/* packet-ipx.c

 * Routines for NetWare's IPX

 * Gilbert Ramirez <gram@alumni.rice.edu>

 * NDPS support added by Greg Morris (gmorris@novell.com)

 *

 * Portions Copyright (c) 2000-2002 by Gilbert Ramirez.

 * Portions Copyright (c) Novell, Inc. 2002-2003

 *

 * Wireshark - Network traffic analyzer

 * By Gerald Combs <gerald@wireshark.org>

 * Copyright 1998 Gerald Combs

 *

 * SPDX-License-Identifier: GPL-2.0-or-later

 */

#include "config.h"

#include <epan/packet.h>

#include <epan/capture_dissectors.h>

#include "packet-ipx.h"

#include "packet-sll.h"

#include <epan/addr_resolv.h>

#include <epan/etypes.h>

#include <epan/aftypes.h>

#include <epan/conversation.h>

#include <epan/conversation_table.h>

#include <epan/proto_data.h>

#include <epan/unit_strings.h>

#include "packet-ppp.h"

#include "packet-llc.h"

#include "packet-arcnet.h"

void proto_register_ipx(void);

void proto_reg_handoff_ipx(void);

static int ipx_tap;

/* The information in this module (IPX, SPX, NCP) comes from:

  NetWare LAN Analysis, Second Edition

  Laura A. Chappell and Dan E. Hakes

  (c) 1994 Novell, Inc.

  Novell Press, San Jose.

  ISBN: 0-7821-1362-1

  And from the ncpfs source code by Volker Lendecke

*/

static int proto_ipx;

static int hf_ipx_checksum;

static int hf_ipx_len;

static int hf_ipx_src;

static int hf_ipx_dst;

static int hf_ipx_addr;

static int hf_ipx_hops;

static int hf_ipx_packet_type;

static int hf_ipx_dnet;

static int hf_ipx_dnode;

static int hf_ipx_dsocket;

static int hf_ipx_snet;

static int hf_ipx_snode;

static int hf_ipx_ssocket;

static int hf_ipx_net;

static int hf_ipx_node;

static int hf_ipx_socket;

static int ett_ipx;

static dissector_table_t ipx_type_dissector_table;

static dissector_table_t ipx_socket_dissector_table;

static dissector_table_t spx_socket_dissector_table;

static dissector_handle_t ipx_handle;

static dissector_handle_t ipxsap_handle;

static dissector_handle_t spx_handle;

static dissector_handle_t ipxrip_handle;

static dissector_handle_t serialization_handle;

static dissector_handle_t ipxmsg_handle;

static int proto_spx;

static int hf_spx_connection_control;

static int hf_spx_connection_control_sys;

static int hf_spx_connection_control_send_ack;

static int hf_spx_connection_control_attn;

static int hf_spx_connection_control_eom;

static int hf_spx_connection_control_v2;

static int hf_spx_connection_control_neg_size;

static int hf_spx_connection_control_reserved;

static int hf_spx_connection_control_ext_header;

static int hf_spx_datastream_type;

static int hf_spx_src_id;

static int hf_spx_dst_id;

static int hf_spx_seq_nr;

static int hf_spx_ack_nr;

static int hf_spx_all_nr;

static int hf_spx_neg_size;

static int hf_spx_rexmt_frame;

static int hf_spx_rexmt_data;

static int ett_spx;

static int ett_spx_connctrl;

static int proto_ipxrip;

static int hf_ipxrip_request;

static int hf_ipxrip_response;

static int hf_ipxrip_packet_type;

static int hf_ipxrip_route_vector;

static int hf_ipxrip_hops;

static int hf_ipxrip_ticks;

static int ett_ipxrip;

static int proto_serialization;

static int hf_serial_number;

static int ett_serialization;

static int proto_sap;

static int hf_sap_request;

static int hf_sap_response;

static int hf_sap_packet_type;

static int hf_sap_server;

static int hf_sap_server_type;

static int hf_sap_server_name;

static int hf_sap_server_network;

static int hf_sap_server_node;

static int hf_sap_server_socket;

static int hf_sap_server_intermediate_networks;

static int ett_ipxsap;

static int ett_ipxsap_server;

static int ett_ipxmsg;

static int proto_ipxmsg;

static int hf_msg_conn;

static int hf_msg_sigchar;

