/* packet-pdcp-lte.c

 * Routines for LTE PDCP

 *

 * Martin Mathieson

 *

 * Wireshark - Network traffic analyzer

 * By Gerald Combs <gerald@wireshark.org>

 * Copyright 1998 Gerald Combs

 *

 * SPDX-License-Identifier: GPL-2.0-or-later

 */

#include "config.h"

#include <epan/packet.h>

#include <epan/prefs.h>

#include <epan/expert.h>

#include <epan/uat.h>

#include <epan/proto_data.h>

#include <epan/tfs.h>

#include <wsutil/array.h>

#include <wsutil/wsgcrypt.h>

#include <wsutil/report_message.h>

/* Define these symbols if you have working implementations of SNOW3G/ZUC f8() and f9() available.

   Note that the use of these algorithms is restricted, so a version of Wireshark with these

   ciphering algorithms enabled would not be distributable. */

/* #define HAVE_SNOW3G */

/* #define HAVE_ZUC */

#include "packet-mac-lte.h"

#include "packet-rlc-lte.h"

#include "packet-pdcp-lte.h"

void proto_register_pdcp_lte(void);

void proto_reg_handoff_pdcp_lte(void);

/* Described in:

 * 3GPP TS 36.323 Evolved Universal Terrestrial Radio Access (E-UTRA)

 *                Packet Data Convergence Protocol (PDCP) specification v14.3.0

 */

/* TODO:

   - Decipher even if sequence analysis isn't 'OK'?

      - know SN, but might be unsure about HFN.

   - Speed up AES decryption by keeping the crypt handle around for the channel

     (like ESP decryption in IPSEC dissector).  N.B. do lazily when it needs to be used.

     CTR will need to be applied before each frame.

   - Add Relay Node user plane data PDU dissection

   - Add SLRB user data plane data PDU dissection

   - Break out security and sequence analysis into a separate common file to be

     shared with pdcp-nr

*/

/* Initialize the protocol and registered fields. */

int proto_pdcp_lte;

extern int proto_rlc_lte;

/* Configuration (info known outside of PDU) */

static int hf_pdcp_lte_configuration;

static int hf_pdcp_lte_direction;

static int hf_pdcp_lte_ueid;

static int hf_pdcp_lte_channel_type;

static int hf_pdcp_lte_channel_id;

static int hf_pdcp_lte_rohc_compression;

static int hf_pdcp_lte_rohc_mode;

static int hf_pdcp_lte_rohc_rnd;

static int hf_pdcp_lte_rohc_udp_checksum_present;

static int hf_pdcp_lte_rohc_profile;

static int hf_pdcp_lte_no_header_pdu;

static int hf_pdcp_lte_plane;

static int hf_pdcp_lte_seqnum_length;

static int hf_pdcp_lte_cid_inclusion_info;

static int hf_pdcp_lte_large_cid_present;

/* PDCP header fields */

static int hf_pdcp_lte_control_plane_reserved;

static int hf_pdcp_lte_seq_num_5;

static int hf_pdcp_lte_seq_num_7;

static int hf_pdcp_lte_reserved3;

static int hf_pdcp_lte_seq_num_12;

static int hf_pdcp_lte_seq_num_15;

static int hf_pdcp_lte_polling;

static int hf_pdcp_lte_reserved5;

static int hf_pdcp_lte_seq_num_18;

static int hf_pdcp_lte_signalling_data;

static int hf_pdcp_lte_mac;

static int hf_pdcp_lte_data_control;

static int hf_pdcp_lte_user_plane_data;

static int hf_pdcp_lte_control_pdu_type;

static int hf_pdcp_lte_fms;

static int hf_pdcp_lte_reserved4;

static int hf_pdcp_lte_fms2;

static int hf_pdcp_lte_reserved6;

static int hf_pdcp_lte_fms3;

static int hf_pdcp_lte_bitmap;

static int hf_pdcp_lte_bitmap_byte;

static int hf_pdcp_lte_hrw;

static int hf_pdcp_lte_nmp;

static int hf_pdcp_lte_reserved7;

static int hf_pdcp_lte_hrw2;

static int hf_pdcp_lte_nmp2;

static int hf_pdcp_lte_hrw3;

static int hf_pdcp_lte_reserved8;

static int hf_pdcp_lte_nmp3;

static int hf_pdcp_lte_lsn;

static int hf_pdcp_lte_lsn2;

static int hf_pdcp_lte_lsn3;

/* Sequence Analysis */

static int hf_pdcp_lte_sequence_analysis;

static int hf_pdcp_lte_sequence_analysis_ok;

static int hf_pdcp_lte_sequence_analysis_previous_frame;

static int hf_pdcp_lte_sequence_analysis_next_frame;

static int hf_pdcp_lte_sequence_analysis_expected_sn;

static int hf_pdcp_lte_sequence_analysis_repeated;

static int hf_pdcp_lte_sequence_analysis_skipped;

