/* packet-btl2cap.c

 * Routines for the Bluetooth L2CAP dissection

 * Copyright 2002, Christoph Scholz <scholz@cs.uni-bonn.de>

 *  From: http://affix.sourceforge.net/archive/ethereal_affix-3.patch

 *

 * Refactored for wireshark checkin

 *   Ronnie Sahlberg 2006

 *

 * Added handling and reassembly of LE-Frames

 *   Anders Broman at ericsson dot com 2016

 *

 * Wireshark - Network traffic analyzer

 * By Gerald Combs <gerald@wireshark.org>

 * Copyright 1998 Gerald Combs

 *

 * SPDX-License-Identifier: GPL-2.0-or-later

 */

#include "config.h"

#include <epan/packet.h>

#include <epan/crc16-tvb.h>

#include <epan/exceptions.h>

#include <epan/expert.h>

#include <epan/decode_as.h>

#include <epan/proto_data.h>

#include <epan/reassemble.h>

#include <epan/unit_strings.h>

#include <wiretap/wtap.h>

#include "packet-bluetooth.h"

#include "packet-bthci_acl.h"

#include "packet-btsdp.h"

#include "packet-btl2cap.h"

/* Initialize the protocol and registered fields */

int proto_btl2cap;

static int hf_btl2cap_length;

static int hf_btl2cap_cid;

static int hf_btl2cap_payload;

static int hf_btl2cap_command;

static int hf_btl2cap_cmd_code;

static int hf_btl2cap_cmd_ident;

static int hf_btl2cap_cmd_length;

static int hf_btl2cap_cmd_data;

static int hf_btl2cap_psm;

static int hf_btl2cap_psm_dynamic;

static int hf_btl2cap_scid;

static int hf_btl2cap_dcid;

static int hf_btl2cap_icid;

static int hf_btl2cap_controller;

static int hf_btl2cap_dcontroller;

static int hf_btl2cap_result;

static int hf_btl2cap_move_result;

static int hf_btl2cap_move_confirmation_result;

static int hf_btl2cap_status;

static int hf_btl2cap_rej_reason;

static int hf_btl2cap_sig_mtu;

static int hf_btl2cap_info_mtu;

static int hf_btl2cap_info_flowcontrol;

static int hf_btl2cap_info_retransmission;

static int hf_btl2cap_info_bidirqos;

static int hf_btl2cap_info_enh_retransmission;

static int hf_btl2cap_info_streaming;

static int hf_btl2cap_info_fcs;

static int hf_btl2cap_info_flow_spec;

static int hf_btl2cap_info_fixedchan;

static int hf_btl2cap_info_fixedchans;

static int hf_btl2cap_info_fixedchans_null;

static int hf_btl2cap_info_fixedchans_signal;

static int hf_btl2cap_info_fixedchans_connless;

static int hf_btl2cap_info_fixedchans_amp_man;

static int hf_btl2cap_info_fixedchans_rfu;

static int hf_btl2cap_info_fixedchans_smp;

static int hf_btl2cap_info_fixedchans_amp_test;

static int hf_btl2cap_info_window;

static int hf_btl2cap_info_unicast;

static int hf_btl2cap_info_type;

static int hf_btl2cap_info_result;

static int hf_btl2cap_configuration_result;

static int hf_btl2cap_info_extfeatures;

static int hf_btl2cap_option;

static int hf_btl2cap_option_type;

static int hf_btl2cap_option_length;

static int hf_btl2cap_option_mtu;

static int hf_btl2cap_option_flushTO;

static int hf_btl2cap_option_flush_to_us;

static int hf_btl2cap_option_flags;

static int hf_btl2cap_option_service_type;

static int hf_btl2cap_option_tokenrate;

static int hf_btl2cap_option_tokenbucketsize;

static int hf_btl2cap_option_peakbandwidth;

static int hf_btl2cap_option_latency;

static int hf_btl2cap_option_delayvariation;

static int hf_btl2cap_option_retransmissionmode;

static int hf_btl2cap_option_txwindow;

static int hf_btl2cap_option_maxtransmit;

static int hf_btl2cap_option_retransmittimeout;

static int hf_btl2cap_option_monitortimeout;

static int hf_btl2cap_option_mps;

static int hf_btl2cap_option_fcs;

static int hf_btl2cap_option_window;

static int hf_btl2cap_option_identifier;

static int hf_btl2cap_option_sdu_size;

static int hf_btl2cap_option_sdu_arrival_time;

static int hf_btl2cap_option_access_latency;

static int hf_btl2cap_control_field;

static int hf_btl2cap_ext_control_field;

static int hf_btl2cap_control_sar;

static int hf_btl2cap_ext_control_sar;

static int hf_btl2cap_control_reqseq;

static int hf_btl2cap_ext_control_reqseq;

static int hf_btl2cap_control_txseq;

static int hf_btl2cap_ext_control_txseq;

static int hf_btl2cap_control_retransmissiondisable;

static int hf_btl2cap_control_poll;

static int hf_btl2cap_ext_control_poll;

static int hf_btl2cap_control_final;

static int hf_btl2cap_ext_control_final;

static int hf_btl2cap_control_supervisory;

static int hf_btl2cap_ext_control_supervisory;

static int hf_btl2cap_control_type;

static int hf_btl2cap_ext_control_type;

static int hf_btl2cap_fcs;