#define UDP_PORT_IPX    213    /* RFC 1234 */

#define IPX_HEADER_LEN  30    /* It's *always* 30 bytes */

static const char* ipx_conv_get_filter_type(conv_item_t* conv, conv_filter_type_e filter)

{

  if ((filter == CONV_FT_SRC_ADDRESS) && (conv->src_address.type == AT_IPX))

    return "ipx.src";

  if ((filter == CONV_FT_DST_ADDRESS) && (conv->dst_address.type == AT_IPX))

    return "ipx.dst";

  if ((filter == CONV_FT_ANY_ADDRESS) && (conv->src_address.type == AT_IPX))

    return "ipx.addr";

  return CONV_FILTER_INVALID;

}

static ct_dissector_info_t ipx_ct_dissector_info = {&ipx_conv_get_filter_type};

static tap_packet_status

ipx_conversation_packet(void *pct, packet_info *pinfo, epan_dissect_t *edt _U_, const void *vip, tap_flags_t flags)

{

  conv_hash_t *hash = (conv_hash_t*) pct;

    hash->flags = flags;

  const ipxhdr_t *ipxh=(const ipxhdr_t *)vip;

  add_conversation_table_data(hash, &ipxh->ipx_src, &ipxh->ipx_dst, 0, 0, 1, pinfo->fd->pkt_len, &pinfo->rel_ts, &pinfo->abs_ts, &ipx_ct_dissector_info, CONVERSATION_NONE);

  return TAP_PACKET_REDRAW;

}

static const char* ipx_endpoint_get_filter_type(endpoint_item_t* endpoint, conv_filter_type_e filter)

{

  if ((filter == CONV_FT_ANY_ADDRESS) && (endpoint->myaddress.type == AT_IPX))

    return "ipx.addr";

  return CONV_FILTER_INVALID;

}

static et_dissector_info_t ipx_endpoint_dissector_info = {&ipx_endpoint_get_filter_type};

static tap_packet_status

ipx_endpoint_packet(void *pit, packet_info *pinfo, epan_dissect_t *edt _U_, const void *vip, tap_flags_t flags)

{

  conv_hash_t *hash = (conv_hash_t*) pit;

    hash->flags = flags;

  const ipxhdr_t *ipxh=(const ipxhdr_t *)vip;

  /* Take two "add" passes per packet, adding for each direction, ensures that all

  packets are counted properly (even if address is sending to itself)

  XXX - this could probably be done more efficiently inside endpoint_table */

  add_endpoint_table_data(hash, &ipxh->ipx_src, 0, true, 1, pinfo->fd->pkt_len, &ipx_endpoint_dissector_info, ENDPOINT_NONE);

  add_endpoint_table_data(hash, &ipxh->ipx_dst, 0, false, 1, pinfo->fd->pkt_len, &ipx_endpoint_dissector_info, ENDPOINT_NONE);

  return TAP_PACKET_REDRAW;