/* Security Settings */

static int hf_pdcp_lte_security;

static int hf_pdcp_lte_security_setup_frame;

static int hf_pdcp_lte_security_integrity_algorithm;

static int hf_pdcp_lte_security_ciphering_algorithm;

static int hf_pdcp_lte_security_bearer;

static int hf_pdcp_lte_security_direction;

static int hf_pdcp_lte_security_count;

static int hf_pdcp_lte_security_cipher_key;

static int hf_pdcp_lte_security_integrity_key;

static int hf_pdcp_lte_security_deciphered_data;

/* Protocol subtree. */

static int ett_pdcp;

static int ett_pdcp_configuration;

static int ett_pdcp_packet;

static int ett_pdcp_lte_sequence_analysis;

static int ett_pdcp_report_bitmap;

static int ett_pdcp_security;

static expert_field ei_pdcp_lte_sequence_analysis_wrong_sequence_number;

static expert_field ei_pdcp_lte_reserved_bits_not_zero;

static expert_field ei_pdcp_lte_sequence_analysis_sn_repeated;

static expert_field ei_pdcp_lte_sequence_analysis_sn_missing;

static expert_field ei_pdcp_lte_digest_wrong;

static expert_field ei_pdcp_lte_unknown_udp_framing_tag;

static expert_field ei_pdcp_lte_missing_udp_framing_tag;

/*-------------------------------------

 * UAT for UE Keys

 *-------------------------------------

 */

/* UAT entry structure. */

typedef struct {

   uint32_t ueid;

   char    *rrcCipherKeyString;

   char    *upCipherKeyString;

   char    *rrcIntegrityKeyString;

   uint8_t  rrcCipherBinaryKey[16];

   bool rrcCipherKeyOK;

   uint8_t  upCipherBinaryKey[16];

   bool upCipherKeyOK;

   uint8_t  rrcIntegrityBinaryKey[16];

   bool rrcIntegrityKeyOK;

} uat_ue_keys_record_t;

/* N.B. this is an array/table of the struct above, where ueid is the key */

static uat_ue_keys_record_t *uat_ue_keys_records;

/* Entries added by UAT */

static uat_t * ue_keys_uat;

static unsigned num_ue_keys_uat;

/* Convert an ascii hex character into a digit.  Should only be given valid

   hex ascii characters */

static unsigned char hex_ascii_to_binary(char c)

{

    if ((c >= '0') && (c <= '9')) {

        return c - '0';

    }

    else if ((c >= 'a') && (c <= 'f')) {

        return 10 + c - 'a';

    }

    else if ((c >= 'A') && (c <= 'F')) {

        return 10 + c - 'A';

    }

    else {

        return 0;

    }

}

static void* uat_ue_keys_record_copy_cb(void* n, const void* o, size_t siz _U_) {

    uat_ue_keys_record_t* new_rec = (uat_ue_keys_record_t *)n;

    const uat_ue_keys_record_t* old_rec = (const uat_ue_keys_record_t *)o;

    new_rec->ueid = old_rec->ueid;

    new_rec->rrcCipherKeyString = g_strdup(old_rec->rrcCipherKeyString);

    new_rec->upCipherKeyString = g_strdup(old_rec->upCipherKeyString);

    new_rec->rrcIntegrityKeyString = g_strdup(old_rec->rrcIntegrityKeyString);

    return new_rec;

}

/* If raw_string is a valid key, set check_string & return true.  Can be spaced out with ' ' or '-' */

static bool check_valid_key_string(const char* raw_string, char* checked_string, char **error)

{

    unsigned n;

    unsigned written = 0;

    unsigned length = (int)strlen(raw_string);

    /* Can't be valid if not long enough. */

    if (length < 32) {

        if (length > 0) {

            *error = ws_strdup_printf("PDCP LTE: Invalid key string (%s) - should include 32 ASCII hex characters (16 bytes) but only %u chars given",

                                     raw_string, length);

        }

        return false;

    }

    for (n=0; (n < length) && (written < 32); n++) {

        char c = raw_string[n];

        /* Skipping past allowed 'padding' characters */

        if ((c == ' ') || (c == '-')) {

            continue;

        }

        /* Other characters must be hex digits, otherwise string is invalid */

        if (((c >= '0') && (c <= '9')) ||

            ((c >= 'a') && (c <= 'f')) ||

            ((c >= 'A') && (c <= 'F'))) {

            checked_string[written++] = c;

        }

        else {

            *error = ws_strdup_printf("PDCP-LTE: Invalid char '%c' given in key", c);

            return false;

        }

    }

    /* Must have found exactly 32 hex ascii chars for 16-byte key */

    if (n<length) {

        *error = ws_strdup_printf("PDCP-LTE: Key (%s) should contain 32 hex characters (16 bytes) but more detected", raw_string);

        return false;

    }

    if (written != 32) {

        *error = ws_strdup_printf("PDCP-LTE: Key (%s) should contain 32 hex characters (16 bytes) but %u detected", raw_string, written);

        return false;

    }

    else {

        return true;

    }

}

/* Write binary key by converting each nibble from the string version */

static void update_key_from_string(const char *stringKey, uint8_t *binaryKey, bool *pKeyOK, char **error)

