, and a potential global standard for 
interconnecting products made by different manufacturers. It covers things 
like how to ask for the value of a temperature, define a fan operating 
schedule, or send a pump status alarm. The main goal is to reestablish 
competition between vendors of the builing automation industry.

I am happy to present the following dissectors:
- BACnet Virtual Link Layer (packet-bvlc.c) (BACnet/IP, Add135a)
- BACnet Network Layer (packet-bacnet.c) (ANSI/ASHRAE 135-1995)
- BACnet Aplication Layer (packet-bacapp.c) (ANSI/ASHRAE 135-1995)

The first two dissectors are complete but partly untestet (see comments in 
the source code). The last one is going to be the biggest part, but is only 
meant as a starting point for my successors here at the University of Applied 
Sciences in Dortmund, Germany. I tested everything with randpkg which had to 
be extended by BVLL (diff and source included).

There are other data link layer protocols than BVLL to be implemented as 
dissectors because it is also possible to communicate over MS/TP (EIA-485), 
LonTalk (tm) and ARCNET. BACnet/IP was just a good starting point for me.

I hope that you will like the idea that this is going to be the first GPL'ed 
software for BACnet and check it in the CVS tree. This time, I will be more 
patient that before and will wait for your comments at least the whole 
weekend ;-) You can try out my dissectors at 
http://www.abmlinux.org/cgi-bin/hethereal.cgi with the nice frontend of Tim 
Abenath and Carsten Buchenau.

I would be very happy about a Win32 version of Ethereal with BACnet included 
because I don't have any Win32 compiler around.

Yours, Hartmut
? packet-bvlc.c
? packet-bvlc.h
? packet-bacapp.c
? packet-bacapp.h
? packet-bacnet.c
? packet-bacnet.h
Index: Makefile.am
===================================================================
RCS file: /cvsroot/ethereal/Makefile.am,v
retrieving revision 1.296
diff -u -r1.296 Makefile.am
--- Makefile.am	2001/03/24 02:07:20	1.296
+++ Makefile.am	2001/03/30 10:56:50
@@ -78,10 +78,13 @@
 	packet-atalk.c \
 	packet-atm.c   \
 	packet-auto_rp.c   \
+	packet-bacapp.c   \
+	packet-bacnet.c   \
 	packet-bgp.c   \
 	packet-bootp.c \
 	packet-bootparams.c \
 	packet-bpdu.c  \
+	packet-bvlc.c \
 	packet-bxxp.c \
 	packet-cdp.c   \
 	packet-cgmp.c  \
Index: Makefile.nmake
===================================================================
RCS file: /cvsroot/ethereal/Makefile.nmake,v
retrieving revision 1.90
diff -u -r1.90 Makefile.nmake
--- Makefile.nmake	2001/03/23 21:38:56	1.90
+++ Makefile.nmake	2001/03/30 10:56:51
@@ -31,10 +31,13 @@
 	packet-atalk.c \
 	packet-atm.c   \
 	packet-auto_rp.c   \
+	packet-bacapp.c   \
+	packet-bacnet.c   \
 	packet-bgp.c   \
 	packet-bootp.c \
 	packet-bootparams.c \
 	packet-bpdu.c  \
+	packet-bvlc.c \
 	packet-bxxp.c \
 	packet-cdp.c   \
 	packet-cgmp.c  \
Index: randpkt.c
===================================================================
RCS file: /cvsroot/ethereal/randpkt.c,v
retrieving revision 1.9
diff -u -r1.9 randpkt.c
--- randpkt.c	2000/09/21 04:41:09	1.9
+++ randpkt.c	2001/03/30 10:56:53
@@ -59,7 +59,8 @@
 	PKT_SYSLOG,
 	PKT_TCP,
 	PKT_TR,
-	PKT_UDP
+	PKT_UDP,
+	PKT_BVLC
 };
 
 typedef struct {
@@ -194,6 +195,23 @@
 	0x0a, 0x01, 0x01, 0x63
 };
 
+/* Ethernet+IP+UDP, indicating BVLC */
+guint8 pkt_bvlc[] = {
+	0xff, 0xff, 0xff, 0xff,
+	0xff, 0xff, 0x01, 0x01,
+	0x01, 0x01, 0x01, 0x01,
+	0x08, 0x00,
+
+	0x45, 0x00, 0x00, 0x3c,
+	0xc5, 0x9e, 0x40, 0x00,
+	0xff, 0x11, 0x01, 0xaa,
+	0xc1, 0xff, 0x19, 0x1e,
+	0xc1, 0xff, 0x19, 0xff,
+	0xba, 0xc0, 0xba, 0xc0,
+	0x00, 0xff, 0x2d, 0x5e,
+	0x81
+};
+
 /* This little data table drives the whole program */
 pkt_example examples[] = {
 	{ "arp", "Address Resolution Protocol",
@@ -230,7 +248,10 @@
 		PKT_TR,		NULL,		WTAP_ENCAP_TOKEN_RING,	0 },
 
 	{ "udp", "User Datagram Protocol",
-		PKT_UDP,	pkt_udp,	WTAP_ENCAP_ETHERNET,	array_length(pkt_udp) }
+		PKT_UDP,	pkt_udp,	WTAP_ENCAP_ETHERNET,	array_length(pkt_udp) },
+	{ "bvlc", "BACnet Virtual Link Control",
+		PKT_BVLC,	pkt_bvlc,	WTAP_ENCAP_ETHERNET,	array_length(pkt_bvlc) }
+
 };
 
 

/*
 * This is only need if the dissector doesn't use self-registration to
 * register it's self with the lower level dissector
 *
 * The dissector has the following header that must be placed into
 * packet-PROTOABBREV.h.
 */

void
dissect_bvll(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree);

/*
 * This is only need if the dissector doesn't use self-registration to
 * register it's self with the lower level dissector
 *
 * The dissector has the following header that must be placed into
 * packet-PROTOABBREV.h.
 */

void
dissect_bacapp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree);

/* packet-bvlc.c
 * Routines for BACnet/IP (BVLL, BVLC) dissection
 * Copyright 2001, Hartmut Mueller <hartmut@xxxxxxxxxxxx>, FH Dortmund
 *
 * $Id: packet-bvlc.c,v 0.1 2001/03/30 09:30:10 mut Exp $
 *
 * Ethereal - Network traffic analyzer
 * By Gerald Combs <gerald@xxxxxxxxxx>
 * Copyright 1998 Gerald Combs
 *
 * Copied from README.developer,v 1.23
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License
 * as published by the Free Software Foundation; either version 2
 * of the License, or (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
 */

#ifdef HAVE_CONFIG_H
# include "config.h"
#endif

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include "prefs.h"
#include "strutil.h"

#ifdef HAVE_SYS_TYPES_H
# include <sys/types.h>
#endif

#ifdef HAVE_NETINET_IN_H
# include <netinet/in.h>
#endif

#include <glib.h>

#ifdef NEED_SNPRINTF_H
# include "snprintf.h"
#endif

#include "packet.h"
#include "packet-bvlc.h"


static int proto_bvlc = -1;
static int hf_bvlc_type = -1;
static int hf_bvlc_function = -1;
static int hf_bvlc_length = -1;
static int hf_bvlc_result = -1;
static int hf_bvlc_bdt_ip = -1;
static int hf_bvlc_bdt_mask = -1;
static int hf_bvlc_bdt_port = -1;
static int hf_bvlc_reg_ttl = -1;
static int hf_bvlc_fdt_ip = -1;
static int hf_bvlc_fdt_port = -1;
static int hf_bvlc_fdt_ttl = -1;
static int hf_bvlc_fdt_timeout = -1;
static int hf_bvlc_fwd_ip = -1;
static int hf_bvlc_fwd_port = -1;



static dissector_table_t bvlc_dissector_table;

static char*
bvlc_function_name (guint8 bvlc_function){
  char *type_names[] = {
	"BVLC-Result",
	"Write-Broadcast-Distribution-Table",
	"Read-Broadcast-Distribution-Table",
	"Read-Broadcast-Distribution-Table-Ack",
	"Forwarded-NPDU",
	"Register-Foreign-Device",
	"Read-Foreign-Device-Table",
	"Read-Foreign-Device-Table-Ack",
	"Delete-Foreign-Device-Table-Entry",
	"Distribute-Broadcast-To-Network",
	"Original-Unicast-NPDU",
	"Original-Broadcast-NPDU"
  };
  return (bvlc_function > 0xb)? "unknown" : type_names[bvlc_function];
}