}

/* ================================================================= */

/* IPX                                                               */

/* ================================================================= */

static const value_string ipx_socket_vals[] = {

  { IPX_SOCKET_PING_CISCO,    "CISCO PING" },

  { IPX_SOCKET_NCP,     "NCP" },

  { IPX_SOCKET_SAP,     "SAP" },

  { IPX_SOCKET_IPXRIP,      "RIP" },

  { IPX_SOCKET_NETBIOS,     "NetBIOS" },

  { IPX_SOCKET_DIAGNOSTIC,    "Diagnostic" },

  { IPX_SOCKET_SERIALIZATION,   "Serialization" },

  { IPX_SOCKET_NWLINK_SMB_SERVER,   "NWLink SMB Server" },

  { IPX_SOCKET_NWLINK_SMB_NAMEQUERY,  "NWLink SMB Name Query" },

  { IPX_SOCKET_NWLINK_SMB_REDIR,    "NWLink SMB Redirector" },

  { IPX_SOCKET_NWLINK_SMB_MAILSLOT, "NWLink SMB Mailslot Datagram" },

  { IPX_SOCKET_NWLINK_SMB_MESSENGER,  "NWLink SMB Messenger" },

  { IPX_SOCKET_NWLINK_SMB_BROWSE,   "NWLink SMB Browse" },

  { IPX_SOCKET_ATTACHMATE_GW,   "Attachmate Gateway" },

  { IPX_SOCKET_IPX_MESSAGE,   "IPX Message" },

  { IPX_SOCKET_IPX_MESSAGE1,    "IPX Message" },

  { 0x4006,       "NetWare Directory Server" },

  { 0x400C,       "HP LaserJet/QuickSilver" },

  { 0x8104,       "NetWare 386" },

  { IPX_SOCKET_ADSM,      "ADSM" },

  { IPX_SOCKET_EIGRP,     "Cisco EIGRP for IPX" },

  { 0x8F83,       "Powerchute UPS Monitoring" },

  { IPX_SOCKET_NLSP,      "NetWare Link Services Protocol" },

  { IPX_SOCKET_IPXWAN,      "IPX WAN" },

  { IPX_SOCKET_SNMP_AGENT,    "SNMP Agent" },

  { IPX_SOCKET_SNMP_SINK,     "SNMP Sink" },

  { 0x907B,       "SMS Testing and Development" },

  { IPX_SOCKET_PING_NOVELL,   "Novell PING" },

  { IPX_SOCKET_TCP_TUNNEL,    "TCP Tunnel" },

  { IPX_SOCKET_UDP_TUNNEL,    "UDP Tunnel" },

  { SPX_SOCKET_PA,      "NDPS Printer Agent/PSM" },

  { SPX_SOCKET_BROKER,      "NDPS Broker" },

  { SPX_SOCKET_SRS,     "NDPS Service Registry Service" },

  { SPX_SOCKET_ENS,     "NDPS Event Notification Service" },

  { SPX_SOCKET_RMS,     "NDPS Remote Management Service" },

  { SPX_SOCKET_NOTIFY_LISTENER,   "NDPS Notify Listener" },

  { 0xE885,       "NT Server-RPC/GW" },

  { 0x0000,       NULL }

};

value_string_ext ipx_socket_vals_ext = VALUE_STRING_EXT_INIT(ipx_socket_vals);

static const value_string ipx_packet_type_vals[] = {

  { IPX_PACKET_TYPE_IPX,    "IPX" },

  { IPX_PACKET_TYPE_RIP,    "RIP" },

  { IPX_PACKET_TYPE_ECHO,   "Echo" },

  { IPX_PACKET_TYPE_ERROR,  "Error" },

  { IPX_PACKET_TYPE_PEP,    "PEP" }, /* Packet Exchange Packet */

  { IPX_PACKET_TYPE_SPX,    "SPX" },

  { 16,       "Experimental Protocol" },

  { IPX_PACKET_TYPE_NCP,    "NCP" },

  { 18,       "Experimental Protocol" },

  { 19,       "Experimental Protocol" },

  { IPX_PACKET_TYPE_WANBCAST, "NetBIOS Broadcast" },

  { 21,       "Experimental Protocol" },

  { 22,       "Experimental Protocol" },

  { 23,       "Experimental Protocol" },

  { 24,       "Experimental Protocol" },

  { 25,       "Experimental Protocol" },

  { 26,       "Experimental Protocol" },

  { 27,       "Experimental Protocol" },

  { 28,       "Experimental Protocol" },

  { 29,       "Experimental Protocol" },

  { 30,       "Experimental Protocol" },

  { 31,       "Experimental Protocol" },

  { 0,        NULL }

};

static const value_string ipxmsg_sigchar_vals[] = {

  { '?', "Poll inactive station" },

  { 'Y', "Station is still using the connection" },

  { '!', "Broadcast message waiting" },

  { 0, NULL }

};

static bool

capture_ipx(const unsigned char *pd _U_, int offset _U_, int len _U_, capture_packet_info_t *cpinfo, const union wtap_pseudo_header *pseudo_header _U_)