{

    int  n;

    char cleanString[32];

    if (!check_valid_key_string(stringKey, cleanString, error)) {

        *pKeyOK = false;

    }

    else {

        for (n=0; n < 32; n += 2) {

            binaryKey[n/2] = (hex_ascii_to_binary(cleanString[n]) << 4) +

                              hex_ascii_to_binary(cleanString[n+1]);

        }

        *pKeyOK = true;

    }

}

/* Update by checking whether the 3 key strings are valid or not, and storing result */

static bool uat_ue_keys_record_update_cb(void* record, char** error) {

    uat_ue_keys_record_t* rec = (uat_ue_keys_record_t *)record;

    /* Check and convert RRC key */

    update_key_from_string(rec->rrcCipherKeyString, rec->rrcCipherBinaryKey, &rec->rrcCipherKeyOK, error);

    /* Check and convert User-plane key */

    update_key_from_string(rec->upCipherKeyString, rec->upCipherBinaryKey, &rec->upCipherKeyOK, error);

    /* Check and convert Integrity key */

    update_key_from_string(rec->rrcIntegrityKeyString, rec->rrcIntegrityBinaryKey, &rec->rrcIntegrityKeyOK, error);

    /* Return true only if *error has not been set by checking code. */

    return *error == NULL;

}

/* Free heap parts of record */

static void uat_ue_keys_record_free_cb(void*r) {

    uat_ue_keys_record_t* rec = (uat_ue_keys_record_t*)r;

    g_free(rec->rrcCipherKeyString);

    g_free(rec->upCipherKeyString);

    g_free(rec->rrcIntegrityKeyString);

}

UAT_DEC_CB_DEF(uat_ue_keys_records, ueid, uat_ue_keys_record_t)

UAT_CSTRING_CB_DEF(uat_ue_keys_records, rrcCipherKeyString, uat_ue_keys_record_t)

UAT_CSTRING_CB_DEF(uat_ue_keys_records, upCipherKeyString,  uat_ue_keys_record_t)

UAT_CSTRING_CB_DEF(uat_ue_keys_records, rrcIntegrityKeyString,  uat_ue_keys_record_t)

/* Also supporting a hash table with entries from these functions */

/* Table from ueid -> ue_key_entries_t* */

static wmem_map_t *pdcp_security_key_hash;

typedef enum {

    rrc_cipher,

    rrc_integrity,

    up_cipher,

} ue_key_type_t;

typedef struct {

    ue_key_type_t key_type;

    char          *keyString;

    uint8_t       binaryKey[16];

    bool          keyOK;

    uint32_t      setup_frame;

} key_entry_t;

/* List of key entries for an individual UE */

typedef struct {

    #define MAX_KEY_ENTRIES_PER_UE 32

    unsigned    num_entries_set;

    key_entry_t entries[MAX_KEY_ENTRIES_PER_UE];

} ue_key_entries_t;

void set_pdcp_lte_rrc_ciphering_key(uint16_t ueid, const char *key, uint32_t frame_num)

{

    char *err = NULL;

    /* Get or create struct for this UE */

    ue_key_entries_t *key_entries = (ue_key_entries_t*)wmem_map_lookup(pdcp_security_key_hash,

                                                                       GUINT_TO_POINTER((unsigned)ueid));

    if (key_entries == NULL) {

        /* Create and add to table */

        key_entries = wmem_new0(wmem_file_scope(), ue_key_entries_t);

        wmem_map_insert(pdcp_security_key_hash, GUINT_TO_POINTER((unsigned)ueid), key_entries);

    }

    if (key_entries->num_entries_set == MAX_KEY_ENTRIES_PER_UE) {

        /* No more room.. */

        return;

    }

    key_entry_t *new_key_entry = &key_entries->entries[key_entries->num_entries_set++];

    new_key_entry->key_type = rrc_cipher;

    new_key_entry->keyString = g_strdup(key);

    new_key_entry->setup_frame = frame_num;

    update_key_from_string(new_key_entry->keyString, new_key_entry->binaryKey, &new_key_entry->keyOK, &err);

    if (err) {

        report_failure("%s: (RRC Ciphering Key)", err);

        g_free(err);

    }

}

void set_pdcp_lte_rrc_integrity_key(uint16_t ueid, const char *key, uint32_t frame_num)

{

    char *err = NULL;

    /* Get or create struct for this UE */

    ue_key_entries_t *key_entries = (ue_key_entries_t*)wmem_map_lookup(pdcp_security_key_hash,

                                                                       GUINT_TO_POINTER((unsigned)ueid));

    if (key_entries == NULL) {

        /* Create and add to table */

        key_entries = wmem_new0(wmem_file_scope(), ue_key_entries_t);

        wmem_map_insert(pdcp_security_key_hash, GUINT_TO_POINTER((unsigned)ueid), key_entries);

    }

    if (key_entries->num_entries_set == MAX_KEY_ENTRIES_PER_UE) {

        /* No more room.. */

        return;