guint16 bvlc_result;

static char*
bvlc_result_name (guint16 bvlc_result){
  char *result_names[] = {
	"Successful completion",
	"Write-Broadcast-Distribution-Table NAK",
	"Read-Broadcast-Distribution-Table NAK",
	"Register-Foreign-Device NAK",
	"Read-Foreign-Device-Table NAK",
	"Delete-Foreign-Device-Table-Entry NAK",
	"Distribute-Broadcast-To-Network NAK"
  };
  return (bvlc_result > 0x0060)? "unknown" : result_names[bvlc_result];
}

static gint ett_bvlc = -1;
static gint ett_bdt = -1;
static gint ett_fdt = -1;

tvbuff_t *next_tvb;

void
dissect_bvlc(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
{

	proto_item *ti;
	proto_item *ti_bdt;
	proto_item *ti_fdt;
	proto_tree *bvlc_tree;
	proto_tree *bdt_tree; /* Broadcast Distribution Table */
	proto_tree *fdt_tree; /* Foreign Device Table */
	
	gint offset;
	guint8 bvlc_type;
	guint8 bvlc_function;
	guint16 bvlc_length;
	guint16 packet_length;
	guint8 npdu_length;
	guint32 bdt_ip;
	guint32 fdt_ip;
	guint32 fwd_ip;
	offset = 0;

	bvlc_type =  tvb_get_guint8(tvb, offset);
	bvlc_function = tvb_get_guint8(tvb, offset+1);
	packet_length = tvb_get_ntohs(tvb, offset+2);
	if (bvlc_function > 0x08) {
		/*  We have a constant header length of BVLC of 4 in every
		 *  BVLC-packet forewarding an NPDU. Beware: Changes in the 
		 *  BACnet-IP-standard may break this. 
		 *  At the moment, no functions above 0x0b
		 *  exist (Addendum 135a to ANSI/ASHRAE 135-1995 - BACnet)
		 */
		bvlc_length = 4;
	} else if(bvlc_function == 0x04) {
		/* 4 Bytes + 6 Bytes for B/IP Address of Originating Device */
		bvlc_length = 10; 
	} else {
		/*  BVLC-packets with function below 0x09 contain 
		 *  routing-level data (e.g. Broadcast Distribution)
		 *  but no NPDU for BACnet, so bvlc_length goes up to the end
		 *  of the captured frame.
		 */
		bvlc_length = packet_length;
	}
	
	CHECK_DISPLAY_AS_DATA(proto_bvlc, tvb, pinfo, tree);

	pinfo->current_proto = "BACnet virtual link control";

	if (check_col(pinfo->fd, COL_PROTOCOL))
		col_add_str(pinfo->fd, COL_PROTOCOL, "BVLC");

	if (check_col(pinfo->fd, COL_INFO))
		col_add_str(pinfo->fd, COL_INFO, "BACnet Virtual Link Control");

	if (tree) {
		ti = proto_tree_add_item(tree, proto_bvlc, tvb, 0, 
			bvlc_length, FALSE);
		bvlc_tree = proto_item_add_subtree(ti, ett_bvlc);
		proto_tree_add_uint_format(bvlc_tree, hf_bvlc_type, tvb, offset, 1, 
			bvlc_type,"Type: 0x%x (Version %s)",bvlc_type,
			(bvlc_type == 0x81)?"BACnet/IP (Annex J)":"unknown");
		offset ++;
		proto_tree_add_uint_format(bvlc_tree, hf_bvlc_function, tvb, 
			offset, 1, bvlc_function,"Function: 0x%02x (%s)", 
			bvlc_function, bvlc_function_name(bvlc_function));
		offset ++;
		proto_tree_add_uint_format(bvlc_tree, hf_bvlc_length, tvb, offset, 
			2, bvlc_length, "BVLC-Length: %d of %d bytes BACnet packet length", 
			bvlc_length, packet_length);
		offset += 2;
		switch (bvlc_function) {
		case 0x00: /* BVLC-Result */
			bvlc_result = tvb_get_ntohs(tvb, offset);
			/* I dont know why the result code is encoded in 4 nibbles,
			 * but only using one: 0x00r0. Shifting left 4 bits.
			 */
			/* We should bitmask the result correctly when we have a
		 	* packet to dissect, see README.developer, 1.6.2, FID */
			proto_tree_add_uint_format(bvlc_tree, hf_bvlc_result, tvb, 
				offset, 2, bvlc_result,"Result: 0x%04x (%s)", 
				bvlc_result, bvlc_result_name(bvlc_result << 4));
			offset += 2;
			break;
		case 0x01: /* Write-Broadcast-Distribution-Table */
		case 0x03: /* Read-Broadcast-Distribution-Table-Ack */
			/* List of BDT Entries:	N*10-octet */
			ti_bdt = proto_tree_add_item(bvlc_tree, proto_bvlc, tvb,
				offset, bvlc_length-4, FALSE);
			bdt_tree = proto_item_add_subtree(ti_bdt, ett_bdt);
			/* List of BDT Entries:	N*10-octet */
			while ((bvlc_length - offset) > 9) {
				tvb_memcpy(tvb, (guint8 *)&bdt_ip, offset, 4);
				proto_tree_add_ipv4(bdt_tree, hf_bvlc_bdt_ip,
					tvb, offset, 4, bdt_ip);
				offset += 4;
				proto_tree_add_uint(bdt_tree, hf_bvlc_bdt_port,
					tvb, offset, 2, tvb_get_ntohs(tvb, offset));
				offset += 2;
				proto_tree_add_bytes(bdt_tree, 
					hf_bvlc_bdt_mask, tvb, offset, 4,
					tvb_get_ptr(tvb, offset, 4));
				offset += 4;
			} 
			/* We check this if we get a BDT-packet somewhere */
			break;
		case 0x02: /* Read-Broadcast-Distribution-Table */
			/* nothing to do here */
			break;
		case 0x05: /* Register-Foreign-Device */
			/* Time-to-Live	2-octets T, Time-to-Live T, in seconds */
			proto_tree_add_uint(bvlc_tree, hf_bvlc_reg_ttl,
				tvb, offset, 2, tvb_get_ntohs(tvb, offset));
			offset += 2;
			break;
		case 0x06: /* Read-Foreign-Device-Table */
			/* nothing to do here */
			break;
		case 0x07: /* Read-Foreign-Device-Table-Ack */
			/* List of FDT Entries:	N*10-octet */
			/* N indicates the number of entries in the FDT whose 
			 * contents are being returned. Each returned entry 
			 * consists of the 6-octet B/IP address of the registrant; 
			 * the 2-octet Time-to-Live value supplied at the time of
			 * registration; and a 2-octet value representing the 
			 * number of seconds remaining before the BBMD will purge 
			 * the registrant's FDT entry if no re-registration occurs.
			 */
			ti_fdt = proto_tree_add_item(bvlc_tree, proto_bvlc, tvb,
				offset, bvlc_length -4, FALSE);
			fdt_tree = proto_item_add_subtree(ti_fdt, ett_fdt);
			/* List of FDT Entries:	N*10-octet */
			while ((bvlc_length - offset) > 9) {
				tvb_memcpy(tvb, (guint8 *)&fdt_ip, offset, 4);
				proto_tree_add_ipv4(fdt_tree, hf_bvlc_fdt_ip,
					tvb, offset, 4, fdt_ip);
				offset += 4;
				proto_tree_add_uint(fdt_tree, hf_bvlc_fdt_port,
					tvb, offset, 2, tvb_get_ntohs(tvb, offset));
				offset += 2;
				proto_tree_add_uint(fdt_tree, 
					hf_bvlc_fdt_ttl, tvb, offset, 2,
					tvb_get_ntohs(tvb, offset));
				offset += 2;
				proto_tree_add_uint(fdt_tree, 
					hf_bvlc_fdt_timeout, tvb, offset, 2,
					tvb_get_ntohs(tvb, offset));
				offset += 2;
			} 
			/* We check this if we get a FDT-packet somewhere */
			break;
		case 0x08: /* Delete-Foreign-Device-Table-Entry */
			/* FDT Entry:	6-octets */
			tvb_memcpy(tvb, (guint8 *)&fdt_ip, offset, 4);
			proto_tree_add_ipv4(bvlc_tree, hf_bvlc_fdt_ip,
				tvb, offset, 4, fdt_ip);
			offset += 4;
			proto_tree_add_uint(bvlc_tree, hf_bvlc_fdt_port,
				tvb, offset, 2, tvb_get_ntohs(tvb, offset));
			offset += 2;
			break;
			/* We check this if we get a FDT-packet somewhere */
		case 0x04:	/* Forwarded-NPDU
				 * Why is this 0x04? It would have been a better
				 * idea to append all forewarded NPDUs at the
				 * end of the function table in the B/IP-standard!
				 */
			/* proto_tree_add_bytes_format(); */
			tvb_memcpy(tvb, (guint8 *)&fwd_ip, offset, 4);
			proto_tree_add_ipv4(bvlc_tree, hf_bvlc_fwd_ip,
				tvb, offset, 4, fwd_ip);
			offset += 4;
			proto_tree_add_uint(bvlc_tree, hf_bvlc_fwd_port,
				tvb, offset, 2, tvb_get_ntohs(tvb, offset));
			offset += 2;
		default:/* Distribute-Broadcast-To-Network
			 * Original-Unicast-NPDU
			 * Original-Broadcast-NPDU
			 * Going to the next dissector...
			 */
			break;
		}