{

  capture_dissector_increment_count(cpinfo, proto_ipx);

  return true;

}

static int

dissect_ipx(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_)

{

  tvbuff_t  *next_tvb;

  proto_tree  *ipx_tree = NULL;

  proto_item  *ti = NULL, *hidden_item;

  uint8_t   ipx_hops;

  char    *str;

  uint16_t    first_socket, second_socket;

  uint32_t    ipx_snet, ipx_dnet;

  static ipxhdr_t ipxh_arr[4];

  static int ipx_current=0;

  ipxhdr_t *ipxh;

  ipx_current++;

  if(ipx_current==4){

    ipx_current=0;

  }

  ipxh=&ipxh_arr[ipx_current];

  col_set_str(pinfo->cinfo, COL_PROTOCOL, "IPX");

  col_clear(pinfo->cinfo, COL_INFO);

  /* Calculate here for use in pinfo and in tree */

  ipxh->ipx_dsocket = tvb_get_ntohs(tvb, 16);

  ipxh->ipx_ssocket = tvb_get_ntohs(tvb, 28);

  ipxh->ipx_type    = tvb_get_uint8(tvb, 5);

  ipxh->ipx_length  = tvb_get_ntohs(tvb, 2);

  pinfo->ptype = PT_IPX;

  pinfo->srcport = ipxh->ipx_ssocket;

  pinfo->destport = ipxh->ipx_dsocket;

  /* Adjust the tvbuff length to include only the IPX datagram. */

  set_actual_length(tvb, ipxh->ipx_length);

  set_address_tvb(&pinfo->net_src, AT_IPX, 10, tvb, 18);

    copy_address_shallow(&pinfo->src, &pinfo->net_src);

    copy_address_shallow(&ipxh->ipx_src, &pinfo->net_src);

  set_address_tvb(&pinfo->net_dst, AT_IPX, 10, tvb, 6);

    copy_address_shallow(&pinfo->dst, &pinfo->net_dst);

    copy_address_shallow(&ipxh->ipx_dst, &pinfo->net_dst);

  col_add_str(pinfo->cinfo, COL_INFO, val_to_str_ext(pinfo->pool, ipxh->ipx_dsocket, &ipx_socket_vals_ext, "Unknown (0x%04x)"));

  if (tree) {

    ti = proto_tree_add_item(tree, proto_ipx, tvb, 0, IPX_HEADER_LEN, ENC_NA);

    ipx_tree = proto_item_add_subtree(ti, ett_ipx);

  }

  str=address_to_str(pinfo->pool, &pinfo->net_src);

  hidden_item = proto_tree_add_string(ipx_tree, hf_ipx_src, tvb, 0, 0, str);

  proto_item_set_hidden(hidden_item);

  hidden_item = proto_tree_add_string(ipx_tree, hf_ipx_addr, tvb, 0, 0, str);

  proto_item_set_hidden(hidden_item);

  str=address_to_str(pinfo->pool, &pinfo->net_dst);

  hidden_item = proto_tree_add_string(ipx_tree, hf_ipx_dst, tvb, 0, 0, str);

  proto_item_set_hidden(hidden_item);

  hidden_item = proto_tree_add_string(ipx_tree, hf_ipx_addr, tvb, 0, 0, str);

  proto_item_set_hidden(hidden_item);

