/* packet-btbredr_rf.c

 * Routines for Bluetooth Pseudoheader for BR/EDR Baseband

 *

 * Copyright 2020, Thomas Sailer <t.sailer@alumni.ethz.ch>

 * Copyright 2014, Michal Labedzki for Tieto Corporation

 * Copyright 2014, Dominic Spill <dominicgs@gmail.com>

 *

 * Wireshark - Network traffic analyzer

 * By Gerald Combs <gerald@wireshark.org>

 * Copyright 1998 Gerald Combs

 *

 * SPDX-License-Identifier: GPL-2.0-or-later

 */

#include "config.h"

#include <epan/packet.h>

#include <epan/expert.h>

#include <epan/proto_data.h>

#include <epan/reassemble.h>

#include <wiretap/wtap.h>

#include "packet-bluetooth.h"

#include "packet-btbredr_rf.h"

#include "packet-bthci_acl.h"

/*

 * Future Improvements:

 * - De-Whiten if the capture hardware did not already do it and we have the UAP

 */

static int proto_btbredr_rf;

static int proto_btbredr_fhs;

static int hf_rf_channel;

static int hf_uncertain_rf_channel;

static int hf_signal_power;

static int hf_invalid_signal_power;

static int hf_noise_power;

static int hf_invalid_noise_power;

static int hf_access_address_offenses;

static int hf_payload_transport_rate;

static int hf_payload_transport_rate_payload;

static int hf_payload_transport_rate_transport;

static int hf_payload_transport_rate_ignored;

static int hf_corrected_header_bits;

static int hf_corrected_payload_bits;

static int hf_lower_address_part;

static int hf_reference_lower_address_part;

static int hf_invalid_reference_lower_address_part;

static int hf_reference_upper_address_part;

static int hf_invalid_reference_upper_address_part;

static int hf_whitened_packet_header;

static int hf_invalid_packet_header;

static int hf_packet_header;

static int hf_packet_header_reserved;

static int hf_packet_header_lt_addr;

static int hf_packet_header_type;

static int hf_packet_header_type_any;

static int hf_packet_header_type_sco_br;

static int hf_packet_header_type_esco_br;

static int hf_packet_header_type_esco_edr;

static int hf_packet_header_type_acl_br;

static int hf_packet_header_type_acl_edr;

static int hf_packet_header_type_cpb_br;

static int hf_packet_header_type_cpb_edr;

static int hf_packet_header_flow_control;

static int hf_packet_header_acknowledge_indication;

static int hf_packet_header_sequence_number;

static int hf_packet_header_header_error_check;

static int hf_packet_header_broken_lt_addr;

static int hf_packet_header_broken_type;

static int hf_packet_header_broken_type_any;

static int hf_packet_header_broken_type_sco_br;

static int hf_packet_header_broken_type_esco_br;

static int hf_packet_header_broken_type_esco_edr;

static int hf_packet_header_broken_type_acl_br;

static int hf_packet_header_broken_type_acl_edr;

static int hf_packet_header_broken_type_cpb_br;

static int hf_packet_header_broken_type_cpb_edr;

static int hf_packet_header_broken_flow_control;

static int hf_packet_header_broken_acknowledge_indication;

static int hf_packet_header_broken_sequence_number;

static int hf_packet_header_broken_header_error_check;

static int hf_flags;

static int hf_flags_reserved_15_14;

static int hf_flags_mic_pass;

static int hf_flags_mic_checked;

static int hf_flags_crc_pass;

static int hf_flags_crc_checked;

static int hf_flags_hec_pass;

static int hf_flags_hec_checked;

static int hf_flags_reference_upper_address_part_valid;

static int hf_flags_rf_channel_aliasing;

static int hf_flags_br_edr_data_present;

static int hf_flags_reference_lower_address_part_valid;

static int hf_flags_bredr_payload_decrypted;

static int hf_flags_noise_power_valid;

static int hf_flags_signal_power_valid;

static int hf_flags_packet_header_and_br_edr_payload_dewhitened;

static int hf_whitened_data;

static int hf_encrypted_data;

static int hf_data;

static int hf_isochronous_data;

static int hf_asynchronous_data;

static int hf_l2cap_fragment;

static int hf_crc;

static int hf_payload_header2;

static int hf_payload_header2_llid;

static int hf_payload_header2_flow;

static int hf_payload_header2_length;

static int hf_payload_header2_rfu;

static int hf_payload_header1;

static int hf_payload_header1_llid;

static int hf_payload_header1_flow;

static int hf_payload_header1_length;

static int hf_l2cap_msg_fragments;

static int hf_l2cap_msg_fragment;

static int hf_l2cap_msg_fragment_overlap;

static int hf_l2cap_msg_fragment_overlap_conflicts;

static int hf_l2cap_msg_fragment_multiple_tails;

static int hf_l2cap_msg_fragment_too_long_fragment;

static int hf_l2cap_msg_fragment_error;

static int hf_l2cap_msg_fragment_count;

static int hf_l2cap_msg_reassembled_in;

static int hf_l2cap_msg_reassembled_length;

static int hf_fhs_parity;

static int hf_fhs_lap;

static int hf_fhs_eir;

static int hf_fhs_reserved;

static int hf_fhs_sr;

static int hf_fhs_sp;

static int hf_fhs_uap;

static int hf_fhs_nap;

static int hf_fhs_class;

static int hf_fhs_ltaddr;

static int hf_fhs_clk;

static int hf_fhs_pagescanmode;