	}
/* Ok, no routing information BVLC packet. Dissect as
 * BACnet NPDU
 */
	npdu_length = packet_length - bvlc_length;
	next_tvb = tvb_new_subset(tvb,bvlc_length,-1,npdu_length);
	/* Code from Guy Harris */
	if (!dissector_try_port(bvlc_dissector_table, 
	bvlc_function, next_tvb, pinfo, tree)) {
		/* Unknown function - dissect the paylod as data */
		dissect_data(next_tvb, 0, pinfo, tree);
	}
}

void
proto_register_bvlc(void)
{
	static hf_register_info hf[] = {
		{ &hf_bvlc_type,
			{ "Type",           "bvlc.type",
			FT_UINT8, BASE_HEX, NULL, 0,
			"Type" }
		},
		{ &hf_bvlc_function,
			{ "Function",           "bvlc.function",
			FT_UINT8, BASE_HEX, NULL, 0,
			"BLVC Function" }
		},
		{ &hf_bvlc_length,
			{ "Length",           "bvlc.length",
			FT_UINT16, BASE_DEC, NULL, 0,
			"Length of BVLC" }
		},
		/* We should bitmask the result correctly when we have a
		 * packet to dissect */
		{ &hf_bvlc_result,
			{ "Result",           "bvlc.result",
			FT_UINT16, BASE_HEX, NULL, 0xffff,
			"Result Code" }
		},
		{ &hf_bvlc_bdt_ip,
			{ "IP",           "bvlc.bdt_ip",
			FT_IPv4, BASE_NONE, NULL, 0,
			"BDT IP" }
		},
		{ &hf_bvlc_bdt_port,
			{ "Port",           "bvlc.bdt_port",
			FT_UINT16, BASE_DEC, NULL, 0,
			"BDT Port" }
		},
		{ &hf_bvlc_bdt_mask,
			{ "Mask",           "bvlc.bdt_mask",
			FT_BYTES, BASE_HEX, NULL, 0,
			"BDT Broadcast Distribution Mask" }
		},
		{ &hf_bvlc_reg_ttl,
			{ "TTL",           "bvlc.reg_ttl",
			FT_UINT16, BASE_DEC, NULL, 0,
			"Foreign Device Time To Live" }
		},
		{ &hf_bvlc_fdt_ip,
			{ "IP",           "bvlc.fdt_ip",
			FT_IPv4, BASE_NONE, NULL, 0,
			"FDT IP" }
		},
		{ &hf_bvlc_fdt_port,
			{ "Port",           "bvlc.fdt_port",
			FT_UINT16, BASE_DEC, NULL, 0,
			"FDT Port" }
		},
		{ &hf_bvlc_fdt_ttl,
			{ "TTL",           "bvlc.fdt_ttl",
			FT_UINT16, BASE_DEC, NULL, 0,
			"Foreign Device Time To Live" }
		},
		{ &hf_bvlc_fdt_timeout,
			{ "Timeout",           "bvlc.fdt_timeout",
			FT_UINT16, BASE_DEC, NULL, 0,
			"Foreign Device Timeout (seconds)" }
		},
		{ &hf_bvlc_fwd_ip,
			{ "IP",           "bvlc.fwd_ip",
			FT_IPv4, BASE_NONE, NULL, 0,
			"FWD IP" }
		},
		{ &hf_bvlc_fwd_port,
			{ "Port",           "bvlc.fwd_port",
			FT_UINT16, BASE_DEC, NULL, 0,
			"FWD Port" }
		},
	};

	static gint *ett[] = {
		&ett_bvlc,
		&ett_bdt,
		&ett_fdt,
	};

	proto_bvlc = proto_register_protocol("BACnet Virtual Link Control",
	    "BVLC", "bvlc");

	proto_register_field_array(proto_bvlc, hf, array_length(hf));
	proto_register_subtree_array(ett, array_length(ett));

	register_dissector("bvlc", dissect_bvlc, proto_bvlc);

	bvlc_dissector_table = register_dissector_table("bvlc.function");
}

void
proto_reg_handoff_bvlc(void)
{
	dissector_add("udp.port", 0xBAC0, dissect_bvlc, proto_bvlc); /* added proto_bvlc */
}
/* Taken from add-135a (BACnet-IP-standard paper):
 *
 * The default UDP port for both directed messages and broadcasts shall 
 * be X'BAC0' and all B/IP devices shall support it. In some cases, 
 * e.g., a situation where it is desirable for two groups of BACnet devices 
 * to coexist independently on the same IP subnet, the UDP port may be 
 * configured locally to a different value without it being considered 
 * a violation of this protocol.
 *
 * This dissector does not analyse UDP packets other than on port 0xBAC0.
 * If you changed your BACnet port locally, use the ethereal feature
 * "Decode As".
 */


/*
 * This is only need if the dissector doesn't use self-registration to
 * register it's self with the lower level dissector
 *
 * The dissector has the following header that must be placed into
 * packet-PROTOABBREV.h.
 */

void
dissect_bacnet(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree);

/* packet-bacnet.c
 * Routines for BACnet (NPDU) dissection
 * Copyright 2001, Hartmut Mueller <hartmut@xxxxxxxxxxxx>, FH Dortmund
 *
 * $Id: packet-bacnet.c,v 0.1 2001/03/30 09:30:01 mut Exp $
 *
 * Ethereal - Network traffic analyzer
 * By Gerald Combs <gerald@xxxxxxxxxx>
 * Copyright 1998 Gerald Combs
 *
 * Copied from README.developer,v 1.23
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License
 * as published by the Free Software Foundation; either version 2
 * of the License, or (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
 */

#ifdef HAVE_CONFIG_H
# include "config.h"
#endif

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#ifdef HAVE_SYS_TYPES_H
# include <sys/types.h>
#endif

#ifdef HAVE_NETINET_IN_H
# include <netinet/in.h>
#endif

#include <glib.h>

#ifdef NEED_SNPRINTF_H
# include "snprintf.h"
#endif

#include "packet.h"
#include "packet-bacnet.h"

static dissector_table_t bacnet_dissector_table;

static char*
bacnet_mesgtyp_name (guint8 bacnet_mesgtyp){
  char *type_names[] = {
        "Who-Is-Router-To-Network",
	"I-Am-Router-To-Network",
	"I-Could-Be-Router-To-Network",
	"Reject-Message-To-Network",
	"Router-Busy-To-Network",
	"Router-Available-To-Network",
	"Initialize-Routing-Table",
	"Initialize-Routing-Table-Ack",
	"Establish-Connection-To-Network",
	"Disconnect-Connection-To-Network"
	};
  if(bacnet_mesgtyp < 0x0a) {
	return type_names[bacnet_mesgtyp];
  } else {
	return (bacnet_mesgtyp < 0x80)? "Reserved for Use by ASHRAE" : "Vendor Proprietary Message";
  }
}

static char*
bacnet_rejectreason_name (guint8 bacnet_rejectreason) {
  char *type_names[] = {
	"Other error.",
	"The router is not directly connected to DNET and cannot find a router to DNET on any directly connected network using Who-Is-Router-To-Network messages.",
	"The router is busy and unable to accept messages for the specified DNET at the present time.",
	"It is an unknown network layer message type.",
	"The message is too long to be routed to this DNET.",
	"The router is no longer directly connected to DNET but can reconnect if requested.",
	"The router is no longer directly connected to DNET and cannot reconnect even if requested."
	};
   return (bacnet_rejectreason > 6)? "Invalid Rejection Reason.":  type_names[bacnet_rejectreason];
}