  proto_tree_add_checksum(ipx_tree, tvb, 0, hf_ipx_checksum, -1, NULL, pinfo, 0, ENC_BIG_ENDIAN, PROTO_CHECKSUM_NO_FLAGS);

  proto_tree_add_uint(ipx_tree, hf_ipx_len, tvb, 2, 2, ipxh->ipx_length);

  ipx_hops = tvb_get_uint8(tvb, 4);

  proto_tree_add_uint_format(ipx_tree, hf_ipx_hops, tvb, 4, 1, ipx_hops,

    "Transport Control: %d hops", ipx_hops);

  proto_tree_add_uint(ipx_tree, hf_ipx_packet_type, tvb, 5, 1, ipxh->ipx_type);

  /* Destination */

  ipx_dnet = tvb_get_ntohl(tvb, 6);

  proto_tree_add_ipxnet(ipx_tree, hf_ipx_dnet, tvb, 6, 4,

    ipx_dnet);

  hidden_item = proto_tree_add_ipxnet(ipx_tree, hf_ipx_net, tvb, 6, 4,

    ipx_dnet);

  proto_item_set_hidden(hidden_item);

  proto_tree_add_item(ipx_tree, hf_ipx_dnode, tvb, 10, 6, ENC_NA);

  hidden_item = proto_tree_add_item(ipx_tree, hf_ipx_node, tvb, 10, 6, ENC_NA);

  proto_item_set_hidden(hidden_item);

  proto_tree_add_uint(ipx_tree, hf_ipx_dsocket, tvb, 16, 2,

    ipxh->ipx_dsocket);

  hidden_item = proto_tree_add_uint(ipx_tree, hf_ipx_socket, tvb, 16, 2,

    ipxh->ipx_dsocket);

  proto_item_set_hidden(hidden_item);

  /* Source */

  ipx_snet = tvb_get_ntohl(tvb, 18);

  proto_tree_add_ipxnet(ipx_tree, hf_ipx_snet, tvb, 18, 4,

    ipx_snet);

  hidden_item = proto_tree_add_ipxnet(ipx_tree, hf_ipx_net, tvb, 18, 4,

    ipx_snet);

  proto_item_set_hidden(hidden_item);

  proto_tree_add_item(ipx_tree, hf_ipx_snode, tvb, 22, 6, ENC_NA);

  hidden_item = proto_tree_add_item(ipx_tree, hf_ipx_node, tvb, 22, 6, ENC_NA);

  proto_item_set_hidden(hidden_item);

  proto_tree_add_uint(ipx_tree, hf_ipx_ssocket, tvb, 28, 2,

    ipxh->ipx_ssocket);

  hidden_item = proto_tree_add_uint(ipx_tree, hf_ipx_socket, tvb, 28, 2,

    ipxh->ipx_ssocket);

  proto_item_set_hidden(hidden_item);

  /* Make the next tvbuff */

  next_tvb = tvb_new_subset_remaining(tvb, IPX_HEADER_LEN);

  /*

   * Check the socket numbers before we check the packet type;

   * we've seen non-NCP packets with a type of NCP and a

   * destination socket of IPX_SOCKET_IPX_MESSAGE, and SAP

   * packets with a type of NCP and a destination socket of

   * IPX_SOCKET_SAP.

   *

   * We've seen NCP packets with a type of NCP, a source socket of

   * IPX_SOCKET_NCP, and a destination socket of IPX_SOCKET_IPX_MESSAGE,

   * and we've seen NCP packets with a type of NCP, a source socket of

   * IPX_SOCKET_IPX_MESSAGE, and a destination socket of

   * IPX_SOCKET_NCP, so testing the destination socket first doesn't

   * always give the right answer.  We've also seen SAP packets with

   * a source socket of IPX_SOCKET_SAP and a destination socket of

   * IPX_SOCKET_IPX_MESSAGE.