static int hf_btl2cap_fcs_status;

static int hf_btl2cap_sdulength;

static int hf_btl2cap_continuation_to;

static int hf_btl2cap_reassembled_in;

static int hf_btl2cap_min_interval;

static int hf_btl2cap_max_interval;

static int hf_btl2cap_peripheral_latency;

static int hf_btl2cap_timeout_multiplier;

static int hf_btl2cap_conn_param_result;

static int hf_btl2cap_credits;

static int hf_btl2cap_initial_credits;

static int hf_btl2cap_le_result;

static int hf_btl2cap_le_psm;

static int hf_btl2cap_flags_reserved;

static int hf_btl2cap_flags_continuation;

static int hf_btl2cap_data;

static int hf_btl2cap_service;

static int hf_btl2cap_connect_in_frame;

static int hf_btl2cap_disconnect_in_frame;

static int hf_btl2cap_le_sdu_fragments;

static int hf_btl2cap_le_sdu_fragment;

static int hf_btl2cap_le_sdu_fragment_overlap;

static int hf_btl2cap_le_sdu_fragment_overlap_conflicts;

static int hf_btl2cap_le_sdu_fragment_multiple_tails;

static int hf_btl2cap_le_sdu_fragment_too_long_fragment;

static int hf_btl2cap_le_sdu_fragment_error;

static int hf_btl2cap_le_sdu_fragment_count;

static int hf_btl2cap_le_sdu_reassembled_in;

static int hf_btl2cap_le_sdu_reassembled_length;

static int hf_btl2cap_le_sdu_length;

/* Initialize the subtree pointers */

static int ett_btl2cap;

static int ett_btl2cap_cmd;

static int ett_btl2cap_option;

static int ett_btl2cap_extfeatures;

static int ett_btl2cap_fixedchans;

static int ett_btl2cap_control;

static int ett_btl2cap_le_sdu_fragment;

static int ett_btl2cap_le_sdu_fragments;

static expert_field ei_btl2cap_parameter_mismatch;

static expert_field ei_btl2cap_sdulength_bad;

static expert_field ei_btl2cap_length_bad;

static expert_field ei_btl2cap_fcs_bad;

static expert_field ei_btl2cap_unknown_command_code;

/* Initialize dissector table */

static dissector_table_t l2cap_psm_dissector_table;

static dissector_table_t l2cap_cid_dissector_table;

/* This table maps command identity values to psm values. */

static wmem_tree_t *cmd_ident_to_psm_table;

/* This table maps cid values to psm values.

 * The same table is used both for SCID and DCID.

 * For Remote CIDs (Receive Request SCID or Sent Response DCID)

 * we 'or' the CID with 0x80000000 in this table

 */

static wmem_tree_t *cid_to_psm_table;

/* 5.4 RETRANSMISSION AND FLOW CONTROL OPTION

 * Table 5.2

 * Mode

 * 0x00 L2CAP Basic Mode

 * 0x01 Retransmission mode

 * 0x02 Flow control mode

 * 0x03 Enhanced Retransmission mode

 * 0x04 Streaming mode

 * Other values Reserved for future use

 */

#define L2CAP_BASIC_MODE                      0

#define L2CAP_RETRANSMISSION_MODE             1

#define L2CAP_FLOW_CONTROL_MODE               2

#define L2CAP_ENHANCED_RETRANSMISSION_MODE    3

#define L2CAP_STREAMING_MODE                  4

/* XXX Cheat and define a vaue for

 * Connection-Oriented Channels in LE Credit Based Flow Control Mode

 */

#define L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE 0xff

enum l2cap_ctl_field_format {

    L2CAP_IFRAME_CONTROL_FIELD_STANDARD,

    L2CAP_IFRAME_CONTROL_FIELD_ENHANCED,

    L2CAP_IFRAME_CONTROL_FIELD_EXTENDED,

};

typedef struct _config_data_t {

    uint8_t     mode;

    uint8_t     txwindow;

    /* Extended Window Size option */

    uint16_t    maxwindowsize;

    wmem_tree_t *start_fragments;  /* indexed by pinfo->num */

    /* Used for LE frame reassembly */

    unsigned segmentation_started : 1;  /* 0 = No, 1 = Yes */

    unsigned segment_len_rem;          /* The remaining segment length, used to find last segment */

} config_data_t;

typedef struct _sdu_reassembly_t

{

    uint8_t *reassembled;

    uint8_t  seq;

    uint32_t first_frame;

    uint32_t last_frame;

    uint16_t tot_len;

    int      cur_off;           /* counter used by reassembly */

} sdu_reassembly_t;

typedef struct _psm_data_t {

    uint32_t      interface_id;

    uint32_t      adapter_id;

    uint32_t      chandle;

    uint32_t      local_cid;

    uint32_t      remote_cid;

    uint16_t      psm;

    bool          local_service;

    uint32_t      connect_in_frame;

    uint32_t      disconnect_in_frame;

    config_data_t in;

    config_data_t out;