/* Network Layer Control Information */
#define BAC_CONTROL_NET		 0x80
#define BAC_CONTROL_RES1	 0x40
#define BAC_CONTROL_DEST	 0x20
#define BAC_CONTROL_RES2	 0x10
#define BAC_CONTROL_SRC		 0x08
#define BAC_CONTROL_EXPECT	 0x04
#define BAC_CONTROL_PRIO_HIGH	 0x02
#define BAC_CONTROL_PRIO_LOW	 0x01

/* Network Layer Message Types */
#define BAC_NET_WHO_R		0x00
#define BAC_NET_IAM_R		0x01
#define BAC_NET_ICB_R		0x02
#define BAC_NET_REJ		0x03
#define BAC_NET_R_BUSY		0x04
#define BAC_NET_R_AVA		0x05
#define BAC_NET_INIT_RTAB	0x06
#define BAC_NET_INIT_RTAB_ACK	0x07
#define BAC_NET_EST_CON		0x08
#define BAC_NET_DISC_CON	0x09

static const true_false_string control_net_set_high = {
	"network layer message, message type field present.",
	"BACnet APDU, message type field absent."
};

static const true_false_string control_res_high = {
	"Shall be zero, but is one.",
	"Shall be zero and is zero."
};
static const true_false_string control_dest_high = {
	"DNET, DLEN and Hop Count present. If DLEN=0: broadcast, dest. address field absent.",
	"DNET, DLEN, DADR and Hop Count absent."
};
 
static const true_false_string control_src_high = {
	"SNET, SLEN and SADR present, SLEN=0 invalid, SLEN specifies length of SADR",
	"SNET, SLEN and SADR absent"
};

static const true_false_string control_expect_high = {
	"BACnet-Confirmed-Request-PDU, a segment of BACnet-ComplexACK-PDU or Network Message expecting a reply present.",
	"Other than a BACnet-Confirmed-Request-PDU, segment of BACnet-ComplexACK-PDU or network layer message expecting a reply present."
};

static const true_false_string control_prio_high_high = {
	"Life Safety or Critical Equipment message.",
	"Not a Life Safety or Critical Equipment message."
};

static const true_false_string control_prio_low_high = {
	"Urgent message",
	"Normal message"
};


static int proto_bacnet = -1;
static int hf_bacnet_version = -1;
static int hf_bacnet_control = -1;
static int hf_bacnet_control_net = -1;
static int hf_bacnet_control_res1 = -1;
static int hf_bacnet_control_dest = -1;
static int hf_bacnet_control_res2 = -1;
static int hf_bacnet_control_src = -1;
static int hf_bacnet_control_expect = -1;
static int hf_bacnet_control_prio_high = -1;
static int hf_bacnet_control_prio_low = -1;
static int hf_bacnet_dnet = -1;
static int hf_bacnet_dlen = -1;
static int hf_bacnet_dadr_eth = -1;
static int hf_bacnet_dadr_tmp = -1;
static int hf_bacnet_snet = -1;
static int hf_bacnet_slen = -1;
static int hf_bacnet_sadr_eth = -1;
static int hf_bacnet_sadr_tmp = -1;
static int hf_bacnet_hopc = -1;
static int hf_bacnet_mesgtyp = -1;
static int hf_bacnet_vendor = -1;
static int hf_bacnet_perf = -1;
static int hf_bacnet_rejectreason = -1;
static int hf_bacnet_rportnum = -1;
static int hf_bacnet_portid = -1;
static int hf_bacnet_pinfolen = -1;
static int hf_bacnet_pinfo = -1;

static gint ett_bacnet = -1;
static gint ett_bacnet_control = -1;

tvbuff_t *next_tvb;

void
dissect_bacnet(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
{
	proto_item *ti;
	proto_item *ct;
	proto_tree *bacnet_tree;
	proto_tree *control_tree;

	gint offset;
	guint8 bacnet_version;
	guint8 bacnet_control;
	guint8 bacnet_control_net;
	guint8 bacnet_dlen;
	guint8 bacnet_slen;
	guint8 bacnet_mesgtyp;
	guint8 bacnet_rejectreason;
	guint8 apdu_length;
	guint8 bacnet_rportnum;
	guint8 bacnet_pinfolen;
	guint8 i;
	guint8 j;
	offset = 0;
	bacnet_version = tvb_get_guint8(tvb, offset);
	bacnet_control = tvb_get_guint8(tvb, offset+1);
	bacnet_control_net = tvb_get_guint8(tvb, offset+1) & BAC_CONTROL_NET;
	bacnet_dlen = 0;
	bacnet_slen = 0;
	bacnet_mesgtyp = 0;
	bacnet_rejectreason = 0;
	apdu_length = 0;
	bacnet_rportnum = 0;
	bacnet_pinfolen =0;
	i = 0;
	j = 0;

	CHECK_DISPLAY_AS_DATA(proto_bacnet, tvb, pinfo, tree);
	pinfo->current_proto = "BACnet";

	if (check_col(pinfo->fd, COL_PROTOCOL)) 
		col_add_str(pinfo->fd, COL_PROTOCOL, "BACnet-NPDU");

	if (check_col(pinfo->fd, COL_INFO)) 
		col_add_str(pinfo->fd, COL_INFO, "Building Automation and Control Network NPDU");

	if (tree) {

/* I don't know the length of the NPDU by know. Setting the length after dissection */
		ti = proto_tree_add_item(tree, proto_bacnet, tvb, 0, 0, FALSE);

		bacnet_tree = proto_item_add_subtree(ti, ett_bacnet);