   *

   * Unfortunately, we've also seen packets with a source socket

   * of IPX_SOCKET_NWLINK_SMB_SERVER and a destination socket

   * of IPX_SOCKET_NWLINK_SMB_NAMEQUERY that were NMPI packets,

   * not SMB packets, so testing the lower-valued socket first

   * also doesn't always give the right answer.

   *

   * So we start out assuming we should test the lower-numbered

   * socket number first, but, if the higher-numbered socket is

   * IPX_SOCKET_NWLINK_SMB_NAMEQUERY, we assume that it's a

   * NMPI query, and test only that socket.

   */

  if (ipxh->ipx_ssocket > ipxh->ipx_dsocket) {

    first_socket = ipxh->ipx_dsocket;

    second_socket = ipxh->ipx_ssocket;

  } else {

    first_socket = ipxh->ipx_ssocket;

    second_socket = ipxh->ipx_dsocket;

  }

  tap_queue_packet(ipx_tap, pinfo, ipxh);

  if (second_socket != IPX_SOCKET_NWLINK_SMB_NAMEQUERY) {

    if (dissector_try_uint_with_data(ipx_socket_dissector_table, first_socket,

      next_tvb, pinfo, tree, false, ipxh))

      return tvb_captured_length(tvb);

  }

  if (dissector_try_uint_with_data(ipx_socket_dissector_table, second_socket,

    next_tvb, pinfo, tree, false, ipxh))

    return tvb_captured_length(tvb);

  /*

   * Neither of them are known; try the packet type, which will

   * at least let us, for example, dissect SPX packets as SPX.

   */

  if (dissector_try_uint_with_data(ipx_type_dissector_table, ipxh->ipx_type, next_tvb,

    pinfo, tree, false, ipxh))

    return tvb_captured_length(tvb);

  call_data_dissector(next_tvb, pinfo, tree);

  return tvb_captured_length(tvb);

}

/* ================================================================= */

/* SPX Hash Functions                                                */

/* ================================================================= */

typedef struct {

  conversation_t  *conversation;

  uint32_t        spx_src;

  uint16_t        spx_seq;

} spx_hash_key;

typedef struct {

  uint16_t            spx_ack;

  uint16_t            spx_all;

  uint32_t            num;

} spx_hash_value;

/*

 * Structure attached to retransmitted SPX frames; it contains the

 * frame number of the original transmission.

 */

typedef struct {

  uint32_t            num;

} spx_rexmit_info;

static wmem_map_t *spx_hash;

/* Hash Functions */

static int

spx_equal(const void *v, const void *v2)

{

  const spx_hash_key  *val1 = (const spx_hash_key*)v;

  const spx_hash_key  *val2 = (const spx_hash_key*)v2;

  if (val1->conversation == val2->conversation &&

      val1->spx_src == val2->spx_src &&

      val1->spx_seq == val2->spx_seq) {

    return 1;

  }

  return 0;

}

static unsigned

spx_hash_func(const void *v)

{

  const spx_hash_key  *spx_key = (const spx_hash_key*)v;

  return GPOINTER_TO_UINT(spx_key->conversation) + spx_key->spx_src;

}

static spx_hash_value*

spx_hash_insert(conversation_t *conversation, uint32_t spx_src, uint16_t spx_seq)

{

  spx_hash_key    *key;

  spx_hash_value    *value;

  /* Now remember the packet, so we can find it if we later. */

  key = wmem_new(wmem_file_scope(), spx_hash_key);

  key->conversation = conversation;

  key->spx_src = spx_src;

  key->spx_seq = spx_seq;

  value = wmem_new0(wmem_file_scope(), spx_hash_value);

  wmem_map_insert(spx_hash, key, value);

  return value;

}

/* Returns the spx_hash_value*, or NULL if not found. */

static spx_hash_value*

spx_hash_lookup(conversation_t *conversation, uint32_t spx_src, uint32_t spx_seq)

{

  spx_hash_key    key;

  key.conversation = conversation;

  key.spx_src = spx_src;

  key.spx_seq = spx_seq;

  return (spx_hash_value *)wmem_map_lookup(spx_hash, &key);