    }

    key_entry_t *new_key_entry = &key_entries->entries[key_entries->num_entries_set++];

    new_key_entry->key_type = rrc_integrity;

    new_key_entry->keyString = g_strdup(key);

    new_key_entry->setup_frame = frame_num;

    update_key_from_string(new_key_entry->keyString, new_key_entry->binaryKey, &new_key_entry->keyOK, &err);

    if (err) {

        report_failure("%s: (RRC Ciphering Key)", err);

        g_free(err);

    }

}

void set_pdcp_lte_up_ciphering_key(uint16_t ueid, const char *key, uint32_t frame_num)

{

    char *err = NULL;

    /* Get or create struct for this UE */

    ue_key_entries_t *key_entries = (ue_key_entries_t*)wmem_map_lookup(pdcp_security_key_hash,

                                                                       GUINT_TO_POINTER((unsigned)ueid));

    if (key_entries == NULL) {

        /* Create and add to table */

        key_entries = wmem_new0(wmem_file_scope(), ue_key_entries_t);

        wmem_map_insert(pdcp_security_key_hash, GUINT_TO_POINTER((unsigned)ueid), key_entries);

    }

    if (key_entries->num_entries_set == MAX_KEY_ENTRIES_PER_UE) {

        /* No more room.. */

        return;

    }

    key_entry_t *new_key_entry = &key_entries->entries[key_entries->num_entries_set++];

    new_key_entry->key_type = up_cipher;

    new_key_entry->keyString = g_strdup(key);

    new_key_entry->setup_frame = frame_num;

    update_key_from_string(new_key_entry->keyString, new_key_entry->binaryKey, &new_key_entry->keyOK, &err);

    if (err) {

        report_failure("%s: (RRC Ciphering Key)", err);

        g_free(err);

    }

}

/* Preference settings for deciphering and integrity checking. */

static bool global_pdcp_decipher_signalling = true;

static bool global_pdcp_decipher_userplane;  /* Can be slow, so default to false */

static bool global_pdcp_check_integrity = true;

static bool global_pdcp_ignore_sec;          /* Ignore Set Security Algo calls */

/* Use these values where we know the keys but may have missed the algorithm,

   e.g. when handing over and RRCReconfigurationRequest goes to target cell only */

static enum lte_security_ciphering_algorithm_e global_default_ciphering_algorithm = eea0;

static enum lte_security_integrity_algorithm_e global_default_integrity_algorithm = eia0;

static const value_string direction_vals[] =

{

    { DIRECTION_UPLINK,      "Uplink"},

    { DIRECTION_DOWNLINK,    "Downlink"},

    { 0, NULL }

};

static const value_string pdcp_plane_vals[] = {

    { SIGNALING_PLANE,    "Signalling" },

    { USER_PLANE,         "User" },

    { 0,   NULL }

};

static const value_string logical_channel_vals[] = {

    { Channel_DCCH,  "DCCH"},

    { Channel_BCCH,  "BCCH"},

    { Channel_CCCH,  "CCCH"},

    { Channel_PCCH,  "PCCH"},

    { 0,             NULL}

};

static const value_string rohc_mode_vals[] = {

    { UNIDIRECTIONAL,            "Unidirectional" },

    { OPTIMISTIC_BIDIRECTIONAL,  "Optimistic Bidirectional" },

    { RELIABLE_BIDIRECTIONAL,    "Reliable Bidirectional" },

    { 0,   NULL }

};

/* Values taken from:

   http://www.iana.org/assignments/rohc-pro-ids/rohc-pro-ids.txt */

static const value_string rohc_profile_vals[] = {

    { 0x0000,   "ROHC uncompressed" },      /* [RFC5795] */

    { 0x0001,   "ROHC RTP" },               /* [RFC3095] */

    { 0x0002,   "ROHC UDP" },               /* [RFC3095] */

    { 0x0003,   "ROHC ESP" },               /* [RFC3095] */

    { 0x0004,   "ROHC IP" },                /* [RFC3843] */

    { 0x0005,   "ROHC LLA" },               /* [RFC4362] */

    { 0x0006,   "ROHC TCP" },               /* [RFC4996] */

    { 0x0007,   "ROHC RTP/UDP-Lite" },      /* [RFC4019] */

    { 0x0008,   "ROHC UDP-Lite" },          /* [RFC4019] */

    { 0x0101,   "ROHCv2 RTP" },             /* [RFC5225] */

    { 0x0102,   "ROHCv2 UDP" },             /* [RFC5225] */

    { 0x0103,   "ROHCv2 ESP" },             /* [RFC5225] */

    { 0x0104,   "ROHCv2 IP" },              /* [RFC5225] */

    { 0x0105,   "ROHC LLA with R-mode" },   /* [RFC3408] */

    { 0x0107,   "ROHCv2 RTP/UDP-Lite" },    /* [RFC5225] */

    { 0x0108,   "ROHCv2 UDP-Lite" },        /* [RFC5225] */

    { 0,   NULL }

};