} psm_data_t;

typedef struct _btl2cap_frame_data_t

{

    /* LE frames info */

    unsigned first_fragment : 1; /* 0 = No, 1 = First or only fragment*/

    unsigned more_fragments : 1; /* 0 = Last fragment, 1 = more fragments*/

} btl2cap_frame_data_t;

static const value_string command_code_vals[] = {

    { 0x01,   "Command Reject" },

    { 0x02,   "Connection Request" },

    { 0x03,   "Connection Response" },

    { 0x04,   "Configure Request" },

    { 0x05,   "Configure Response" },

    { 0x06,   "Disconnection Request" },

    { 0x07,   "Disconnection Response" },

    { 0x08,   "Echo Request" },

    { 0x09,   "Echo Response" },

    { 0x0A,   "Information Request" },

    { 0x0B,   "Information Response" },

    { 0x0C,   "Create Channel Request" },

    { 0x0D,   "Create Channel Response" },

    { 0x0E,   "Move Channel Request" },

    { 0x0F,   "Move Channel Response" },

    { 0x10,   "Move Channel Confirmation" },

    { 0x11,   "Move Channel Confirmation Response" },

    { 0x12,   "Connection Parameter Update Request" },

    { 0x13,   "Connection Parameter Update Response" },

    { 0x14,   "LE Credit Based Connection Request" },

    { 0x15,   "LE Credit Based Connection Response" },

    { 0x16,   "LE Flow Control Credit" },

    { 0x17,   "L2CAP Credit Based Connection Request" },

    { 0x18,   "L2CAP Credit Based Connection Response" },

    { 0x19,   "L2CAP Credit Based Reconfigure Request" },

    { 0x1A,   "L2CAP Credit Based Reconfigure Response" },

    { 0, NULL }

};

static const value_string psm_vals[] = {

    { 0x0001, "SDP" },

    { 0x0003, "RFCOMM" },

    { 0x0005, "TCS-BIN" },

    { 0x0007, "TCS-BIN-CORDLESS" },

    { 0x000F, "BNEP" },

    { 0x0011, "HID-Control" },

    { 0x0013, "HID-Interrupt" },

    { 0x0015, "UPnP" },

    { 0x0017, "AVCTP-Control" },

    { 0x0019, "AVDTP" },

    { 0x001B, "AVCTP-Browsing" },

    { 0x001D, "UDI_C-Plane" },

    { 0x001F, "ATT" },

    { 0x0021, "3DSP" },

    { 0x0023, "IPSP" },

    { 0x0025, "OTS" },

    { 0x0027, "EATT" },

    { 0, NULL }

};

value_string_ext ext_psm_vals = VALUE_STRING_EXT_INIT(psm_vals);

static const value_string result_vals[] = {

    { 0x0000, "Successful" },

    { 0x0001, "Pending" },

    { 0x0002, "Refused - PSM not supported" },

    { 0x0003, "Refused - security block" },

    { 0x0004, "Refused - no resources available" },

    { 0x0005, "Refused - Controller ID not supported" },

    { 0, NULL }

};

static const value_string le_result_vals[] = {

    { 0x0000, "Connection Successful" },

    { 0x0002, "Connection Refused - LE_PSM Not Supported" },

    { 0x0004, "Connection Refused - No Resources Available" },

    { 0x0005, "Connection Refused - Insufficient Authentication" },

    { 0x0006, "Connection Refused - Insufficient Authorization" },

    { 0x0007, "Connection Refused - Insufficient Encryption Key Size" },

    { 0x0008, "Connection Refused - Insufficient Encryption" },

    { 0, NULL }

};

static const value_string move_result_vals[] = {

    { 0x0000, "Success" },

    { 0x0001, "Pending" },

    { 0x0002, "Refused - Controller ID not supported" },

    { 0x0003, "Refused - New Controller ID is same as old" },

    { 0x0004, "Refused - Configuration not supported" },

    { 0x0005, "Refused - Move Channel collision" },

    { 0x0006, "Refused - Channel not allowed to be moved" },

    { 0, NULL }

};

static const value_string move_result_confirmation_vals[] = {

    { 0x0000,   "Success - both sides succeed" },

    { 0x0001,   "Failure - one or both sides refuse" },

    { 0, NULL }

};

static const value_string configuration_result_vals[] = {

    { 0x0000, "Success"},

    { 0x0001, "Failure - unacceptable parameters" },

    { 0x0002, "Failure - reject (no reason provided)" },

    { 0x0003, "Failure - unknown options" },

    { 0x0004, "Pending" },

    { 0x0005, "Failure - flow spec rejected" },

    { 0, NULL }

};

static const value_string conn_param_result_vals[] = {

    { 0x0000,   "Accepted" },

    { 0x0001,   "Rejected" },

    { 0, NULL }

};

static const value_string status_vals[] = {

    { 0x0000, "No further information available" },

    { 0x0001, "Authentication pending" },

    { 0x0002, "Authorization pending" },

    { 0, NULL }

};

static const value_string reason_vals[] = {

    { 0x0000, "Command not understood" },

    { 0x0001, "Signaling MTU exceeded" },

    { 0x0002, "Invalid CID in request" },

    { 0, NULL }

};

static const value_string info_type_vals[] = {

    { 0x0001, "Connectionless MTU" },

    { 0x0002, "Extended Features Mask" },

    { 0x0003, "Fixed Channels Supported" },

    { 0, NULL }

};

static const value_string info_result_vals[] = {

    { 0x0000, "Success" },

    { 0x0001, "Not Supported" },

    { 0, NULL }

};

static const value_string option_servicetype_vals[] = {

    { 0x00,   "No traffic" },

    { 0x01,   "Best effort (Default)" },

    { 0x02,   "Guaranteed" },

    { 0, NULL }

};