#define FLAGS_MIC_PASS                                      0x2000

#define FLAGS_MIC_CHECKED                                   0x1000

#define FLAGS_CRC_PASS                                      0x0800

#define FLAGS_CRC_CHECKED                                   0x0400

#define FLAGS_HEC_PASS                                      0x0200

#define FLAGS_HEC_CHECKED                                   0x0100

#define FLAGS_REFERENCE_UPPER_ADDRESS_PART_VALID            0x0080

#define FLAGS_RF_CHANNEL_ALIASING                           0x0040

#define FLAGS_BR_EDR_DATA_PRESENT                           0x0020

#define FLAGS_REFERENCE_LOWER_ADDRESS_PART_VALID            0x0010

#define FLAGS_BREDR_PAYLOAD_DECRYPTED                       0x0008

#define FLAGS_NOISE_POWER_VALID                             0x0004

#define FLAGS_SIGNAL_POWER_VALID                            0x0002

#define FLAGS_PACKET_HEADER_AND_BR_EDR_PAYLOAD_DEWHITENED   0x0001

static int * const hfx_payload_transport_rate[] = {

    &hf_payload_transport_rate_payload,

    &hf_payload_transport_rate_transport,

    NULL

};

static expert_field ei_unexpected_data;

static expert_field ei_reserved_not_zero;

static expert_field ei_incorrect_packet_header_or_hec;

static expert_field ei_packet_header_with_hec_not_checked;

static expert_field ei_broken_packet_header_format;

static expert_field ei_incorrect_crc;

static expert_field ei_missing_fragment_start;

static expert_field ei_esco_incorrect_ltaddr;

static expert_field ei_esco_incorrect_length;

static int ett_btbredr_rf;

static int ett_flags;

static int ett_payload_transport_rate;

static int ett_packet_header;

static int ett_bluetooth_header;

static int ett_payload_header;

static int ett_l2cap_msg_fragment;

static int ett_l2cap_msg_fragments;

static int ett_btbredr_fhs;

static dissector_table_t  packet_type_sco_br_table;

static dissector_table_t  packet_type_esco_br_table;

static dissector_table_t  packet_type_esco_edr_table;

static dissector_table_t  packet_type_acl_br_table;

static dissector_table_t  packet_type_acl_edr_table;

static dissector_table_t  packet_type_cpb_br_table;

static dissector_table_t  packet_type_cpb_edr_table;

static dissector_handle_t btlmp_handle;

static dissector_handle_t btl2cap_handle;

static dissector_handle_t btbredr_rf_handle;

static dissector_handle_t btbredr_fhs_handle;

static wmem_tree_t *connection_info_tree;

static wmem_tree_t *device_info_tree;

typedef struct _device_info_t {

    uint32_t interface_id;

    uint32_t adapter_id;

    uint8_t  bd_addr[6];

    int8_t   dir;

} device_info_t;

#define BDADDR_CENTRAL  0

#define BDADDR_PERIPHERAL   1

typedef struct _btbredr_frame_info_t {

    unsigned retransmit : 1;      /* 0 = No, 1 = Retransmitted frame */

    unsigned ack : 1;             /* 0 = Nack, 1 = Ack */

    unsigned more_fragments : 1;  /* 0 = Last fragment, 1 = More fragments */

    unsigned missing_start : 1;   /* 0 = No, 1 = Missing fragment start */

    uint32_t l2cap_index;         /* Unique identifier for each L2CAP message */

} btbredr_frame_info_t;

typedef struct {

    bluetooth_data_t  *bluetooth_data;

    connection_info_t *connection_info;

    device_info_t     *device_info;

} btbredr_fhs_data_t;

static const uint8_t null_bd_addr[6] = { 0, 0, 0, 0, 0, 0 };

/* Reassembly */

static reassembly_table l2cap_msg_reassembly_table;

static const fragment_items l2cap_msg_frag_items = {

    /* Fragment subtrees */

    &ett_l2cap_msg_fragment,

    &ett_l2cap_msg_fragments,

    /* Fragment fields */

    &hf_l2cap_msg_fragments,

    &hf_l2cap_msg_fragment,

    &hf_l2cap_msg_fragment_overlap,

    &hf_l2cap_msg_fragment_overlap_conflicts,

    &hf_l2cap_msg_fragment_multiple_tails,

    &hf_l2cap_msg_fragment_too_long_fragment,

    &hf_l2cap_msg_fragment_error,

    &hf_l2cap_msg_fragment_count,

    /* Reassembled in field */

    &hf_l2cap_msg_reassembled_in,

    /* Reassembled length field */

    &hf_l2cap_msg_reassembled_length,

    /* Reassembled data field */

    NULL,

    /* Tag */

    "BT BR/EDR L2CAP fragments"

};

static const value_string payload_transport_rate_transport_vals[] = {

    { 0x00, "Any" },

    { 0x01, "SCO" },

    { 0x02, "eSCO" },

    { 0x03, "ACL" },

    { 0x04, "CPB" },

    { 0,    NULL }

};

#define TRANSPORT_ANY   0x00

#define TRANSPORT_SCO   0x10

#define TRANSPORT_eSCO  0x20

#define TRANSPORT_ACL   0x30

#define TRANSPORT_CPB   0x40

static const value_string payload_transport_rate_payload_vals[] = {

    { 0x00, "Basic Rate with GFSK demodulation" },

    { 0x01, "Enhanced Data Rate with PI/2-DQPSK demodulation" },

    { 0x02, "Enhanced Data Rate with 8DPSK demodulation" },

    { 0,    NULL }

};

static const value_string payload_transport_rate_payload_abbrev_vals[] = {

    { 0x00, "BR 1Mbps" },

    { 0x01, "EDR 2Mbps" },

    { 0x02, "EDR 3Mbps" },

    { 0,    NULL }

};