static const value_string control_pdu_type_vals[] = {

    { 0,   "PDCP status report" },

    { 1,   "Interspersed ROHC feedback packet" },

    { 2,   "LWA status report" },

    { 3,   "LWA end-marker packet"},

    { 0,   NULL }

};

static const value_string integrity_algorithm_vals[] = {

    { eia0,   "EIA0 (NULL)" },

    { eia1,   "EIA1 (SNOW3G)" },

    { eia2,   "EIA2 (AES)" },

    { eia3,   "EIA3 (ZUC)" },

    { 0,   NULL }

};

static const value_string ciphering_algorithm_vals[] = {

    { eea0,   "EEA0 (NULL)" },

    { eea1,   "EEA1 (SNOW3G)" },

    { eea2,   "EEA2 (AES)" },

    { eea3,   "EEA3 (ZUC)" },

    { 0,   NULL }

};

static dissector_handle_t ip_handle;

static dissector_handle_t ipv6_handle;

static dissector_handle_t rohc_handle;

static dissector_handle_t lte_rrc_ul_ccch;

static dissector_handle_t lte_rrc_dl_ccch;

static dissector_handle_t lte_rrc_pcch;

static dissector_handle_t lte_rrc_bcch_bch;

static dissector_handle_t lte_rrc_bcch_dl_sch;

static dissector_handle_t lte_rrc_ul_dcch;

static dissector_handle_t lte_rrc_dl_dcch;

static dissector_handle_t lte_rrc_ul_ccch_nb;

static dissector_handle_t lte_rrc_dl_ccch_nb;

static dissector_handle_t lte_rrc_pcch_nb;

static dissector_handle_t lte_rrc_bcch_bch_nb;

static dissector_handle_t lte_rrc_bcch_dl_sch_nb;

static dissector_handle_t lte_rrc_ul_dcch_nb;

static dissector_handle_t lte_rrc_dl_dcch_nb;

#define SEQUENCE_ANALYSIS_RLC_ONLY  1

#define SEQUENCE_ANALYSIS_PDCP_ONLY 2

/* Preference variables */

static bool global_pdcp_dissect_user_plane_as_ip = true;

static bool global_pdcp_dissect_signalling_plane_as_rrc = true;

static int  global_pdcp_check_sequence_numbers = SEQUENCE_ANALYSIS_RLC_ONLY;

static bool global_pdcp_dissect_rohc;

/* Which layer info to show in the info column */

enum layer_to_show {

    ShowRLCLayer, ShowPDCPLayer, ShowTrafficLayer

};

static int      global_pdcp_lte_layer_to_show = (int)ShowRLCLayer;

/**************************************************/

/* Sequence number analysis                       */

/* Channel key */

typedef struct

{

    /* Using bit fields to fit into 32 bits, so avoiding the need to allocate

       heap memory for these structs */

    unsigned        ueId : 16;

    unsigned        plane : 2;

    unsigned        channelId : 6;

    unsigned        direction : 1;

    unsigned        notUsed : 7;

} pdcp_channel_hash_key;

/* Channel state */

typedef struct

{

    uint32_t previousSequenceNumber;

    uint32_t previousFrameNum;

    uint32_t hfn;

} pdcp_channel_status;

/* The sequence analysis channel hash table.

   Maps pdcp_channel_hash_key -> *pdcp_channel_status */

static wmem_map_t *pdcp_sequence_analysis_channel_hash;

/* Hash table types & functions for frame reports */

typedef struct {

    uint32_t        frameNumber;

    uint32_t        SN :       18;

    uint32_t        plane :    2;

    uint32_t        channelId: 5;

    uint32_t        direction: 1;

    uint32_t        notUsed :  6;

} pdcp_result_hash_key;

static int pdcp_result_hash_equal(const void *v, const void *v2)

{

    const pdcp_result_hash_key* val1 = (const pdcp_result_hash_key *)v;

    const pdcp_result_hash_key* val2 = (const pdcp_result_hash_key *)v2;

    /* All fields must match */

    return (memcmp(val1, val2, sizeof(pdcp_result_hash_key)) == 0);

}

/* Compute a hash value for a given key. */

static unsigned pdcp_result_hash_func(const void *v)

{

    const pdcp_result_hash_key* val1 = (const pdcp_result_hash_key *)v;

    /* TODO: This is a bit random.  */

    return val1->frameNumber + (val1->channelId<<7) +

                               (val1->plane<<12) +

                               (val1->SN<<14) +

                               (val1->direction<<6);

}

/* pdcp_channel_hash_key fits into the pointer, so just copy the value into

   a unsigned, cast to a pointer and return that as the key */

static void *get_channel_hash_key(pdcp_channel_hash_key *key)

{

    unsigned  asInt = 0;

    /* TODO: assert that sizeof(pdcp_channel_hash_key) <= sizeof(unsigned) ? */

    memcpy(&asInt, key, sizeof(pdcp_channel_hash_key));

    return GUINT_TO_POINTER(asInt);

}

/* Convenience function to get a pointer for the hash_func to work with */

static void *get_report_hash_key(uint32_t SN, uint32_t frameNumber,

                                    pdcp_lte_info *p_pdcp_lte_info,

                                    bool do_persist)