static const value_string option_type_vals[] = {

    { 0x01,   "Maximum Transmission Unit" },

    { 0x02,   "Flush Timeout" },

    { 0x03,   "Quality of Service" },

    { 0x04,   "Retransmission and Flow Control" },

    { 0x05,   "FCS" },

    { 0x06,   "Extended Flow Specification" },

    { 0x07,   "Extended Window Size" },

    { 0, NULL }

};

static const value_string option_retransmissionmode_vals[] = {

    { 0x00,   "Basic Mode" },

    { 0x01,   "Retransmission Mode" },

    { 0x02,   "Flow Control Mode" },

    { 0x03,   "Enhanced Retransmission Mode" },

    { 0x04,   "Streaming Mode" },

    { 0, NULL }

};

static const value_string control_sar_vals[] = {

    { 0x00,   "Unsegmented" },

    { 0x01,   "Start" },

    { 0x02,   "End" },

    { 0x03,   "Continuation" },

    { 0, NULL }

};

static const value_string control_supervisory_vals[] = {

    { 0x00,   "RR" },

    { 0x01,   "REJ" },

    { 0x02,   "RNR" },

    { 0x03,   "SREJ" },

    { 0, NULL }

};

static const value_string control_type_vals[] = {

    { 0x00,   "I-Frame" },

    { 0x01,   "S-Frame" },

    { 0, NULL }

};

static const value_string option_fcs_vals[] = {

    { 0x00,   "No FCS" },

    { 0x01,   "16-bit FCS" },

    { 0, NULL }

};

static const value_string ctrl_id_code_vals[] = {

    { 0x00,   "Bluetooth BR/EDR" },

    { 0x01,   "Wifi 802.11" },

    { 0, NULL }

};

static const range_string cid_rvals[] = {

    { 0x0000, 0x0000,  "Null identifier" },

    { 0x0001, 0x0001,  "L2CAP Signaling Channel" },

    { 0x0002, 0x0002,  "Connectionless Channel" },

    { 0x0003, 0x0003,  "AMP Manager Protocol" },

    { 0x0004, 0x0004,  "Attribute Protocol" },

    { 0x0005, 0x0005,  "L2CAP LE Signaling Channel" },

    { 0x0006, 0x0006,  "Security Manager Protocol" },

    { 0x0007, 0x0007,  "BR/EDR Security Manager Protocol" },

    { 0x0008, 0x003E,  "Reserved" },

    { 0x003F, 0x003F,  "AMP Test Manager" },

    { 0x0040, 0xFFFF,  "Dynamically Allocated" },

    { 0, 0, NULL }

};

static const range_string le_psm_rvals[] = {

    { 0x0001, 0x007F,  "Fixed, SIG Assigned" },

    { 0x0080, 0x00FF,  "Dynamically Allocated" },

    { 0x0100, 0xFFFF,  "Reserved" },

    { 0, 0, NULL }

};

static const unit_name_string units_ll_connection_event = { " LL Connection Event", " LL Connection Events" };

#define PROTO_DATA_BTL2CAP_CID        0

#define PROTO_DATA_BTL2CAP_PSM        1

void proto_register_btl2cap(void);

void proto_reg_handoff_btl2cap(void);

/* Reassembly */

static reassembly_table btl2cap_le_sdu_reassembly_table;

static const fragment_items btl2cap_le_sdu_frag_items = {

    /* Fragment subtrees */

    &ett_btl2cap_le_sdu_fragment,

    &ett_btl2cap_le_sdu_fragments,

    /* Fragment fields */

    &hf_btl2cap_le_sdu_fragments,

    &hf_btl2cap_le_sdu_fragment,

    &hf_btl2cap_le_sdu_fragment_overlap,

    &hf_btl2cap_le_sdu_fragment_overlap_conflicts,

    &hf_btl2cap_le_sdu_fragment_multiple_tails,

    &hf_btl2cap_le_sdu_fragment_too_long_fragment,

    &hf_btl2cap_le_sdu_fragment_error,

    &hf_btl2cap_le_sdu_fragment_count,

    /* Reassembled in field */

    &hf_btl2cap_le_sdu_reassembled_in,

    /* Reassembled length field */

    &hf_btl2cap_le_sdu_reassembled_length,

    /* Reassembled data field */

    NULL,

    /* Tag */

    "BTL2CAP LE SDU fragments"

};

static void btl2cap_cid_prompt(packet_info *pinfo, char* result)

{

    uint16_t *value_data;

    value_data = (uint16_t *) p_get_proto_data(pinfo->pool, pinfo, proto_btl2cap, PROTO_DATA_BTL2CAP_CID);

    if (value_data)

        snprintf(result, MAX_DECODE_AS_PROMPT_LEN, "L2CAP CID 0x%04x as", (unsigned) *value_data);

    else

        snprintf(result, MAX_DECODE_AS_PROMPT_LEN, "Unknown L2CAP CID");

}

static void *btl2cap_cid_value(packet_info *pinfo)

{

    uint16_t *value_data;

    value_data = (uint16_t *) p_get_proto_data(pinfo->pool, pinfo, proto_btl2cap, PROTO_DATA_BTL2CAP_CID);

    if (value_data)

        return GUINT_TO_POINTER((unsigned long)*value_data);

    return NULL;

}

static void btl2cap_psm_prompt(packet_info *pinfo, char* result)