#define PAYLOAD_BR     0x00

#define PAYLOAD_EDR_2  0x01

#define PAYLOAD_EDR_3  0x02

#define PACKET_TYPE_UNKNOWN  -1

static const value_string packet_type_any_vals[] = {

    { 0x00, "NULL" },

    { 0x01, "POLL" },

    { 0x02, "FHS" },

    { 0x03, "DM1" },

    { 0x04, "DH1/2-DH1" },

    { 0x05, "HV1" },

    { 0x06, "HV2/2-EV3" },

    { 0x07, "HV3/EV3/3-EV3" },

    { 0x08, "DV/3-DH1" },

    { 0x09, "AUX1" },

    { 0x0A, "DM3/2-DH3" },

    { 0x0B, "DH3/3-DH3" },

    { 0x0C, "EV4/2-EV5" },

    { 0x0D, "EV5/3-EV5" },

    { 0x0E, "DM5/2-DH5" },

    { 0x0F, "DH5/3-DH5" },

    { 0,    NULL }

};

static const value_string packet_type_sco_br_vals[] = {

    { 0x00, "NULL" },

    { 0x01, "POLL" },

    { 0x02, "FHS" },

    { 0x03, "DM1" },

    { 0x04, "undefined" },

    { 0x05, "HV1" },

    { 0x06, "HV2" },

    { 0x07, "HV3" },

    { 0x08, "DV" },

    { 0x09, "undefined" },

    { 0x0A, "undefined" },

    { 0x0B, "undefined" },

    { 0x0C, "undefined" },

    { 0x0D, "undefined" },

    { 0x0E, "undefined" },

    { 0x0F, "undefined" },

    { 0,    NULL }

};

static const value_string packet_type_esco_br_vals[] = {

    { 0x00, "NULL" },

    { 0x01, "POLL" },

    { 0x02, "reserved" },

    { 0x03, "reserved" },

    { 0x04, "undefined" },

    { 0x05, "undefined" },

    { 0x06, "undefined" },

    { 0x07, "EV3" },

    { 0x08, "undefined" },

    { 0x09, "undefined" },

    { 0x0A, "undefined" },

    { 0x0B, "undefined" },

    { 0x0C, "EV4" },

    { 0x0D, "EV5" },

    { 0x0E, "undefined" },

    { 0x0F, "undefined" },

    { 0,    NULL }

};

static const value_string packet_type_esco_edr_vals[] = {

    { 0x00, "NULL" },

    { 0x01, "POLL" },

    { 0x02, "reserved" },

    { 0x03, "reserved" },

    { 0x04, "undefined" },

    { 0x05, "undefined" },

    { 0x06, "2-EV3" },

    { 0x07, "3-EV3" },

    { 0x08, "undefined" },

    { 0x09, "undefined" },

    { 0x0A, "undefined" },

    { 0x0B, "undefined" },

    { 0x0C, "2-EV5" },

    { 0x0D, "3-EV5" },

    { 0x0E, "undefined" },

    { 0x0F, "undefined" },

    { 0,    NULL }

};

static const value_string packet_type_acl_br_vals[] = {

    { 0x00, "NULL" },

    { 0x01, "POLL" },

    { 0x02, "FHS" },

    { 0x03, "DM1" },

    { 0x04, "DH1" },

    { 0x05, "undefined" },

    { 0x06, "undefined" },

    { 0x07, "undefined" },

    { 0x08, "undefined" },

    { 0x09, "AUX1" },

    { 0x0A, "DM3" },

    { 0x0B, "DH3" },

    { 0x0C, "undefined" },

    { 0x0D, "undefined" },

    { 0x0E, "DM5" },

    { 0x0F, "DH5" },

    { 0,    NULL }

};

static const value_string packet_type_acl_edr_vals[] = {

    { 0x00, "NULL" },

    { 0x01, "POLL" },

    { 0x02, "FHS" },

    { 0x03, "DM1" },

    { 0x04, "2-DH1" },

    { 0x05, "undefined" },

    { 0x06, "undefined" },

    { 0x07, "undefined" },

    { 0x08, "3-DH1" },

    { 0x09, "AUX1" },

    { 0x0A, "2-DH3" },

    { 0x0B, "3-DH3" },

    { 0x0C, "undefined" },

    { 0x0D, "undefined" },

    { 0x0E, "2-DH5" },

    { 0x0F, "3-DH5" },

    { 0,    NULL }

};

static const value_string packet_type_cpb_br_vals[] = {

    { 0x00, "NULL" },

    { 0x01, "reserved" },

    { 0x02, "reserved" },

    { 0x03, "DM1" },

    { 0x04, "DH1" },

    { 0x05, "undefined" },

    { 0x06, "undefined" },

    { 0x07, "undefined" },

    { 0x08, "undefined" },

    { 0x09, "undefined" },

    { 0x0A, "DM3" },

    { 0x0B, "DH3" },

    { 0x0C, "undefined" },

    { 0x0D, "undefined" },

    { 0x0E, "DM5" },

    { 0x0F, "DH5" },

    { 0,    NULL }

};

static const value_string packet_type_cpb_edr_vals[] = {

    { 0x00, "NULL" },

    { 0x01, "reserved" },

    { 0x02, "reserved" },

    { 0x03, "DM1" },

    { 0x04, "2-DH1" },

    { 0x05, "undefined" },

    { 0x06, "undefined" },

    { 0x07, "undefined" },

    { 0x08, "3-DH1" },

    { 0x09, "undefined" },

    { 0x0A, "2-DH3" },

    { 0x0B, "3-DH3" },

    { 0x0C, "undefined" },

    { 0x0D, "undefined" },

    { 0x0E, "2-DH5" },

    { 0x0F, "3-DH5" },

    { 0,    NULL }

};

static const val64_string fhs_scan_repetition_vals[] = {

    { 0x00, "R0" },

    { 0x01, "R1" },

    { 0x02, "R2" },

    { 0,    NULL }

};

static const value_string fhs_page_scan_mode_vals[] = {

    { 0x00, "Mandatory Scan Mode" },

    { 0,    NULL }

};

void proto_register_btbredr_rf(void);

void proto_reg_handoff_btbredr_rf(void);

static uint8_t

reverse_bits(uint8_t value)

{

    value = ((value >> 1) & 0x55) | ((value << 1) & 0xaa);

    value = ((value >> 2) & 0x33) | ((value << 2) & 0xcc);

    value = ((value >> 4) & 0x0f) | ((value << 4) & 0xf0);

    return value;

}

static bool

broken_check_hec(uint8_t uap, uint32_t header)