{

    static pdcp_result_hash_key  key;

    pdcp_result_hash_key        *p_key;

    /* Only allocate a struct when will be adding entry */

    if (do_persist) {

        p_key = wmem_new(wmem_file_scope(), pdcp_result_hash_key);

    }

    else {

        memset(&key, 0, sizeof(pdcp_result_hash_key));

        p_key = &key;

    }

    /* Fill in details, and return pointer */

    p_key->frameNumber = frameNumber;

    p_key->SN = SN;

    p_key->plane = (uint8_t)p_pdcp_lte_info->plane;

    p_key->channelId = p_pdcp_lte_info->channelId;

    p_key->direction = p_pdcp_lte_info->direction;

    p_key->notUsed = 0;

    return p_key;

}

/* Info to attach to frame when first read, recording what to show about sequence */

typedef enum

{

    SN_OK, SN_Repeated, SN_MAC_Retx, SN_Retx, SN_Missing

} sequence_state;

typedef struct

{

    bool sequenceExpectedCorrect;

    uint32_t sequenceExpected;

    uint32_t previousFrameNum;

    uint32_t nextFrameNum;

    uint32_t firstSN;

    uint32_t lastSN;

    uint32_t hfn;

    sequence_state state;

} pdcp_sequence_report_in_frame;

/* The sequence analysis frame report hash table.

   Maps pdcp_result_hash_key* -> pdcp_sequence_report_in_frame* */

static wmem_map_t *pdcp_lte_sequence_analysis_report_hash;

/* Gather together security settings in order to be able to do deciphering */

typedef struct pdu_security_settings_t

{

    enum lte_security_ciphering_algorithm_e ciphering;

    enum lte_security_integrity_algorithm_e integrity;

    uint8_t* cipherKey;

    uint8_t* integrityKey;

    bool cipherKeyValid;

    bool integrityKeyValid;

    uint32_t count;

    uint8_t bearer;

    uint8_t direction;

} pdu_security_settings_t;

static uat_ue_keys_record_t* look_up_keys_record(uint16_t ueid, uint32_t frame_num,

                                                 uint32_t *config_frame_rrc_cipher,

                                                 uint32_t *config_frame_rrc_integrity,

                                                 uint32_t *config_frame_up_cipher)

{

    unsigned int record_id;

    /* Try hash table first (among entries added by set_pdcp_nr_xxx_key() functions) */

    ue_key_entries_t* key_record = (ue_key_entries_t*)wmem_map_lookup(pdcp_security_key_hash,

                                                                      GUINT_TO_POINTER((unsigned)ueid));

    if (key_record != NULL) {

        /* Will build up and return usual type */

        uat_ue_keys_record_t *keys = wmem_new0(wmem_file_scope(), uat_ue_keys_record_t);

        /* Fill in details */

        keys->ueid = ueid;

        /* Walk entries backwards (want last entry before frame_num) */

        for (int e=key_record->num_entries_set; e>0; e--) {

            key_entry_t *entry = &key_record->entries[e-1];

            if (frame_num > entry->setup_frame) {

                /* This frame is after corresponding setup, so can adopt if don't have one */

                switch (entry->key_type) {

                    case rrc_cipher:

                        if (!keys->rrcCipherKeyOK) {

                            keys->rrcCipherKeyString = entry->keyString;

                            memcpy(keys->rrcCipherBinaryKey, entry->binaryKey, 16);

                            keys->rrcCipherKeyOK = entry->keyOK;

                            *config_frame_rrc_cipher = entry->setup_frame;

                        }

                        break;

                    case rrc_integrity:

                        if (!keys->rrcIntegrityKeyOK) {

                            keys->rrcIntegrityKeyString = entry->keyString;

                            memcpy(keys->rrcIntegrityBinaryKey, entry->binaryKey, 16);

                            keys->rrcIntegrityKeyOK = entry->keyOK;

                            *config_frame_rrc_integrity = entry->setup_frame;

                        }

                        break;

                    case up_cipher:

                        if (!keys->upCipherKeyOK) {

                            keys->upCipherKeyString = entry->keyString;

                            memcpy(keys->upCipherBinaryKey, entry->binaryKey, 16);

                            keys->upCipherKeyOK = entry->keyOK;

                            *config_frame_up_cipher = entry->setup_frame;

                        }

                        break;

                }

            }

        }

        /* Return this struct (even if doesn't have all/any keys set..) */

        return keys;

    }

    /* Else look up UAT entries. N.B. linear search... */

    for (record_id=0; record_id < num_ue_keys_uat; record_id++) {

        if (uat_ue_keys_records[record_id].ueid == ueid) {

            return &uat_ue_keys_records[record_id];

        }

    }

    /* No match at all - return NULL */

    return NULL;