{

    uint16_t *value_data;

    value_data = (uint16_t *) p_get_proto_data(pinfo->pool, pinfo, proto_btl2cap, PROTO_DATA_BTL2CAP_PSM);

    if (value_data)

        snprintf(result, MAX_DECODE_AS_PROMPT_LEN, "L2CAP PSM 0x%04x as", (unsigned) *value_data);

    else

        snprintf(result, MAX_DECODE_AS_PROMPT_LEN, "Unknown L2CAP PSM");

}

static void *btl2cap_psm_value(packet_info *pinfo)

{

    uint16_t *value_data;

    value_data = (uint16_t *) p_get_proto_data(pinfo->pool, pinfo, proto_btl2cap, PROTO_DATA_BTL2CAP_PSM);

    if (value_data)

        return GUINT_TO_POINTER((unsigned long)*value_data);

    return NULL;

}

static uint16_t

get_service_uuid(packet_info *pinfo, btl2cap_data_t *l2cap_data, uint16_t psm, bool is_local_psm)

{

    wmem_tree_key_t    key[10];

    uint32_t           k_interface_id;

    uint32_t           k_adapter_id;

    uint32_t           k_sdp_psm;

    uint32_t           k_direction;

    uint32_t           k_bd_addr_oui;

    uint32_t           k_bd_addr_id;

    uint32_t           k_service_type;

    uint32_t           k_service_channel;

    uint32_t           k_frame_number;

    uint32_t           interface_id;

    uint32_t           adapter_id;

    uint32_t           remote_bd_addr_oui;

    uint32_t           remote_bd_addr_id;

    service_info_t    *service_info;

    interface_id       = l2cap_data->interface_id;

    adapter_id         = l2cap_data->adapter_id;

    k_interface_id    = interface_id;

    k_adapter_id      = adapter_id;

    k_sdp_psm         = SDP_PSM_DEFAULT;

    k_direction       = (is_local_psm) ? P2P_DIR_SENT : P2P_DIR_RECV;

    if (k_direction == P2P_DIR_RECV) {

        k_bd_addr_oui = l2cap_data->remote_bd_addr_oui;

        k_bd_addr_id  = l2cap_data->remote_bd_addr_id;

    } else {

        k_bd_addr_oui = 0;

        k_bd_addr_id  = 0;

    }

    remote_bd_addr_oui = k_bd_addr_oui;

    remote_bd_addr_id  = k_bd_addr_id;

    k_service_type    = BTSDP_L2CAP_PROTOCOL_UUID;

    k_service_channel = psm;

    k_frame_number    = pinfo->num;

    key[0].length = 1;

    key[0].key = &k_interface_id;

    key[1].length = 1;

    key[1].key = &k_adapter_id;

    key[2].length = 1;

    key[2].key = &k_sdp_psm;

    key[3].length = 1;

    key[3].key = &k_direction;

    key[4].length = 1;

    key[4].key = &k_bd_addr_oui;

    key[5].length = 1;

    key[5].key = &k_bd_addr_id;

    key[6].length = 1;

    key[6].key = &k_service_type;

    key[7].length = 1;

    key[7].key = &k_service_channel;

    key[8].length = 1;

    key[8].key = &k_frame_number;

    key[9].length = 0;

    key[9].key = NULL;

    service_info = btsdp_get_service_info(key);

    if (service_info &&

        service_info->interface_id == interface_id &&

        service_info->adapter_id == adapter_id &&

        service_info->sdp_psm == SDP_PSM_DEFAULT &&

        ((service_info->direction == P2P_DIR_RECV &&

          service_info->bd_addr_oui == remote_bd_addr_oui &&

          service_info->bd_addr_id == remote_bd_addr_id) ||

         (service_info->direction != P2P_DIR_RECV &&

          service_info->bd_addr_oui == 0 &&

          service_info->bd_addr_id == 0)) &&

        service_info->type == BTSDP_L2CAP_PROTOCOL_UUID &&

        service_info->channel == psm)

    {

        return service_info->uuid.bt_uuid;

    }

    return 0;

}

static int

dissect_comrej(tvbuff_t *tvb, int offset, packet_info *pinfo _U_, proto_tree *tree)

{

    uint16_t reason;

    reason  = tvb_get_letohs(tvb, offset);

    proto_tree_add_item(tree, hf_btl2cap_rej_reason, tvb, offset, 2, ENC_LITTLE_ENDIAN);

    offset += 2;

    switch (reason) {

    case 0x0000: /* Command not understood */

        break;

    case 0x0001: /* Signaling MTU exceeded */

        proto_tree_add_item(tree, hf_btl2cap_sig_mtu, tvb, offset, 2, ENC_LITTLE_ENDIAN);

        offset += 2;

        break;

    case 0x0002: /* Invalid CID in requests */

        proto_tree_add_item(tree, hf_btl2cap_scid, tvb, offset, 2, ENC_LITTLE_ENDIAN);

        offset += 2;

        proto_tree_add_item(tree, hf_btl2cap_dcid, tvb, offset, 2, ENC_LITTLE_ENDIAN);

        offset += 2;

        break;

    default:

        break;

    }

    return offset;

}

static int

dissect_connrequest(tvbuff_t *tvb, int offset, packet_info *pinfo,

        proto_tree *tree, proto_tree *command_tree, bool is_ch_request,

        bthci_acl_data_t *acl_data, btl2cap_data_t *l2cap_data)