		proto_tree_add_uint_format(bacnet_tree, hf_bacnet_version, tvb, 
			offset, 1,
                        bacnet_version,"Version: 0x%02x (%s)",bacnet_version,
                        (bacnet_version == 0x01)?"ASHRAE 135-1995":"unknown");
		offset ++;
		ct = proto_tree_add_uint_format(bacnet_tree, hf_bacnet_control, 
			tvb, offset, 1,
                        bacnet_control,"Control: 0x%02x",bacnet_control);
		control_tree = proto_item_add_subtree(ct, 
			ett_bacnet_control);
		proto_tree_add_boolean(control_tree, hf_bacnet_control_net, 
			tvb, offset, 1, bacnet_control);
		proto_tree_add_boolean(control_tree, hf_bacnet_control_res1, tvb, 
			offset, 1, bacnet_control);
		proto_tree_add_boolean(control_tree, hf_bacnet_control_dest, tvb, 
			offset, 1, bacnet_control);
		proto_tree_add_boolean(control_tree, hf_bacnet_control_res2, tvb, 
			offset, 1, bacnet_control);
		proto_tree_add_boolean(control_tree, hf_bacnet_control_src, tvb, 
			offset, 1, bacnet_control);
		proto_tree_add_boolean(control_tree, hf_bacnet_control_expect, tvb, 
			offset, 1, bacnet_control);
		proto_tree_add_boolean(control_tree, hf_bacnet_control_prio_high, 
			tvb, offset, 1, bacnet_control);
		proto_tree_add_boolean(control_tree, hf_bacnet_control_prio_low, 
			tvb, offset, 1, bacnet_control);
		offset ++;
		if (bacnet_control & BAC_CONTROL_DEST) { /* DNET, DLEN, DADR */
			proto_tree_add_uint(bacnet_tree, hf_bacnet_dnet,
				tvb, offset, 2, tvb_get_ntohs(tvb, offset));
			offset += 2;
			bacnet_dlen = tvb_get_guint8(tvb, offset);
			/* DLEN = 0 is broadcast on dest.network */
			if( bacnet_dlen == 0) {
				/* append to hf_bacnet_dlen: broadcast */
				proto_tree_add_uint_format(bacnet_tree, 
				hf_bacnet_dlen, tvb, offset, 1, bacnet_dlen, 
				"Destination MAC Layer Address Length: %d indicates Broadcast on Destination Network",
				bacnet_dlen);
				offset ++;
				/* going to SNET */
			} else if (bacnet_dlen==6) {
				proto_tree_add_uint(bacnet_tree, hf_bacnet_dlen,
					tvb, offset, 1, bacnet_dlen);
				offset ++;
				/* Ethernet MAC */
				proto_tree_add_item(bacnet_tree, 
					hf_bacnet_dadr_eth, tvb, offset, 
					bacnet_dlen, FALSE);
				offset += bacnet_dlen;
			} else if (bacnet_dlen<7) {
				proto_tree_add_uint(bacnet_tree, hf_bacnet_dlen,
					tvb, offset, 1, bacnet_dlen);
				offset ++;
				/* Other MAC formats should be included here */
				proto_tree_add_bytes(bacnet_tree, 
					hf_bacnet_dadr_tmp, tvb, offset, 
					bacnet_dlen, tvb_get_ptr(tvb, offset, bacnet_dlen));
				offset += bacnet_dlen;
			} else {
				proto_tree_add_uint_format(bacnet_tree, 
				hf_bacnet_dlen, tvb, offset, 1, bacnet_dlen, 
				"Destination MAC Layer Address Length: %d invalid!",
				bacnet_dlen);
			}
		}
		if (bacnet_control & BAC_CONTROL_SRC) { /* SNET, SLEN, SADR */
			/* SNET */
			proto_tree_add_uint(bacnet_tree, hf_bacnet_snet,
				tvb, offset, 2, tvb_get_ntohs(tvb, offset));
			offset += 2;
			bacnet_slen = tvb_get_guint8(tvb, offset);
			if( bacnet_slen == 0) { /* SLEN = 0 invalid */
				proto_tree_add_uint_format(bacnet_tree,
				hf_bacnet_slen, tvb, offset, 1, bacnet_slen, 
				"Source MAC Layer Address Length: %d invalid!",
				bacnet_slen);
				offset ++;
			} else if (bacnet_slen==6) {
				/* SLEN */
				 proto_tree_add_uint(bacnet_tree, hf_bacnet_slen,
					tvb, offset, 1, bacnet_slen);
				offset ++;
				/* Ethernet MAC */
				proto_tree_add_item(bacnet_tree, 
					hf_bacnet_sadr_eth, tvb, offset, 
					bacnet_slen, FALSE);
				offset += bacnet_slen;
			} else if (bacnet_slen<6) { /* LON,ARCNET,MS/TP MAC */
				/* SLEN */
				 proto_tree_add_uint(bacnet_tree, hf_bacnet_slen,
					tvb, offset, 1, bacnet_slen);
				offset ++;
				/* Other MAC formats should be included here */
				proto_tree_add_bytes(bacnet_tree, 
					hf_bacnet_sadr_tmp, tvb, offset, 
					bacnet_slen, tvb_get_ptr(tvb, offset, bacnet_slen));
				offset += bacnet_slen;
			} else {
				proto_tree_add_uint_format(bacnet_tree,
				hf_bacnet_slen, tvb, offset, 1, bacnet_slen, 
				"Source MAC Layer Address Length: %d invalid!",
				bacnet_slen);
				offset ++;
			}
		}
		if (bacnet_control & BAC_CONTROL_DEST) { /* Hopcount */
			proto_tree_add_uint(bacnet_tree, hf_bacnet_hopc,
				tvb, offset, 1, tvb_get_guint8(tvb, offset));
			offset ++;
		}
		/* Network Layer Message Type */
		if (bacnet_control & BAC_CONTROL_NET) { 
			bacnet_mesgtyp =  tvb_get_guint8(tvb, offset);
			proto_tree_add_uint_format(bacnet_tree,
			hf_bacnet_mesgtyp, tvb, offset, 1, bacnet_mesgtyp,
			"Network Layer Message Type: %02x (%s)", bacnet_mesgtyp,
			bacnet_mesgtyp_name(bacnet_mesgtyp));
			offset ++;
		}
		/* Vendor ID 
		 * The standard says: "If Bit 7 of the control octet is 1 and 
		 * the Message Type field contains a value in the range 
		 * X'80' - X'FF', then a Vendor ID field shall be present (...)."
		 * We should not go any further in dissecting the packet if it's
		 * not present, but we don't know about that: No length field...
		 */
		if ((bacnet_mesgtyp > 0x7f) && (bacnet_control == BAC_CONTROL_NET)) {
			proto_tree_add_uint(bacnet_tree, hf_bacnet_vendor,
				tvb, offset, 2, tvb_get_ntohs(tvb, offset));
			offset += 2;
			/* attention: doesnt work here because of if(tree) */
			dissect_data(next_tvb, offset, pinfo, tree);
		}
		/* Performance Index (in I-Could-Be-Router-To-Network) */
		if (bacnet_mesgtyp == BAC_NET_ICB_R) {
			proto_tree_add_uint(bacnet_tree, hf_bacnet_perf,
				tvb, offset, 1, tvb_get_guint8(tvb, offset));
			offset ++;
		}
		/* Reason, DNET (in Reject-Message-To-Network) */
		if (bacnet_mesgtyp == BAC_NET_REJ) {
			bacnet_rejectreason = tvb_get_guint8(tvb, offset);
			proto_tree_add_uint_format(bacnet_tree, 
				hf_bacnet_rejectreason,
				tvb, offset, 1, 
				bacnet_rejectreason, "Rejection Reason: %d (%s)",
				bacnet_rejectreason,
				bacnet_rejectreason_name(bacnet_rejectreason));
			offset ++;
			proto_tree_add_uint(bacnet_tree, hf_bacnet_dnet,
				tvb, offset, 2, tvb_get_ntohs(tvb, offset));
			offset += 2;
		}
		/* N*DNET (in Router-Busy-To-Network,Router-Available-To-Network) */
		if ((bacnet_mesgtyp == BAC_NET_R_BUSY) || 
		(bacnet_mesgtyp == BAC_NET_R_AVA) || (bacnet_mesgtyp == BAC_NET_IAM_R) ) {
		    while((tvb_length(tvb)-offset) > 1 ) {
			proto_tree_add_uint(bacnet_tree, hf_bacnet_dnet,
				tvb, offset, 2, tvb_get_ntohs(tvb, offset));
			offset += 2;
		    }
		}
		/* Initialize-Routing-Table */
		if ( (bacnet_mesgtyp == BAC_NET_INIT_RTAB) || 
		    (bacnet_mesgtyp == BAC_NET_INIT_RTAB_ACK) ) {
		    bacnet_rportnum = tvb_get_guint8(tvb, offset);
		    /* number of ports */
		    proto_tree_add_uint(bacnet_tree, hf_bacnet_rportnum,
			tvb, offset, 1, bacnet_rportnum);
		    offset ++;
		    for(i=0; i>bacnet_rportnum; i++) {
		    	/* Connected DNET */
		    	proto_tree_add_uint(bacnet_tree, hf_bacnet_dnet,
				tvb, offset, 2, tvb_get_ntohs(tvb, offset));
		    	offset += 2;
		    	/* Port ID */
		     	proto_tree_add_uint(bacnet_tree, hf_bacnet_portid,
				tvb, offset, 1, tvb_get_guint8(tvb, offset));
			offset ++;
		    	/* Port Info Length */
			bacnet_pinfolen = tvb_get_guint8(tvb, offset);
		     	proto_tree_add_uint(bacnet_tree, hf_bacnet_pinfolen,
				tvb, offset, 1, bacnet_pinfolen);
		    	offset ++;
			for(j=0; j>bacnet_pinfolen; j++){
		    	    /* Port Info */
		     	    proto_tree_add_uint(bacnet_tree, hf_bacnet_pinfo,
				tvb, offset, 1, tvb_get_guint8(tvb, offset));
		    	    offset ++;
			}
		    }
		    