{

    uint8_t  hec;

    uint16_t header_data;

    uint8_t  lfsr;

    int8_t   i;

    hec = header & 0xFF;

    header_data = (header >> 8) & 0x3F;

    lfsr = uap;

    for (i = 9; i >= 0; i -= 1) {

        if (lfsr & 0x80)

            lfsr ^= 0x65;

        lfsr = (lfsr << 1) | (((lfsr >> 7) ^ (header_data >> i)) & 0x01);

    }

    lfsr = reverse_bits(lfsr);

    return lfsr == hec;

}

static bool

check_hec(uint8_t uap, uint32_t header)

{

    static const uint32_t crc_poly_rev_bt_hec = 0xe5;

    header &= 0x3ffff;

    header ^= reverse_bits(uap) & 0xff;

    for (unsigned i = 0; i < 10; ++i, header >>= 1)

        if (header & 1)

            header ^= (crc_poly_rev_bt_hec << 1);

    return !header;

}

static bool

check_crc(uint8_t uap, tvbuff_t *tvb, int offset, int len)

{

    static const uint16_t crc_poly_rev_bt_pdu = 0x8408;

    uint16_t crc = reverse_bits(uap);

    crc <<= 8;

    for (; len > 0; --len, ++offset) {

        crc ^= tvb_get_uint8(tvb, offset) & 0xff;

        for (unsigned i = 0; i < 8; ++i) {

            uint16_t x = crc & 1;

            crc >>= 1;

            crc ^= crc_poly_rev_bt_pdu & -x;

        }

    }

    return !crc;

}

static uint32_t

extract_lap(const uint8_t bd_addr[6])

{

    uint32_t lap = bd_addr[3];

    lap <<= 8;

    lap |= bd_addr[4];

    lap <<= 8;

    lap |= bd_addr[5];

    return lap;

}

static bool

is_reserved_lap(uint32_t lap)

{

    return (lap >= 0x9e8b00) && (lap <= 0x9e8b3f);

}

static connection_info_t *

lookup_connection_info(uint32_t interface_id, uint32_t adapter_id, uint32_t lap, uint32_t ltaddr, uint32_t pktnum)

{

    connection_info_t *cinfo;

    wmem_tree_key_t key[6];

    key[0].length = 1;

    key[0].key = &interface_id;

    key[1].length = 1;

    key[1].key = &adapter_id;

    key[2].length = 1;

    key[2].key = ⪅

    key[3].length = 1;

    key[3].key = &ltaddr;

    key[4].length = 1;

    key[4].key = &pktnum;

    key[5].length = 0;

    key[5].key = NULL;

    cinfo = (connection_info_t *) wmem_tree_lookup32_array_le(connection_info_tree, key);

    if (!cinfo)

        return NULL;

    if (cinfo->interface_id != interface_id || cinfo->adapter_id != adapter_id ||

        extract_lap(cinfo->bd_addr[BDADDR_CENTRAL]) != lap || cinfo->lt_addr != ltaddr)

        return NULL;

    return cinfo;

}

connection_info_t *

btbredr_rf_add_esco_link(connection_info_t *cinfo, packet_info *pinfo, uint8_t handle, uint32_t ltaddr, uint16_t pktszms, uint16_t pktszsm)

{

    connection_info_t *ecinfo;

    uint32_t lap;

    wmem_tree_key_t key[6];

    if (!cinfo || !pinfo || ltaddr >= 8 || !ltaddr)

        return NULL;

    lap = extract_lap(cinfo->bd_addr[BDADDR_CENTRAL]);

    ecinfo = lookup_connection_info(cinfo->interface_id, cinfo->adapter_id, lap, ltaddr, pinfo->num);

    if (ecinfo && (memcmp(cinfo->bd_addr[BDADDR_CENTRAL], ecinfo->bd_addr[BDADDR_CENTRAL], 6) ||

                   memcmp(cinfo->bd_addr[BDADDR_PERIPHERAL], ecinfo->bd_addr[BDADDR_PERIPHERAL], 6) ||

                   !ecinfo->esco || ecinfo->escohandle != handle || ecinfo->escosize[0] != pktszms ||

                   ecinfo->escosize[1] != pktszsm))

        ecinfo = NULL;

    if (ecinfo)

        return ecinfo;

    ecinfo = wmem_new0(wmem_file_scope(), connection_info_t);

    ecinfo->interface_id   = cinfo->interface_id;

    ecinfo->adapter_id     = cinfo->adapter_id;

    ecinfo->lt_addr        = ltaddr;

    ecinfo->timestamp      = cinfo->timestamp;

    ecinfo->btclock        = cinfo->btclock;

    memcpy(ecinfo->bd_addr[BDADDR_CENTRAL], cinfo->bd_addr[BDADDR_CENTRAL], 6);

    memcpy(ecinfo->bd_addr[BDADDR_PERIPHERAL], cinfo->bd_addr[BDADDR_PERIPHERAL], 6);

    ecinfo->escosize[0] = pktszms;

    ecinfo->escosize[1] = pktszsm;

    ecinfo->escohandle = handle;

    ecinfo->esco = 1;

    key[0].length = 1;

    key[0].key = &cinfo->interface_id;

    key[1].length = 1;

    key[1].key = &cinfo->adapter_id;

    key[2].length = 1;

    key[2].key = ⪅

    key[3].length = 1;

    key[3].key = &ltaddr;

    key[4].length = 1;

    key[4].key = &pinfo->num;

    key[5].length = 0;

    key[5].key = NULL;

    wmem_tree_insert32_array(connection_info_tree, key, ecinfo);

    return ecinfo;

}

void

btbredr_rf_remove_esco_link(connection_info_t *cinfo, packet_info *pinfo, uint8_t handle)