{

    uint16_t           scid;

    uint16_t           psm;

    const char        *psm_str = "<NONE>";

    psm = tvb_get_letohs(tvb, offset);

    if (p_get_proto_data(pinfo->pool, pinfo, proto_btl2cap, PROTO_DATA_BTL2CAP_PSM ) == NULL) {

        uint16_t *value_data;

        value_data = wmem_new(wmem_file_scope(), uint16_t);

        *value_data = psm;

        p_add_proto_data(pinfo->pool, pinfo, proto_btl2cap, PROTO_DATA_BTL2CAP_PSM, value_data);

    }

    if (psm < BTL2CAP_DYNAMIC_PSM_START) {

        proto_tree_add_item(command_tree, hf_btl2cap_psm, tvb, offset, 2, ENC_LITTLE_ENDIAN);

        psm_str = val_to_str_const(psm, psm_vals, "Unknown PSM");

    } else {

        proto_item  *item;

        uint16_t     uuid;

        item = proto_tree_add_item(command_tree, hf_btl2cap_psm_dynamic, tvb, offset, 2, ENC_LITTLE_ENDIAN);

        uuid = get_service_uuid(pinfo, l2cap_data, psm, (pinfo->p2p_dir == P2P_DIR_RECV) ? true : false);

        if (uuid) {

            psm_str = val_to_str_ext_const(uuid, &bluetooth_uuid_vals_ext, "Unknown PSM");

            proto_item_append_text(item, " (%s)", psm_str);

        }

    }

    offset += 2;

    scid = tvb_get_letohs(tvb, offset);

    proto_tree_add_item(command_tree, hf_btl2cap_scid, tvb, offset, 2, ENC_LITTLE_ENDIAN);

    offset += 2;

    col_append_fstr(pinfo->cinfo, COL_INFO, " (%s, SCID: 0x%04x)", psm_str, scid);

    if (is_ch_request) {

        proto_tree_add_item(command_tree, hf_btl2cap_controller, tvb, offset, 1, ENC_LITTLE_ENDIAN);

        offset += 1;

    }

    if (!pinfo->fd->visited) {

        wmem_tree_key_t    key[6];

        uint32_t           k_interface_id;

        uint32_t           k_adapter_id;

        uint32_t           k_chandle;

        uint32_t           k_cid;

        uint32_t           k_frame_number;

        uint32_t           interface_id;

        uint32_t           adapter_id;

        uint32_t           chandle;

        psm_data_t        *psm_data;

        if (pinfo->rec->presence_flags & WTAP_HAS_INTERFACE_ID)

            interface_id = pinfo->rec->rec_header.packet_header.interface_id;

        else

            interface_id = HCI_INTERFACE_DEFAULT;

        adapter_id   = (acl_data) ? acl_data->adapter_id : HCI_ADAPTER_DEFAULT;

        chandle      = (acl_data) ? acl_data->chandle : 0;

        k_interface_id = interface_id;

        k_adapter_id   = adapter_id;

        k_chandle      = chandle;

        k_cid          = scid | ((pinfo->p2p_dir == P2P_DIR_RECV) ? 0x80000000 : 0x00000000);

        k_frame_number = pinfo->num;

        psm_data = wmem_new0(wmem_file_scope(), psm_data_t);

        if (pinfo->p2p_dir == P2P_DIR_RECV) {

            psm_data->local_cid = BTL2CAP_UNKNOWN_CID;

            psm_data->remote_cid = scid |  0x80000000;

        } else {

            psm_data->local_cid = scid;

            psm_data->remote_cid = BTL2CAP_UNKNOWN_CID;

        }

        psm_data->psm  = psm;

        psm_data->local_service = (pinfo->p2p_dir == P2P_DIR_RECV) ? true : false;

        psm_data->in.start_fragments = wmem_tree_new(wmem_file_scope());

        psm_data->out.start_fragments = wmem_tree_new(wmem_file_scope());

        psm_data->interface_id = k_interface_id;

        psm_data->adapter_id   = k_adapter_id;

        psm_data->chandle      = k_chandle;

        psm_data->connect_in_frame = pinfo->num;

        psm_data->disconnect_in_frame = bluetooth_max_disconnect_in_frame;

        key[0].length = 1;

        key[0].key    = &k_interface_id;

        key[1].length = 1;

        key[1].key    = &k_adapter_id;

        key[2].length = 1;

        key[2].key    = &k_chandle;

        key[3].length = 1;

        key[3].key    = &k_cid;

        key[4].length = 1;

        key[4].key    = &k_frame_number;

        key[5].length = 0;

        key[5].key    = NULL;

        wmem_tree_insert32_array(cid_to_psm_table, key, psm_data);