		}
		proto_item_set_len(ti, offset);
	}

/* dissect BACnet APDU
 */
        apdu_length = tvb_length(tvb) - offset;
        next_tvb = tvb_new_subset(tvb,offset,-1,apdu_length);
        /* Code from Guy Harris */
        if (!dissector_try_port(bacnet_dissector_table,
        bacnet_control_net, next_tvb, pinfo, tree)) {
                /* Unknown function - dissect the paylod as data */
                dissect_data(next_tvb, 0, pinfo, tree);
        }
}

void
proto_register_bacnet(void)
{
	static hf_register_info hf[] = {
		{ &hf_bacnet_version,
			{ "Version",           "bacnet.version",
			FT_UINT8, BASE_DEC, NULL, 0,
			"BACnet Version" }
		},
		{ &hf_bacnet_control,
			{ "Control",           "bacnet.control",
			FT_UINT8, BASE_HEX, NULL, 0xff,
			"BACnet Control" }
		},
		{ &hf_bacnet_control_net,
			{ "NSDU contains",           
			"bacnet.control_net",
			FT_BOOLEAN, 8, TFS(&control_net_set_high),
			BAC_CONTROL_NET, "BACnet Control" }
		},
		{ &hf_bacnet_control_res1,
			{ "Reserved",           
			"bacnet.control_res1",
			FT_BOOLEAN, 8, TFS(&control_res_high),
			BAC_CONTROL_RES1, "BACnet Control" }
		},
		{ &hf_bacnet_control_dest,
			{ "Destination Specifier",           
			"bacnet.control_dest",
			FT_BOOLEAN, 8, TFS(&control_dest_high),
			BAC_CONTROL_DEST, "BACnet Control" }
		},
		{ &hf_bacnet_control_res2,
			{ "Reserved",           
			"bacnet.control_res2",
			FT_BOOLEAN, 8, TFS(&control_res_high),
			BAC_CONTROL_RES2, "BACnet Control" }
		},
		{ &hf_bacnet_control_src,
			{ "Source specifier",           
			"bacnet.control_src",
			FT_BOOLEAN, 8, TFS(&control_src_high),
			BAC_CONTROL_SRC, "BACnet Control" }
		},
		{ &hf_bacnet_control_expect,
			{ "Expecting Reply",           
			"bacnet.control_expect",
			FT_BOOLEAN, 8, TFS(&control_expect_high),
			BAC_CONTROL_EXPECT, "BACnet Control" }
		},
		{ &hf_bacnet_control_prio_high,
			{ "Priority",           
			"bacnet.control_prio_high",
			FT_BOOLEAN, 8, TFS(&control_prio_high_high),
			BAC_CONTROL_PRIO_HIGH, "BACnet Control" }
		},
		{ &hf_bacnet_control_prio_low,
			{ "Priority",           
			"bacnet.control_prio_low",
			FT_BOOLEAN, 8, TFS(&control_prio_low_high),
			BAC_CONTROL_PRIO_LOW, "BACnet Control" }
		},
		{ &hf_bacnet_dnet,
			{ "Destination Network Address", "bacnet.dnet",
			FT_UINT16, BASE_HEX, NULL, 0,
			"Destination Network Address" }
		},
		{ &hf_bacnet_dlen,
			{ "Destination MAC Layer Address Length", "bacnet.dlen",
			FT_UINT8, BASE_DEC, NULL, 0,
			"Destination MAC Layer Address Length" }
		},
		{ &hf_bacnet_dadr_eth,
			{ "Destination ISO 8802-3 MAC Address", "bacnet.dadr_eth",
			FT_ETHER, BASE_HEX, NULL, 0,
			"Destination ISO 8802-3 MAC Address" }
		},
		{ &hf_bacnet_dadr_tmp,
			{ "Unknown Destination MAC", "bacnet.dadr_tmp",
			FT_BYTES, BASE_HEX, NULL, 0,
			"Unknown Destination MAC" }
		},
		{ &hf_bacnet_snet,
			{ "Source Network Address", "bacnet.snet",
			FT_UINT16, BASE_HEX, NULL, 0,
			"Source Network Address" }
		},
		{ &hf_bacnet_slen,
			{ "Source MAC Layer Address Length", "bacnet.slen",
			FT_UINT8, BASE_DEC, NULL, 0,
			"Source MAC Layer Address Length" }
		},
		{ &hf_bacnet_sadr_eth,
			{ "SADR", "bacnet.sadr_eth",
			FT_ETHER, BASE_HEX, NULL, 0,
			"Source ISO 8802-3 MAC Address" }
		},
		{ &hf_bacnet_sadr_tmp,
			{ "Unknown Source MAC", "bacnet.sadr_tmp",
			FT_BYTES, BASE_HEX, NULL, 0,
			"Unknown Source MAC" }
		},
		{ &hf_bacnet_hopc,
			{ "Hop Count", "bacnet.hopc",
			FT_UINT8, BASE_DEC, NULL, 0,
			"Hop Count" }
		},
		{ &hf_bacnet_mesgtyp,
			{ "Message Type", "bacnet.mesgtyp",
			FT_UINT8, BASE_HEX, NULL, 0,
			"Message Type" }
		},
		{ &hf_bacnet_vendor,
			{ "Vendor ID", "bacnet.vendor",
			FT_UINT16, BASE_HEX, NULL, 0,
			"Vendor ID" }
		},
		{ &hf_bacnet_perf,
			{ "Performance Index", "bacnet.perf",
			FT_UINT8, BASE_DEC, NULL, 0,
			"Performance Index" }
		},
		{ &hf_bacnet_rejectreason,
			{ "Reject Reason", "bacnet.rejectreason",
			FT_UINT8, BASE_DEC, NULL, 0,
			"Reject Reason" }
		},
		{ &hf_bacnet_rportnum,
			{ "Number of Port Mappings", "bacnet.rportnum",
			FT_UINT8, BASE_DEC, NULL, 0,
			"Number of Port Mappings" }
		},
		{ &hf_bacnet_pinfolen,
			{ "Port Info Length", "bacnet.pinfolen",
			FT_UINT8, BASE_DEC, NULL, 0,
			"Port Info Length" }
		},
		{ &hf_bacnet_portid,
			{ "Port ID", "bacnet.portid",
			FT_UINT8, BASE_HEX, NULL, 0,
			"Port ID" }
		},
		{ &hf_bacnet_pinfo,
			{ "Port Info", "bacnet.pinfo",
			FT_UINT8, BASE_HEX, NULL, 0,
			"Port Info" }
		},
	};

	static gint *ett[] = {
		&ett_bacnet,
		&ett_bacnet_control,
	};

	proto_bacnet = proto_register_protocol("Building Automation and Control Network NPDU",
	    "BACnet", "bacnet");

	proto_register_field_array(proto_bacnet, hf, array_length(hf));
	proto_register_subtree_array(ett, array_length(ett));

	register_dissector("bacnet", dissect_bacnet, proto_bacnet);
	bacnet_dissector_table = register_dissector_table("bacnet_control_net");
}

void
proto_reg_handoff_bacnet(void)
{
	dissector_add("bvlc.function", 0x04, dissect_bacnet, proto_bacnet);
	dissector_add("bvlc.function", 0x09, dissect_bacnet, proto_bacnet);
	dissector_add("bvlc.function", 0x0a, dissect_bacnet, proto_bacnet);
	dissector_add("bvlc.function", 0x0b, dissect_bacnet, proto_bacnet);
}

/* packet-bacapp.c
 * Routines for BACnet (APDU) dissection
 * Copyright 2001, Hartmut Mueller <hartmut@xxxxxxxxxxxx>, FH Dortmund
 *
 * $Id: packet-bacapp.c,v 0.1 2001/03/30 09:30:04 mut Exp $
 *
 * Ethereal - Network traffic analyzer
 * By Gerald Combs <gerald@xxxxxxxxxx>
 * Copyright 1998 Gerald Combs
 *
 * Copied from README.developer,v 1.23
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License
 * as published by the Free Software Foundation; either version 2
 * of the License, or (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 * 
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
 */

#ifdef HAVE_CONFIG_H
# include "config.h"
#endif

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#ifdef HAVE_SYS_TYPES_H
# include <sys/types.h>
#endif