{

    connection_info_t *ecinfo;

    uint32_t lap;

    wmem_tree_key_t key[6];

    if (!cinfo || !pinfo)

        return;

    lap = extract_lap(cinfo->bd_addr[BDADDR_CENTRAL]);

    for (uint32_t ltaddr = 1; ltaddr < 8; ++ltaddr) {

        ecinfo = lookup_connection_info(cinfo->interface_id, cinfo->adapter_id, lap, ltaddr, pinfo->num);

        if (!ecinfo)

            continue;

        if (memcmp(cinfo->bd_addr[BDADDR_CENTRAL], ecinfo->bd_addr[BDADDR_CENTRAL], 6) ||

            memcmp(cinfo->bd_addr[BDADDR_PERIPHERAL], ecinfo->bd_addr[BDADDR_PERIPHERAL], 6) ||

            !ecinfo->esco || ecinfo->escohandle != handle)

            continue;

        key[0].length = 1;

        key[0].key = &cinfo->interface_id;

        key[1].length = 1;

        key[1].key = &cinfo->adapter_id;

        key[2].length = 1;

        key[2].key = ⪅

        key[3].length = 1;

        key[3].key = &ltaddr;

        key[4].length = 1;

        key[4].key = &pinfo->num;

        key[5].length = 0;

        key[5].key = NULL;

        wmem_tree_insert32_array(connection_info_tree, key, ecinfo);

    }

}

static int

dissect_btbredr_rf(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data)

{

    proto_item           *btbredr_rf_item;

    proto_tree           *btbredr_rf_tree;

    proto_item           *flags_item;

    proto_tree           *flags_tree;

    proto_item           *header_item = NULL;

    proto_tree           *header_tree;

    proto_item           *reserved_item;

    proto_item           *hec_item = NULL;

    int                   offset = 0;

    int                   hf_x;

    int                   header_mode;

    uint32_t              interface_id;

    uint32_t              adapter_id;

    uint16_t              flags;

    uint32_t              lap;

    uint8_t               uap = 0;

    uint32_t              ltaddr = 0;

    uint8_t               payload_and_transport;

    int16_t               packet_type = PACKET_TYPE_UNKNOWN;

    const char           *packet_type_str = "Unknown";

    dissector_table_t     packet_type_table = NULL;

    bool                  decrypted;

    int                   isochronous_length = 0;

    bool                  isochronous_crc = false;

    bool                  isochronous_esco = false;

    int                   data_length = 0;

    int                   data_header = 0;

    bool                  data_crc = false;

    bool                  arqn = false;

    bool                  seqn = false;

    int                   direction = -1;

    btbredr_frame_info_t *frame_info = NULL;

    connection_info_t    *connection_info = NULL;

    device_info_t        *device_info = NULL;

    bluetooth_data_t     *bluetooth_data = (bluetooth_data_t *) data;

    if (bluetooth_data)

        interface_id = bluetooth_data->interface_id;

    else if (pinfo->rec->presence_flags & WTAP_HAS_INTERFACE_ID)

        interface_id = pinfo->rec->rec_header.packet_header.interface_id;

    else

        interface_id = HCI_INTERFACE_DEFAULT;

    if (bluetooth_data)

        adapter_id = bluetooth_data->adapter_id;

    else

        adapter_id = HCI_ADAPTER_DEFAULT;

    btbredr_rf_item = proto_tree_add_item(tree, proto_btbredr_rf, tvb, offset, -1, ENC_NA);

    btbredr_rf_tree = proto_item_add_subtree(btbredr_rf_item, ett_btbredr_rf);

    col_set_str(pinfo->cinfo, COL_PROTOCOL, "BT BR/EDR RF");

    if (tvb_captured_length(tvb) >= 21) {

        flags = tvb_get_uint16(tvb, 20, ENC_LITTLE_ENDIAN);

    } else {

        flags = 0;

    }

    if (flags & FLAGS_RF_CHANNEL_ALIASING)

        hf_x = hf_uncertain_rf_channel;

    else

        hf_x = hf_rf_channel;

    proto_tree_add_item(btbredr_rf_tree, hf_x, tvb, offset, 1, ENC_NA);

    offset += 1;

    if (flags & FLAGS_SIGNAL_POWER_VALID)

        hf_x = hf_signal_power;

    else

        hf_x = hf_invalid_signal_power;

    proto_tree_add_item(btbredr_rf_tree, hf_x, tvb, offset, 1, ENC_NA);

    offset += 1;

    if (flags & FLAGS_NOISE_POWER_VALID)

        hf_x = hf_noise_power;

    else

        hf_x = hf_invalid_noise_power;

    proto_tree_add_item(btbredr_rf_tree, hf_x, tvb, offset, 1, ENC_NA);

    offset += 1;

    proto_tree_add_item(btbredr_rf_tree, hf_access_address_offenses, tvb, offset, 1, ENC_NA);

    offset += 1;

    payload_and_transport = tvb_get_uint8(tvb, offset);

    col_add_fstr(pinfo->cinfo, COL_INFO, "Transport: %s (%s), RF Channel: %s%2u",

            val_to_str_const(payload_and_transport >> 4, payload_transport_rate_transport_vals, "Unknown"),

            val_to_str_const(payload_and_transport & 0xF, payload_transport_rate_payload_abbrev_vals, "Unknown"),

            (flags & FLAGS_RF_CHANNEL_ALIASING) ? "~" : "",

            tvb_get_uint8(tvb, 0));

    if (payload_and_transport == 0xFF)

        proto_tree_add_item(btbredr_rf_tree, hf_payload_transport_rate_ignored, tvb, offset, 1, ENC_NA);

    else

        proto_tree_add_bitmask(btbredr_rf_tree, tvb, offset, hf_payload_transport_rate, ett_payload_transport_rate, hfx_payload_transport_rate, ENC_LITTLE_ENDIAN);

    offset += 1;

    proto_tree_add_item(btbredr_rf_tree, hf_corrected_header_bits, tvb, offset, 1, ENC_NA);

    offset += 1;

    proto_tree_add_item(btbredr_rf_tree, hf_corrected_payload_bits, tvb, offset, 2, ENC_LITTLE_ENDIAN);

    offset += 2;

    proto_tree_add_item(btbredr_rf_tree, hf_lower_address_part, tvb, offset, 4, ENC_LITTLE_ENDIAN);

    lap = tvb_get_uint32(tvb, offset, ENC_LITTLE_ENDIAN) & 0xffffff;

    offset += 4;

    if (!is_reserved_lap(lap)) {

        wmem_tree_key_t key[4];

        key[0].length = 1;

        key[0].key = &interface_id;

        key[1].length = 1;

        key[1].key = &adapter_id;

        key[2].length = 1;

        key[2].key = ⪅

        key[3].length = 0;

        key[3].key = NULL;

        device_info = (device_info_t *) wmem_tree_lookup32_array(device_info_tree, key);