}

/* Add to the tree values associated with sequence analysis for this frame */

static void addChannelSequenceInfo(pdcp_sequence_report_in_frame *p,

                                   pdcp_lte_info *p_pdcp_lte_info,

                                   uint32_t  sequenceNumber,

                                   packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb,

                                   proto_tree *security_tree,

                                   pdu_security_settings_t *pdu_security)

{

    proto_tree *seqnum_tree;

    proto_item *seqnum_ti;

    proto_item *ti_expected_sn;

    proto_item *ti;

    uat_ue_keys_record_t *keys_record;

    /* Create subtree */

    seqnum_ti = proto_tree_add_string_format(tree,

                                             hf_pdcp_lte_sequence_analysis,

                                             tvb, 0, 0,

                                             "", "Sequence Analysis");

    seqnum_tree = proto_item_add_subtree(seqnum_ti,

                                         ett_pdcp_lte_sequence_analysis);

    proto_item_set_generated(seqnum_ti);

    /* Previous channel frame */

    if (p->previousFrameNum != 0) {

        proto_tree_add_uint(seqnum_tree, hf_pdcp_lte_sequence_analysis_previous_frame,

                            tvb, 0, 0, p->previousFrameNum);

    }

    /* Expected sequence number */

    ti_expected_sn = proto_tree_add_uint(seqnum_tree, hf_pdcp_lte_sequence_analysis_expected_sn,

                                         tvb, 0, 0, p->sequenceExpected);

    proto_item_set_generated(ti_expected_sn);

    /* Make sure we have recognised SN length */

    switch (p_pdcp_lte_info->seqnum_length) {

        case PDCP_SN_LENGTH_5_BITS:

        case PDCP_SN_LENGTH_7_BITS:

        case PDCP_SN_LENGTH_12_BITS:

        case PDCP_SN_LENGTH_15_BITS:

        case PDCP_SN_LENGTH_18_BITS:

            break;

        default:

            DISSECTOR_ASSERT_NOT_REACHED();

            break;

    }

    switch (p->state) {

        case SN_OK:

            proto_item_set_hidden(ti_expected_sn);

            ti = proto_tree_add_boolean(seqnum_tree, hf_pdcp_lte_sequence_analysis_ok,

                                        tvb, 0, 0, true);

            proto_item_set_generated(ti);

            proto_item_append_text(seqnum_ti, " - OK");

            /* Link to next SN in channel (if known) */

            if (p->nextFrameNum != 0) {

                proto_tree_add_uint(seqnum_tree, hf_pdcp_lte_sequence_analysis_next_frame,

                                    tvb, 0, 0, p->nextFrameNum);

            }

            /* May also be able to add key inputs to security tree here */

            if ((pdu_security->ciphering != eea0) ||

                (pdu_security->integrity != eia0)) {

                uint32_t             hfn_multiplier;

                uint32_t             count;

                char                 *cipher_key = NULL;

                char                 *integrity_key = NULL;

                /* BEARER */

                ti = proto_tree_add_uint(security_tree, hf_pdcp_lte_security_bearer,

                                         tvb, 0, 0, p_pdcp_lte_info->channelId-1);

                proto_item_set_generated(ti);

                pdu_security->bearer = p_pdcp_lte_info->channelId-1;

                /* DIRECTION */

                ti = proto_tree_add_uint(security_tree, hf_pdcp_lte_security_direction,

                                         tvb, 0, 0, p_pdcp_lte_info->direction);

                proto_item_set_generated(ti);

                /* COUNT (HFN * snLength^2 + SN) */

                switch (p_pdcp_lte_info->seqnum_length) {

                    case PDCP_SN_LENGTH_5_BITS:

                        hfn_multiplier = 32;

                        break;

                    case PDCP_SN_LENGTH_7_BITS:

                        hfn_multiplier = 128;

                        break;

                    case PDCP_SN_LENGTH_12_BITS:

                        hfn_multiplier = 4096;

                        break;

                    case PDCP_SN_LENGTH_15_BITS:

                        hfn_multiplier = 32768;

                        break;

                    case PDCP_SN_LENGTH_18_BITS:

                        hfn_multiplier = 262144;

                        break;

                    default:

                        DISSECTOR_ASSERT_NOT_REACHED();

                        break;

                }

                count = (p->hfn * hfn_multiplier) + sequenceNumber;

                ti = proto_tree_add_uint(security_tree, hf_pdcp_lte_security_count,

                                         tvb, 0, 0, count);

                proto_item_set_generated(ti);

                pdu_security->count = count;

                /* KEY.  Look this UE up among UEs that have keys configured */

                uint32_t config_frame_rrc_cipher=0, config_frame_rrc_integrity=0,

                        config_frame_up_cipher=0;

                keys_record = look_up_keys_record(p_pdcp_lte_info->ueid, pinfo->num,

                                                  &config_frame_rrc_cipher, &config_frame_rrc_integrity,

                                                  &config_frame_up_cipher);

                if (keys_record != NULL) {

                    if (p_pdcp_lte_info->plane == SIGNALING_PLANE) {

                        /* Get RRC ciphering key */

                        if (keys_record->rrcCipherKeyOK) {

                            cipher_key = keys_record->rrcCipherKeyString;