#ifdef HAVE_NETINET_IN_H
# include <netinet/in.h>
#endif

#include <glib.h>

#ifdef NEED_SNPRINTF_H
# include "snprintf.h"
#endif

#include "packet.h"
#include "packet-bacapp.h"

static char*
bacapp_type_name (guint8 bacapp_type){
  char *type_names[] = {
	"Confirmed-Request-PDU",
	"Unconfirmed-Request-PDU",
	"SimpleACK-PDU",
	"ComplexACK-PDU",
	"SegmentACK-PDU",
	"Error-PDU",
	"Reject-PDU",
	"Abort-PDU"
	};
        return (bacapp_type > 7)? "unknown PDU" : type_names[bacapp_type];
}

static int proto_bacapp = -1;
static int hf_bacapp_type = -1;

static gint ett_bacapp = -1;
tvbuff_t *next_tvb;

void
dissect_bacapp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
{
	proto_item *ti;
	proto_tree *bacapp_tree;
	guint8 offset;
	guint8 bacapp_type;
	offset  = 0;
	bacapp_type = (tvb_get_guint8(tvb, offset) >> 4) & 0x0f;

	CHECK_DISPLAY_AS_DATA(proto_bacapp, tvb, pinfo, tree);
	pinfo->current_proto = "BACapp";
	if (check_col(pinfo->fd, COL_PROTOCOL))
		col_add_str(pinfo->fd, COL_PROTOCOL, "BACnet-APDU");
	if (check_col(pinfo->fd, COL_INFO))
		col_add_str(pinfo->fd, COL_INFO, "BACnet APDU ");

	if (tree) {

		ti = proto_tree_add_item(tree, proto_bacapp, tvb, offset, tvb_length(tvb), FALSE);

		bacapp_tree = proto_item_add_subtree(ti, ett_bacapp);

		proto_tree_add_uint_format(bacapp_tree, hf_bacapp_type, tvb, 
			offset, 1, bacapp_type, "APDU Type: %d (%s)", bacapp_type,
				bacapp_type_name(bacapp_type));
		offset ++;

	}
	if (check_col(pinfo->fd, COL_INFO))
		col_append_fstr(pinfo->fd, COL_INFO, "(%s)",
		bacapp_type_name(bacapp_type));
	next_tvb = tvb_new_subset(tvb,offset,-1,tvb_length(tvb) - offset);
	dissect_data(next_tvb, 0, pinfo, tree);
}


void
proto_register_bacapp(void)
{
	static hf_register_info hf[] = {
		{ &hf_bacapp_type,
			{ "APDU Type",           "bacapp.bacapp_type",
			FT_UINT8, BASE_DEC, NULL, 0xf0, "APDU Type" }
		},
	};
	static gint *ett[] = {
		&ett_bacapp,
	};
	proto_bacapp = proto_register_protocol("Building Automation and Control Network APDU",
	    "BACapp", "bacapp");
	proto_register_field_array(proto_bacapp, hf, array_length(hf));
	proto_register_subtree_array(ett, array_length(ett));
}
void
proto_reg_handoff_bacapp(void)
{
	dissector_add("bacnet_control_net", 0, dissect_bacapp, proto_bacapp);
}

/*
 * randpkt.c
 * ---------
 * Creates random packet traces. Useful for debugging sniffers by testing
 * assumptions about the veracity of the data found in the packet.
 *
 * $Id: randpkt.c,v 1.9 2000/09/21 04:41:09 gram Exp $
 *
 * Copyright (C) 1999 by Gilbert Ramirez <gram@xxxxxxxxxx>
 * 
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License
 * as published by the Free Software Foundation; either version 2
 * of the License, or (at your option) any later version.
 * 
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 * 
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
 */

#ifdef HAVE_CONFIG_H
#include "config.h"
#endif

#ifdef HAVE_UNISTD_H
#include <unistd.h>
#endif

#ifdef HAVE_FCNTL_H
#include <fcntl.h>
#endif

#include <time.h>
#include <errno.h>

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <glib.h>
#include "wiretap/wtap.h"

#define array_length(x)	(sizeof x / sizeof x[0])

/* Types of produceable packets */
enum {
	PKT_ARP,
	PKT_DNS,
	PKT_ETHERNET,
	PKT_FDDI,
	PKT_ICMP,
	PKT_IP,
	PKT_LLC,
	PKT_NBNS,
	PKT_SYSLOG,
	PKT_TCP,
	PKT_TR,
	PKT_UDP,
	PKT_BVLC
};

typedef struct {
	char	*abbrev;
	char	*longname;
	int	produceable_type;
	guint8	*sample_buffer;
	int	sample_wtap_encap;
	int	sample_length;
} pkt_example;

/* Ethernet, indicating ARP */
guint8 pkt_arp[] = {
	0xff, 0xff, 0xff, 0xff,
	0xff, 0xff, 0x00, 0x00,
	0x32, 0x25, 0x0f, 0xff,
	0x08, 0x06
};

/* Ethernet+IP+UDP, indicating DNS */
guint8 pkt_dns[] = {
	0xff, 0xff, 0xff, 0xff,
	0xff, 0xff, 0x01, 0x01,
	0x01, 0x01, 0x01, 0x01,
	0x08, 0x00,

	0x45, 0x00, 0x00, 0x3c,
	0xc5, 0x9e, 0x40, 0x00,
	0xff, 0x11, 0xd7, 0xe0,
	0xd0, 0x15, 0x02, 0xb8,
	0x0a, 0x01, 0x01, 0x63,

	0x05, 0xe8, 0x00, 0x35,
	0x00, 0x00, 0x2a, 0xb9,
	0x30
};

/* Ethernet+IP, indicating ICMP */
guint8 pkt_icmp[] = {
	0xff, 0xff, 0xff, 0xff,
	0xff, 0xff, 0x01, 0x01,
	0x01, 0x01, 0x01, 0x01,
	0x08, 0x00,

	0x45, 0x00, 0x00, 0x54,
	0x8f, 0xb3, 0x40, 0x00,
	0xfd, 0x01, 0x8a, 0x99,
	0xcc, 0xfc, 0x66, 0x0b,
	0xce, 0x41, 0x62, 0x12
};

/* Ethernet, indicating IP */
guint8 pkt_ip[] = {
	0xff, 0xff, 0xff, 0xff,
	0xff, 0xff, 0x01, 0x01,
	0x01, 0x01, 0x01, 0x01,
	0x08, 0x00
};

/* TR, indicating LLC */
guint8 pkt_llc[] = {
	0x10, 0x40, 0x68, 0x00,
	0x19, 0x69, 0x95, 0x8b,
	0x00, 0x01, 0xfa, 0x68,
	0xc4, 0x67
};

/* Ethernet+IP+UP, indicating NBNS */
guint8 pkt_nbns[] = {
	0xff, 0xff, 0xff, 0xff,
	0xff, 0xff, 0x01, 0x01,
	0x01, 0x01, 0x01, 0x01,
	0x08, 0x00,

	0x45, 0x00, 0x00, 0x3c,
	0xc5, 0x9e, 0x40, 0x00,
	0xff, 0x11, 0xd7, 0xe0,
	0xd0, 0x15, 0x02, 0xb8,
	0x0a, 0x01, 0x01, 0x63,

	0x00, 0x89, 0x00, 0x89,
	0x00, 0x00, 0x2a, 0xb9,
	0x30
};

/* Ethernet+IP+UDP, indicating syslog */
guint8 pkt_syslog[] = {
	0xff, 0xff, 0xff, 0xff,
	0xff, 0xff, 0x01, 0x01,
	0x01, 0x01, 0x01, 0x01,
	0x08, 0x00,

	0x45, 0x00, 0x00, 0x64,
	0x20, 0x48, 0x00, 0x00,
	0xfc, 0x11, 0xf8, 0x03,
	0xd0, 0x15, 0x02, 0xb8,
	0x0a, 0x01, 0x01, 0x63,

	0x05, 0xe8, 0x02, 0x02,
	0x00, 0x50, 0x51, 0xe1,
	0x3c
};

/* TR+LLC+IP, indicating TCP */
guint8 pkt_tcp[] = {
	0x10, 0x40, 0x68, 0x00,
	0x19, 0x69, 0x95, 0x8b,
	0x00, 0x01, 0xfa, 0x68,
	0xc4, 0x67,

	0xaa, 0xaa, 0x03, 0x00,
	0x00, 0x00, 0x08, 0x00,

	0x45, 0x00, 0x00, 0x28,
	0x0b, 0x0b, 0x40, 0x00,
	0x20, 0x06, 0x85, 0x37,
	0xc0, 0xa8, 0x27, 0x01,
	0xc0, 0xa8, 0x22, 0x3c
};