    }

    if (device_info) {

        direction = (device_info->dir == pinfo->p2p_dir) ? BDADDR_CENTRAL : BDADDR_PERIPHERAL;

        uap = device_info->bd_addr[2];

    }

    if (flags & FLAGS_REFERENCE_LOWER_ADDRESS_PART_VALID)

        hf_x = hf_reference_lower_address_part;

    else

        hf_x = hf_invalid_reference_lower_address_part;

    proto_tree_add_item(btbredr_rf_tree, hf_x, tvb, offset, 3, ENC_LITTLE_ENDIAN);

    offset += 3;

    if (flags & FLAGS_REFERENCE_UPPER_ADDRESS_PART_VALID) {

        hf_x = hf_reference_upper_address_part;

        uap = tvb_get_uint8(tvb, offset);

    } else {

        hf_x = hf_invalid_reference_upper_address_part;

    }

    proto_tree_add_item(btbredr_rf_tree, hf_x, tvb, offset, 1, ENC_NA);

    offset += 1;

    {

        uint32_t hdr = tvb_get_uint32(tvb, offset, ENC_LITTLE_ENDIAN);

        bool have_uap = device_info || !!(flags & FLAGS_REFERENCE_UPPER_ADDRESS_PART_VALID);

        bool is_inquiry = is_reserved_lap(lap);

        bool is_inquiry_fhs = is_inquiry && (((hdr >> 3) & 0x0f) == 2);

        bool is_inquiry_broken_fhs = is_inquiry && (((hdr >> 11) & 0x0f) == 2);

        if (is_inquiry && !(is_inquiry_fhs || is_inquiry_broken_fhs))

            header_mode = -2;

        else if (!(flags & FLAGS_PACKET_HEADER_AND_BR_EDR_PAYLOAD_DEWHITENED))

            header_mode = -1;

        else if ((have_uap || is_inquiry_fhs) && check_hec(is_inquiry_fhs ? 0 : uap, hdr))

            header_mode = 1;

        else if ((have_uap || is_inquiry_broken_fhs) && broken_check_hec(is_inquiry_broken_fhs ? 0 : uap, hdr))

            header_mode = 2;

        else if (!have_uap)

            header_mode = -1;

        else

            header_mode = 0;

    }

    decrypted = !!(flags & FLAGS_BREDR_PAYLOAD_DECRYPTED);

    if (header_mode == -1) {

        proto_tree_add_item(btbredr_rf_tree, hf_whitened_packet_header, tvb, offset, 4, ENC_LITTLE_ENDIAN);

    } else if (header_mode == -2) {

        proto_tree_add_item(btbredr_rf_tree, hf_invalid_packet_header, tvb, offset, 4, ENC_LITTLE_ENDIAN);

    } else if (header_mode == 2) {

        // broken header format

        header_item = proto_tree_add_item(btbredr_rf_tree, hf_packet_header, tvb, offset, 4, ENC_LITTLE_ENDIAN);

        header_tree = proto_item_add_subtree(header_item, ett_bluetooth_header);

        proto_tree_add_item(header_tree, hf_packet_header_reserved, tvb, offset, 4, ENC_LITTLE_ENDIAN);

        proto_tree_add_item(header_tree, hf_packet_header_broken_lt_addr, tvb, offset, 4, ENC_LITTLE_ENDIAN);

        ltaddr = (tvb_get_uint32(tvb, offset, ENC_LITTLE_ENDIAN) >> 15) & 7;

        arqn = (tvb_get_uint32(tvb, offset, ENC_LITTLE_ENDIAN) >> 9) & 1;

        seqn = (tvb_get_uint32(tvb, offset, ENC_LITTLE_ENDIAN) >> 8) & 1;

        if (payload_and_transport == (TRANSPORT_SCO | PAYLOAD_BR)) {

            proto_tree_add_item(header_tree, hf_packet_header_broken_type_sco_br, tvb, offset, 4, ENC_LITTLE_ENDIAN);

            packet_type = (tvb_get_uint8(tvb, offset + 1) >> 3) & 0xF;

            packet_type_str = val_to_str_const(packet_type, packet_type_sco_br_vals, "Unknown");

            packet_type_table = packet_type_sco_br_table;

        } else if (payload_and_transport == (TRANSPORT_eSCO | PAYLOAD_BR)) {

            proto_tree_add_item(header_tree, hf_packet_header_broken_type_esco_br, tvb, offset, 4, ENC_LITTLE_ENDIAN);

            packet_type = (tvb_get_uint8(tvb, offset + 1) >> 3) & 0xF;

            packet_type_str = val_to_str_const(packet_type, packet_type_esco_br_vals, "Unknown");

            packet_type_table = packet_type_esco_br_table;

        } else if (payload_and_transport == (TRANSPORT_eSCO | PAYLOAD_EDR_2) || payload_and_transport == (TRANSPORT_eSCO | PAYLOAD_EDR_3)) {

            proto_tree_add_item(header_tree, hf_packet_header_broken_type_esco_edr, tvb, offset, 4, ENC_LITTLE_ENDIAN);

            packet_type = (tvb_get_uint8(tvb, offset + 1) >> 3) & 0xF;

            packet_type_str = val_to_str_const(packet_type, packet_type_esco_edr_vals, "Unknown");

            packet_type_table = packet_type_esco_edr_table;