    }

    if (l2cap_data) {

        proto_item        *sub_item;

        uint32_t           bt_uuid = 0;

        uint32_t           disconnect_in_frame = 0;

        psm_data_t        *psm_data;

        wmem_tree_key_t    key[6];

        uint32_t           k_interface_id;

        uint32_t           k_adapter_id;

        uint32_t           k_chandle;

        uint32_t           k_cid;

        uint32_t           k_frame_number;

        uint32_t           interface_id;

        uint32_t           adapter_id;

        uint32_t           chandle;

        if (pinfo->rec->presence_flags & WTAP_HAS_INTERFACE_ID)

            interface_id = pinfo->rec->rec_header.packet_header.interface_id;

        else

            interface_id = HCI_INTERFACE_DEFAULT;

        adapter_id   = (acl_data) ? acl_data->adapter_id : HCI_ADAPTER_DEFAULT;

        chandle      = (acl_data) ? acl_data->chandle : 0;

        k_interface_id = interface_id;

        k_adapter_id   = adapter_id;

        k_chandle      = chandle;

        k_cid          = scid | ((pinfo->p2p_dir == P2P_DIR_RECV) ? 0x80000000 : 0x00000000);

        k_frame_number = pinfo->num;

        key[0].length = 1;

        key[0].key    = &k_interface_id;

        key[1].length = 1;

        key[1].key    = &k_adapter_id;

        key[2].length = 1;

        key[2].key    = &k_chandle;

        key[3].length = 1;

        key[3].key    = &k_cid;

        key[4].length = 1;

        key[4].key    = &k_frame_number;

        key[5].length = 0;

        key[5].key    = NULL;

        psm_data = (psm_data_t *)wmem_tree_lookup32_array_le(cid_to_psm_table, key);

        if (psm_data &&

            psm_data->interface_id == interface_id &&

            psm_data->adapter_id == adapter_id &&

            psm_data->chandle == chandle &&

            psm_data->local_cid == k_cid)

        {

            bt_uuid = get_service_uuid(pinfo, l2cap_data, psm_data->psm, psm_data->local_service);

            disconnect_in_frame = psm_data->disconnect_in_frame;

        }

        if (bt_uuid) {

            sub_item = proto_tree_add_uint(tree, hf_btl2cap_service, tvb, 0, 0, bt_uuid);

            proto_item_set_generated(sub_item);

        }

        if (disconnect_in_frame < bluetooth_max_disconnect_in_frame) {

            sub_item = proto_tree_add_uint(tree, hf_btl2cap_disconnect_in_frame, tvb, 0, 0, disconnect_in_frame);

            proto_item_set_generated(sub_item);

        }

    }

    return offset;

}

static int

dissect_le_credit_based_connrequest(tvbuff_t *tvb, int offset, packet_info *pinfo,

    proto_tree *tree, proto_tree *command_tree, uint16_t cid, uint8_t cmd_ident,

    bthci_acl_data_t *acl_data, btl2cap_data_t *l2cap_data)

{

    proto_item  *psm_item;

    uint32_t     psm;

    uint32_t     scid;

    proto_tree_add_item_ret_uint(command_tree, hf_btl2cap_le_psm, tvb, offset, 2, ENC_LITTLE_ENDIAN, &psm);

    if (psm < 0x80) {

        psm_item = proto_tree_add_item(command_tree, hf_btl2cap_psm, tvb, offset, 2, ENC_LITTLE_ENDIAN);

        proto_item_set_generated(psm_item);

    }

    offset += 2;

    proto_tree_add_item_ret_uint(command_tree, hf_btl2cap_scid, tvb, offset, 2, ENC_LITTLE_ENDIAN, &scid);

    offset += 2;

    proto_tree_add_item(command_tree, hf_btl2cap_option_mtu, tvb, offset, 2, ENC_LITTLE_ENDIAN);

    offset += 2;

    proto_tree_add_item(command_tree, hf_btl2cap_option_mps, tvb, offset, 2, ENC_LITTLE_ENDIAN);

    offset += 2;

    proto_tree_add_item(command_tree, hf_btl2cap_initial_credits, tvb, offset, 2, ENC_LITTLE_ENDIAN);

    offset += 2;

    if (!pinfo->fd->visited) {

        wmem_tree_key_t    key[8];

        uint32_t           k_interface_id;

        uint32_t           k_adapter_id;

        uint32_t           k_chandle;

        uint32_t           k_cid;

        uint32_t           k_cmd_ident;

        uint32_t           k_frame_number;

        uint32_t           interface_id;

        uint32_t           adapter_id;

        uint32_t           chandle;

        psm_data_t        *psm_data;

        uint32_t           key_cid;

        uint32_t           cid_index;

        if (pinfo->rec->presence_flags & WTAP_HAS_INTERFACE_ID)

            interface_id = pinfo->rec->rec_header.packet_header.interface_id;

        else

            interface_id = HCI_INTERFACE_DEFAULT;

        adapter_id = (acl_data) ? acl_data->adapter_id : HCI_ADAPTER_DEFAULT;

        chandle = (acl_data) ? acl_data->chandle : 0;

        k_interface_id = interface_id;

        k_adapter_id = adapter_id;

        k_chandle = chandle;

        k_cid = cid;

        k_cmd_ident = cmd_ident;

        k_frame_number = pinfo->num;

        cid_index = 0;

        psm_data = wmem_new0(wmem_file_scope(), psm_data_t);

        if (pinfo->p2p_dir == P2P_DIR_RECV) {

            key_cid = scid | 0x80000000;

            psm_data->local_cid = BTL2CAP_UNKNOWN_CID;

            psm_data->remote_cid = key_cid;

        }

        else {

            key_cid = scid;

            psm_data->local_cid = key_cid;

            psm_data->remote_cid = BTL2CAP_UNKNOWN_CID;