/* Ethernet+IP, indicating UDP */
guint8 pkt_udp[] = {
	0xff, 0xff, 0xff, 0xff,
	0xff, 0xff, 0x01, 0x01,
	0x01, 0x01, 0x01, 0x01,
	0x08, 0x00,

	0x45, 0x00, 0x00, 0x3c,
	0xc5, 0x9e, 0x40, 0x00,
	0xff, 0x11, 0xd7, 0xe0,
	0xd0, 0x15, 0x02, 0xb8,
	0x0a, 0x01, 0x01, 0x63
};

/* Ethernet+IP+UDP, indicating BVLC */
guint8 pkt_bvlc[] = {
	0xff, 0xff, 0xff, 0xff,
	0xff, 0xff, 0x01, 0x01,
	0x01, 0x01, 0x01, 0x01,
	0x08, 0x00,

	0x45, 0x00, 0x00, 0x3c,
	0xc5, 0x9e, 0x40, 0x00,
	0xff, 0x11, 0x01, 0xaa,
	0xc1, 0xff, 0x19, 0x1e,
	0xc1, 0xff, 0x19, 0xff,
	0xba, 0xc0, 0xba, 0xc0,
	0x00, 0xff, 0x2d, 0x5e,
	0x81
};

/* This little data table drives the whole program */
pkt_example examples[] = {
	{ "arp", "Address Resolution Protocol",
		PKT_ARP,	pkt_arp,	WTAP_ENCAP_ETHERNET,	array_length(pkt_arp) },

	{ "dns", "Domain Name Service",
		PKT_DNS,	pkt_dns,	WTAP_ENCAP_ETHERNET,	array_length(pkt_dns) },

	{ "eth", "Ethernet",
		PKT_ETHERNET,	NULL,		WTAP_ENCAP_ETHERNET,	0 },

	{ "fddi", "Fiber Distributed Data Interface",
		PKT_FDDI,	NULL,		WTAP_ENCAP_FDDI,	0 },

	{ "icmp", "Internet Control Message Protocol",
		PKT_ICMP,	pkt_icmp,	WTAP_ENCAP_ETHERNET,	array_length(pkt_icmp) },

	{ "ip", "Internet Protocol",
		PKT_IP,		pkt_ip,		WTAP_ENCAP_ETHERNET,	array_length(pkt_ip) },

	{ "llc", "Logical Link Control",
		PKT_LLC,	pkt_llc,	WTAP_ENCAP_TOKEN_RING,	array_length(pkt_llc) },

	{ "nbns", "NetBIOS-over-TCP Name Service",
		PKT_NBNS,	pkt_nbns,	WTAP_ENCAP_ETHERNET,	array_length(pkt_nbns) },

	{ "syslog", "Syslog message",
		PKT_SYSLOG,	pkt_syslog,	WTAP_ENCAP_ETHERNET,	array_length(pkt_syslog) },

	{ "tcp", "Transmission Control Protocol",
		PKT_TCP,	pkt_tcp,	WTAP_ENCAP_TOKEN_RING,	array_length(pkt_tcp) },

	{ "tr",	 "Token-Ring",
		PKT_TR,		NULL,		WTAP_ENCAP_TOKEN_RING,	0 },

	{ "udp", "User Datagram Protocol",
		PKT_UDP,	pkt_udp,	WTAP_ENCAP_ETHERNET,	array_length(pkt_udp) },
	{ "bvlc", "BACnet Virtual Link Control",
		PKT_BVLC,	pkt_bvlc,	WTAP_ENCAP_ETHERNET,	array_length(pkt_bvlc) }

};



static int parse_type(char *string);
static void usage(void);
static void seed(void);

static pkt_example* find_example(int type);

int
main(int argc, char **argv)
{

	wtap_dumper		*dump;
	struct wtap_pkthdr	pkthdr;
	union wtap_pseudo_header	ps_header;
	int 			i, j, len_this_pkt, len_random, err;
	guint8			buffer[65536];

	int			opt;
	extern char		*optarg;
	extern int		optind;

	int			produce_count = 1000; /* number of pkts to produce */
	int			produce_type = PKT_ETHERNET;
	char			*produce_filename = NULL;
	int			produce_max_bytes = 5000;
	pkt_example		*example;

	while ((opt = getopt(argc, argv, "b:c:t:")) != EOF) {
		switch (opt) {
			case 'b':	/* max bytes */
				produce_max_bytes = atoi(optarg);
				if (produce_max_bytes > 65536) {
					printf("Max bytes is 65536\n");
					exit(0);
				}
				break;

			case 'c':	/* count */
				produce_count = atoi(optarg);
				break;

			case 't':	/* type of packet to produce */
				produce_type = parse_type(optarg);
				break;

			default:
				usage();
				break;
		}
	}

	/* any more command line parameters? */
	if (argc > optind) {
		produce_filename = argv[optind];
	}
	else {
		usage();
	}

	example = find_example(produce_type);

	pkthdr.ts.tv_sec = 0;
	pkthdr.ts.tv_usec = 0;
	pkthdr.pkt_encap = example->sample_wtap_encap;

	dump = wtap_dump_open(produce_filename, WTAP_FILE_PCAP,
		example->sample_wtap_encap, produce_max_bytes, &err);

	seed();

	/* reduce max_bytes by # of bytes already in sample */
	if (produce_max_bytes <= example->sample_length) {
		printf("Sample packet length is %d, which is greater than or equal to\n", example->sample_length);
		printf("your requested max_bytes value of %d\n", produce_max_bytes);
		exit(0);
	}
	else {
		produce_max_bytes -= example->sample_length;
	}

	/* Load the sample into our buffer */
	if (example->sample_buffer)
		memcpy(&buffer[0], example->sample_buffer, example->sample_length);

	/* Produce random packets */
	for (i = 0; i < produce_count; i++) {
		if (produce_max_bytes > 0) {
			len_random = (rand() % produce_max_bytes + 1);
		}
		else {
			len_random = 0;
		}

		len_this_pkt = example->sample_length + len_random;

		pkthdr.caplen = len_this_pkt;
		pkthdr.len = len_this_pkt;
		pkthdr.ts.tv_sec = i; /* just for variety */

		for (j = example->sample_length; j < len_random; j++) {
			buffer[j] = (rand() % 0x100);
		}

		wtap_dump(dump, &pkthdr, &ps_header, &buffer[0], &err);
	}

	wtap_dump_close(dump, &err);

	return 0;

}

/* Print usage statement and exit program */
static
void usage(void)
{
	int	num_entries = array_length(examples);
	int	i;

	printf("Usage: randpkt [-b maxbytes] [-c count] [-t type] filename\n");
	printf("Default max bytes (per packet) is 5000\n");
	printf("Default count is 1000.\n");
	printf("Types:\n");

	for (i = 0; i < num_entries; i++) {
		printf("\t%s\t%s\n", examples[i].abbrev, examples[i].longname);
	}

	printf("\n");

	exit(0);
}

/* Parse command-line option "type" and return enum type */
static
int parse_type(char *string)
{
	int	num_entries = array_length(examples);
	int	i;

	for (i = 0; i < num_entries; i++) {
		if (strcmp(examples[i].abbrev, string) == 0) {
			return examples[i].produceable_type;
		}
	}

	/* default type */
	return PKT_ETHERNET;
}

/* Find pkt_example record and return pointer to it */
static
pkt_example* find_example(int type)
{
	int	num_entries = array_length(examples);
	int	i;

	for (i = 0; i < num_entries; i++) {
		if (examples[i].produceable_type == type) {
			return &examples[i];
		}
	}

	printf("Internal error. Type %d has no entry in examples table.\n", type);
	exit(0);
}

/* Seed the random-number generator */
void
seed(void)
{
	unsigned int	randomness;

#if defined(linux)
	/* Okay, I should use #ifdef HAVE_DEV_RANDOM, but this is a quick hack */
	int 		fd;

	fd = open("/dev/random", O_RDONLY);
	if (fd < 0) {
		printf("Could not open /dev/random for reading: %s\n", strerror(errno));
		exit(0);
	}

	read(fd, &randomness, sizeof(randomness));
#else
	time_t now;

	now = time(NULL);
	randomness = (unsigned int) now;
#endif

	srand(randomness);
}
Wireshark logo footer

© Wireshark Foundation · Privacy Policy

Facebook·Mastodon·Twitter·YouTube