        } else if (payload_and_transport == (TRANSPORT_ACL | PAYLOAD_BR)) {

            proto_tree_add_item(header_tree, hf_packet_header_broken_type_acl_br, tvb, offset, 4, ENC_LITTLE_ENDIAN);

            packet_type = (tvb_get_uint8(tvb, offset + 1) >> 3) & 0xF;

            packet_type_str = val_to_str_const(packet_type, packet_type_acl_br_vals, "Unknown");

            packet_type_table = packet_type_acl_br_table;

        } else if (payload_and_transport == (TRANSPORT_ACL | PAYLOAD_EDR_2) || payload_and_transport == (TRANSPORT_ACL | PAYLOAD_EDR_3)) {

            proto_tree_add_item(header_tree, hf_packet_header_broken_type_acl_edr, tvb, offset, 4, ENC_LITTLE_ENDIAN);

            packet_type = (tvb_get_uint8(tvb, offset + 1) >> 3) & 0xF;

            packet_type_str = val_to_str_const(packet_type, packet_type_acl_edr_vals, "Unknown");

            packet_type_table = packet_type_acl_edr_table;

        } else if (payload_and_transport == (TRANSPORT_CPB | PAYLOAD_BR)) {

            proto_tree_add_item(header_tree, hf_packet_header_broken_type_cpb_br, tvb, offset, 4, ENC_LITTLE_ENDIAN);

            packet_type = (tvb_get_uint8(tvb, offset + 1) >> 3) & 0xF;

            packet_type_str = val_to_str_const(packet_type, packet_type_cpb_br_vals, "Unknown");

            packet_type_table = packet_type_cpb_br_table;

        } else if (payload_and_transport == (TRANSPORT_CPB | PAYLOAD_EDR_2) || payload_and_transport == (TRANSPORT_ACL | PAYLOAD_EDR_3)) {

            proto_tree_add_item(header_tree, hf_packet_header_broken_type_cpb_edr, tvb, offset, 4, ENC_LITTLE_ENDIAN);

            packet_type = (tvb_get_uint8(tvb, offset + 1) >> 3) & 0xF;

            packet_type_str = val_to_str_const(packet_type, packet_type_cpb_edr_vals, "Unknown");

            packet_type_table = packet_type_cpb_edr_table;

        } else if ((payload_and_transport >> 4) == TRANSPORT_ANY) {

            proto_tree_add_item(header_tree, hf_packet_header_broken_type_any, tvb, offset, 4, ENC_LITTLE_ENDIAN);

            packet_type = (tvb_get_uint8(tvb, offset + 1) >> 3) & 0xF;

            packet_type_str = val_to_str_const(packet_type, packet_type_any_vals, "Unknown");

        } else {

            proto_tree_add_item(header_tree, hf_packet_header_broken_type, tvb, offset, 4, ENC_LITTLE_ENDIAN);

        }

        proto_tree_add_item(header_tree, hf_packet_header_broken_flow_control, tvb, offset, 4, ENC_LITTLE_ENDIAN);

        proto_tree_add_item(header_tree, hf_packet_header_broken_acknowledge_indication, tvb, offset, 4, ENC_LITTLE_ENDIAN);

        proto_tree_add_item(header_tree, hf_packet_header_broken_sequence_number, tvb, offset, 4, ENC_LITTLE_ENDIAN);

        hec_item = proto_tree_add_item(header_tree, hf_packet_header_broken_header_error_check, tvb, offset, 4, ENC_LITTLE_ENDIAN);

    } else if (header_mode >= 0) {

        // header format according to Core_v5.2.pdf Vol 2 Part B Chapter 6.4

        header_item = proto_tree_add_item(btbredr_rf_tree, hf_packet_header, tvb, offset, 4, ENC_LITTLE_ENDIAN);

        header_tree = proto_item_add_subtree(header_item, ett_bluetooth_header);

        proto_tree_add_item(header_tree, hf_packet_header_lt_addr, tvb, offset, 4, ENC_LITTLE_ENDIAN);

        ltaddr = tvb_get_uint32(tvb, offset, ENC_LITTLE_ENDIAN) & 7;

        arqn = (tvb_get_uint32(tvb, offset, ENC_LITTLE_ENDIAN) >> 8) & 1;

        seqn = (tvb_get_uint32(tvb, offset, ENC_LITTLE_ENDIAN) >> 9) & 1;

        if (payload_and_transport == (TRANSPORT_SCO | PAYLOAD_BR)) {

            proto_tree_add_item(header_tree, hf_packet_header_type_sco_br, tvb, offset, 4, ENC_LITTLE_ENDIAN);

            packet_type = (tvb_get_uint8(tvb, offset) >> 3) & 0xF;

            packet_type_str = val_to_str_const(packet_type, packet_type_sco_br_vals, "Unknown");

            packet_type_table = packet_type_sco_br_table;

        } else if (payload_and_transport == (TRANSPORT_eSCO | PAYLOAD_BR)) {

            proto_tree_add_item(header_tree, hf_packet_header_type_esco_br, tvb, offset, 4, ENC_LITTLE_ENDIAN);

            packet_type = (tvb_get_uint8(tvb, offset) >> 3) & 0xF;

            packet_type_str = val_to_str_const(packet_type, packet_type_esco_br_vals, "Unknown");

            packet_type_table = packet_type_esco_br_table;

        } else if (payload_and_transport == (TRANSPORT_eSCO | PAYLOAD_EDR_2) || payload_and_transport == (TRANSPORT_eSCO | PAYLOAD_EDR_3)) {

            proto_tree_add_item(header_tree, hf_packet_header_type_esco_edr, tvb, offset, 4, ENC_LITTLE_ENDIAN);

            packet_type = (tvb_get_uint8(tvb, offset) >> 3) & 0xF;

            packet_type_str = val_to_str_const(packet_type, packet_type_esco_edr_vals, "Unknown");

            packet_type_table = packet_type_esco_edr_table;