        }

        psm_data->psm = psm;

        psm_data->local_service = (pinfo->p2p_dir == P2P_DIR_RECV) ? true : false;

        psm_data->in.mode = L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE;

        psm_data->in.start_fragments = wmem_tree_new(wmem_file_scope());

        psm_data->out.mode = L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE;

        psm_data->out.start_fragments = wmem_tree_new(wmem_file_scope());

        psm_data->interface_id = k_interface_id;

        psm_data->adapter_id = k_adapter_id;

        psm_data->chandle = k_chandle;

        psm_data->connect_in_frame = pinfo->num;

        psm_data->disconnect_in_frame = bluetooth_max_disconnect_in_frame;

        key[0].length = 1;

        key[0].key = &k_interface_id;

        key[1].length = 1;

        key[1].key = &k_adapter_id;

        key[2].length = 1;

        key[2].key = &k_chandle;

        key[3].length = 1;

        key[3].key = &k_cid;

        key[4].length = 1;

        key[4].key = &k_cmd_ident;

        key[5].length = 1;

        key[5].key = &k_frame_number;

        key[6].length = 1;

        key[6].key = &cid_index;

        key[7].length = 0;

        key[7].key = NULL;

        wmem_tree_insert32_array(cmd_ident_to_psm_table, key, psm_data);

        k_cid = key_cid;

        key[4].length = 1;

        key[4].key = &k_frame_number;

        key[5].length = 0;

        key[5].key = NULL;

        wmem_tree_insert32_array(cid_to_psm_table, key, psm_data);

    }

    if (l2cap_data) {

        proto_item        *sub_item;

        uint32_t           bt_uuid = 0;

        uint32_t           disconnect_in_frame = 0;

        psm_data_t        *psm_data;

        wmem_tree_key_t    key[6];

        uint32_t           k_interface_id;

        uint32_t           k_adapter_id;

        uint32_t           k_chandle;

        uint32_t           k_cid;

        uint32_t           k_frame_number;

        uint32_t           interface_id;

        uint32_t           adapter_id;

        uint32_t           chandle;

        if (pinfo->rec->presence_flags & WTAP_HAS_INTERFACE_ID)

            interface_id = pinfo->rec->rec_header.packet_header.interface_id;

        else

            interface_id = HCI_INTERFACE_DEFAULT;

        adapter_id = (acl_data) ? acl_data->adapter_id : HCI_ADAPTER_DEFAULT;

        chandle = (acl_data) ? acl_data->chandle : 0;

        k_interface_id = interface_id;

        k_adapter_id = adapter_id;

        k_chandle = chandle;

        k_cid = scid;

        k_frame_number = pinfo->num;

        key[0].length = 1;

        key[0].key = &k_interface_id;

        key[1].length = 1;

        key[1].key = &k_adapter_id;

        key[2].length = 1;

        key[2].key = &k_chandle;

        key[3].length = 1;

        key[3].key = &k_cid;

        key[4].length = 1;

        key[4].key = &k_frame_number;

        key[5].length = 0;

        key[5].key = NULL;

        psm_data = (psm_data_t *)wmem_tree_lookup32_array_le(cid_to_psm_table, key);

        if (psm_data &&

            psm_data->interface_id == interface_id &&

            psm_data->adapter_id == adapter_id &&

            psm_data->chandle == chandle &&

            psm_data->local_cid == k_cid)

        {

            bt_uuid = get_service_uuid(pinfo, l2cap_data, psm_data->psm, psm_data->local_service);

            disconnect_in_frame = psm_data->disconnect_in_frame;

        }

        if (bt_uuid) {

            sub_item = proto_tree_add_uint(tree, hf_btl2cap_service, tvb, 0, 0, bt_uuid);

            proto_item_set_generated(sub_item);

        }

        if (disconnect_in_frame < bluetooth_max_disconnect_in_frame) {

            sub_item = proto_tree_add_uint(tree, hf_btl2cap_disconnect_in_frame, tvb, 0, 0, disconnect_in_frame);

            proto_item_set_generated(sub_item);

        }

    }

    return offset;

}

static int

dissect_le_credit_based_connresponse(tvbuff_t *tvb, int offset, packet_info *pinfo,

    proto_tree *tree, uint16_t cid, uint8_t cmd_ident, bthci_acl_data_t *acl_data)

{

    uint32_t           dcid;

    proto_tree_add_item_ret_uint(tree, hf_btl2cap_dcid, tvb, offset, 2, ENC_LITTLE_ENDIAN, &dcid);

    offset += 2;

    proto_tree_add_item(tree, hf_btl2cap_option_mtu, tvb, offset, 2, ENC_LITTLE_ENDIAN);

    offset += 2;

    proto_tree_add_item(tree, hf_btl2cap_option_mps, tvb, offset, 2, ENC_LITTLE_ENDIAN);

    offset += 2;

    proto_tree_add_item(tree, hf_btl2cap_initial_credits, tvb, offset, 2, ENC_LITTLE_ENDIAN);

    offset += 2;

    proto_tree_add_item(tree, hf_btl2cap_le_result, tvb, offset, 2, ENC_LITTLE_ENDIAN);

    offset += 2;

    if (pinfo->fd->visited == 0) {

        psm_data_t        *psm_data;

        wmem_tree_key_t    key[8];

        uint32_t           k_interface_id;

        uint32_t           k_adapter_id;

        uint32_t           k_chandle;

        uint32_t           k_cid;

        uint32_t           k_cmd_ident;