                            pdu_security->cipherKey = &(keys_record->rrcCipherBinaryKey[0]);

                            pdu_security->cipherKeyValid = true;

                        }

                        /* Get RRC integrity key */

                        if (keys_record->rrcIntegrityKeyOK) {

                            integrity_key = keys_record->rrcIntegrityKeyString;

                            pdu_security->integrityKey = &(keys_record->rrcIntegrityBinaryKey[0]);

                            pdu_security->integrityKeyValid = true;

                        }

                    }

                    else {

                        /* Get userplane ciphering key */

                        if (keys_record->upCipherKeyOK) {

                            cipher_key = keys_record->upCipherKeyString;

                            pdu_security->cipherKey = &(keys_record->upCipherBinaryKey[0]);

                            pdu_security->cipherKeyValid = true;

                        }

                    }

                    /* Show keys where known and valid */

                    if (cipher_key != NULL) {

                        ti = proto_tree_add_string(security_tree, hf_pdcp_lte_security_cipher_key,

                                                   tvb, 0, 0, cipher_key);

                        proto_item_set_generated(ti);

                    }

                    if (integrity_key != NULL) {

                        ti = proto_tree_add_string(security_tree, hf_pdcp_lte_security_integrity_key,

                                                   tvb, 0, 0, integrity_key);

                        proto_item_set_generated(ti);

                    }

                    pdu_security->direction = p_pdcp_lte_info->direction;

                }

            }

            break;

        case SN_Missing:

            ti = proto_tree_add_boolean(seqnum_tree, hf_pdcp_lte_sequence_analysis_ok,

                                        tvb, 0, 0, false);

            proto_item_set_generated(ti);

            ti = proto_tree_add_boolean(seqnum_tree, hf_pdcp_lte_sequence_analysis_skipped,

                                        tvb, 0, 0, true);

            proto_item_set_generated(ti);

            if (p->lastSN != p->firstSN) {

                expert_add_info_format(pinfo, ti, &ei_pdcp_lte_sequence_analysis_sn_missing,

                                       "PDCP SNs (%u to %u) missing for %s on UE %u (%s-%u)",

                                       p->firstSN, p->lastSN,

                                       val_to_str_const(p_pdcp_lte_info->direction, direction_vals, "Unknown"),

                                       p_pdcp_lte_info->ueid,

                                       val_to_str_const(p_pdcp_lte_info->channelType, logical_channel_vals, "Unknown"),

                                       p_pdcp_lte_info->channelId);

                proto_item_append_text(seqnum_ti, " - SNs missing (%u to %u)",

                                       p->firstSN, p->lastSN);

            }

            else {

                expert_add_info_format(pinfo, ti, &ei_pdcp_lte_sequence_analysis_sn_missing,

                                       "PDCP SN (%u) missing for %s on UE %u (%s-%u)",

                                       p->firstSN,

                                       val_to_str_const(p_pdcp_lte_info->direction, direction_vals, "Unknown"),

                                       p_pdcp_lte_info->ueid,

                                       val_to_str_const(p_pdcp_lte_info->channelType, logical_channel_vals, "Unknown"),

                                       p_pdcp_lte_info->channelId);

                proto_item_append_text(seqnum_ti, " - SN missing (%u)",

                                       p->firstSN);

            }

            break;

        case SN_Repeated:

            ti = proto_tree_add_boolean(seqnum_tree, hf_pdcp_lte_sequence_analysis_ok,

                                        tvb, 0, 0, false);

            proto_item_set_generated(ti);

            ti = proto_tree_add_boolean(seqnum_tree, hf_pdcp_lte_sequence_analysis_repeated,

                                        tvb, 0, 0, true);

            proto_item_set_generated(ti);

            expert_add_info_format(pinfo, ti, &ei_pdcp_lte_sequence_analysis_sn_repeated,

                                   "PDCP SN (%u) repeated for %s for UE %u (%s-%u)",

                                   p->firstSN,

                                   val_to_str_const(p_pdcp_lte_info->direction, direction_vals, "Unknown"),

                                   p_pdcp_lte_info->ueid,

                                   val_to_str_const(p_pdcp_lte_info->channelType, logical_channel_vals, "Unknown"),

                                   p_pdcp_lte_info->channelId);

            proto_item_append_text(seqnum_ti, "- SN %u Repeated",

                                   p->firstSN);

            break;

        default:

            /* Incorrect sequence number */

            expert_add_info_format(pinfo, ti_expected_sn, &ei_pdcp_lte_sequence_analysis_wrong_sequence_number,

                                   "Wrong Sequence Number for %s on UE %u (%s-%u) - got %u, expected %u",

                                   val_to_str_const(p_pdcp_lte_info->direction, direction_vals, "Unknown"),

                                   p_pdcp_lte_info->ueid,

                                   val_to_str_const(p_pdcp_lte_info->channelType, logical_channel_vals, "Unknown"),

                                   p_pdcp_lte_info->channelId,

                                   sequenceNumber, p->sequenceExpected);

            break;

    }

}