        } else if (payload_and_transport == (TRANSPORT_ACL | PAYLOAD_BR)) {

            proto_tree_add_item(header_tree, hf_packet_header_type_acl_br, tvb, offset, 4, ENC_LITTLE_ENDIAN);

            packet_type = (tvb_get_uint8(tvb, offset) >> 3) & 0xF;

            packet_type_str = val_to_str_const(packet_type, packet_type_acl_br_vals, "Unknown");

            packet_type_table = packet_type_acl_br_table;

        } else if (payload_and_transport == (TRANSPORT_ACL | PAYLOAD_EDR_2) || payload_and_transport == (TRANSPORT_ACL | PAYLOAD_EDR_3)) {

            proto_tree_add_item(header_tree, hf_packet_header_type_acl_edr, tvb, offset, 4, ENC_LITTLE_ENDIAN);

            packet_type = (tvb_get_uint8(tvb, offset) >> 3) & 0xF;

            packet_type_str = val_to_str_const(packet_type, packet_type_acl_edr_vals, "Unknown");

            packet_type_table = packet_type_acl_edr_table;

        } else if (payload_and_transport == (TRANSPORT_CPB | PAYLOAD_BR)) {

            proto_tree_add_item(header_tree, hf_packet_header_type_cpb_br, tvb, offset, 4, ENC_LITTLE_ENDIAN);

            packet_type = (tvb_get_uint8(tvb, offset) >> 3) & 0xF;

            packet_type_str = val_to_str_const(packet_type, packet_type_cpb_br_vals, "Unknown");

            packet_type_table = packet_type_cpb_br_table;

        } else if (payload_and_transport == (TRANSPORT_CPB | PAYLOAD_EDR_2) || payload_and_transport == (TRANSPORT_ACL | PAYLOAD_EDR_3)) {

            proto_tree_add_item(header_tree, hf_packet_header_type_cpb_edr, tvb, offset, 4, ENC_LITTLE_ENDIAN);

            packet_type = (tvb_get_uint8(tvb, offset) >> 3) & 0xF;

            packet_type_str = val_to_str_const(packet_type, packet_type_cpb_edr_vals, "Unknown");

            packet_type_table = packet_type_cpb_edr_table;

        } else if ((payload_and_transport >> 4) == TRANSPORT_ANY) {

            proto_tree_add_item(header_tree, hf_packet_header_type_any, tvb, offset, 4, ENC_LITTLE_ENDIAN);

            packet_type = (tvb_get_uint8(tvb, offset) >> 3) & 0xF;

            packet_type_str = val_to_str_const(packet_type, packet_type_any_vals, "Unknown");

        } else {

            proto_tree_add_item(header_tree, hf_packet_header_type, tvb, offset, 4, ENC_LITTLE_ENDIAN);

        }

        proto_tree_add_item(header_tree, hf_packet_header_flow_control, tvb, offset, 4, ENC_LITTLE_ENDIAN);

        proto_tree_add_item(header_tree, hf_packet_header_acknowledge_indication, tvb, offset, 4, ENC_LITTLE_ENDIAN);

        proto_tree_add_item(header_tree, hf_packet_header_sequence_number, tvb, offset, 4, ENC_LITTLE_ENDIAN);

        hec_item = proto_tree_add_item(header_tree, hf_packet_header_header_error_check, tvb, offset, 4, ENC_LITTLE_ENDIAN);

        proto_tree_add_item(header_tree, hf_packet_header_reserved, tvb, offset, 4, ENC_LITTLE_ENDIAN);

    }

    switch (header_mode) {

    case -2:

        col_set_str(pinfo->cinfo, COL_INFO, (lap == 0x9e8b33) ? "GIAC" : "DIAC");

        break;

    case -1:

        expert_add_info(pinfo, hec_item, &ei_packet_header_with_hec_not_checked);

        break;

    case 0:

        expert_add_info(pinfo, hec_item, &ei_incorrect_packet_header_or_hec);

        break;

    case 2:

        expert_add_info(pinfo, header_item, &ei_broken_packet_header_format);

        break;

    default:

        break;

    }

    if (header_mode > 0 && ltaddr)

        connection_info = lookup_connection_info(interface_id, adapter_id, lap, ltaddr, pinfo->num);

    if (connection_info && direction >= 0) {

        set_address(&pinfo->dl_src, AT_ETHER, sizeof(connection_info->bd_addr[0]), connection_info->bd_addr[direction]);

        set_address(&pinfo->dl_dst, AT_ETHER, sizeof(connection_info->bd_addr[0]), connection_info->bd_addr[1 - direction]);

        set_address(&pinfo->net_src, AT_ETHER, sizeof(connection_info->bd_addr[0]), connection_info->bd_addr[direction]);

        set_address(&pinfo->net_dst, AT_ETHER, sizeof(connection_info->bd_addr[0]), connection_info->bd_addr[1 - direction]);

    } else {

        clear_address(&pinfo->dl_dst);

        clear_address(&pinfo->net_dst);

        if (header_mode > 0 && !ltaddr && device_info) {

            set_address(&pinfo->dl_src, AT_ETHER, sizeof(device_info->bd_addr), device_info->bd_addr);

            set_address(&pinfo->net_src, AT_ETHER, sizeof(device_info->bd_addr), device_info->bd_addr);

        } else {

            clear_address(&pinfo->dl_src);

            clear_address(&pinfo->net_src);

        }

    }

    copy_address_shallow(&pinfo->src, &pinfo->net_src);

    copy_address_shallow(&pinfo->dst, &pinfo->net_dst);

    offset += 4;

    flags_item = proto_tree_add_item(btbredr_rf_tree, hf_flags, tvb, offset, 2, ENC_LITTLE_ENDIAN);

    flags_tree = proto_item_add_subtree(flags_item, ett_flags);