}

/* ================================================================= */

/* SPX                                                               */

/* ================================================================= */

#define SPX_SYS_PACKET  0x80

#define SPX_SEND_ACK  0x40

#define SPX_ATTN  0x20

#define SPX_EOM   0x10

#define SPX_VII_PACKET  0x08

#define SPX_NEG_SIZE  0x04

#define SPX_RESERVED  0x02

#define SPX_EXT_HEADER  0x01

static const value_string conn_vals[] = {

  { 0x00,                        "Data, No Ack Required" },

  { SPX_EOM,                     "End-of-Message" },

  { SPX_ATTN,                    "Attention" },

  { SPX_SEND_ACK,                "Acknowledgment Required"},

  { SPX_SEND_ACK|SPX_EOM,        "Send Ack: End Message"},

  { SPX_SYS_PACKET,              "System Packet"},

  { SPX_SYS_PACKET|SPX_SEND_ACK, "System Packet: Send Ack"},

  { 0x00,                        NULL }

};

static const char*

spx_datastream(uint8_t type)

{

  switch (type) {

    case 0xfe:

      return "End-of-Connection";

    case 0xff:

      return "End-of-Connection Acknowledgment";

    default:

      return NULL;

  }

}

#define SPX_HEADER_LEN  12

#define SPX2_HEADER_LEN 14

static int

dissect_spx(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_)

{

  proto_tree  *spx_tree;

  proto_item  *ti;

  tvbuff_t  *next_tvb;

  uint8_t   conn_ctrl;

  uint8_t   hdr_len = SPX_HEADER_LEN;

  uint8_t   datastream_type;

  const char  *datastream_type_string;

  uint16_t        spx_seq;

  const char  *spx_msg_string;

  uint16_t    low_socket, high_socket;

  uint32_t    src;

  conversation_t  *conversation;

  spx_hash_value  *pkt_value;

  spx_rexmit_info *spx_rexmit_info_p;

  spx_info  spx_infox;

  col_set_str(pinfo->cinfo, COL_PROTOCOL, "SPX");

  col_set_str(pinfo->cinfo, COL_INFO, "SPX");

  conn_ctrl = tvb_get_uint8(tvb, 0);

  if ((conn_ctrl & SPX_VII_PACKET) && tvb_get_ntohs(tvb, 4) != 0xffff) {

    /* SPX2 packets have an extra two-byte field, unless they have

     * a dest-ID of 0xffff... */

    hdr_len = SPX2_HEADER_LEN;

  }

  ti = proto_tree_add_item(tree, proto_spx, tvb, 0, hdr_len, ENC_NA);

  spx_tree = proto_item_add_subtree(ti, ett_spx);

  spx_msg_string = val_to_str_const((conn_ctrl & 0xf0), conn_vals, "Unknown" );

  col_append_fstr(pinfo->cinfo, COL_INFO, " %s", spx_msg_string);

  if (tree) {

    static int * const spx_flags[] = {

      &hf_spx_connection_control_sys,

      &hf_spx_connection_control_send_ack,

      &hf_spx_connection_control_attn,

      &hf_spx_connection_control_eom,

      NULL

    };

    static int * const spx_vii_flags[] = {

      &hf_spx_connection_control_sys,

      &hf_spx_connection_control_send_ack,

      &hf_spx_connection_control_attn,

      &hf_spx_connection_control_eom,

      &hf_spx_connection_control_v2,

      &hf_spx_connection_control_neg_size,

      &hf_spx_connection_control_reserved,

      &hf_spx_connection_control_ext_header,

      NULL

    };

    if (conn_ctrl & SPX_VII_PACKET) {

      proto_tree_add_bitmask_with_flags(spx_tree, tvb, 0, hf_spx_connection_control,

                      ett_spx_connctrl, spx_vii_flags, ENC_NA, BMT_NO_APPEND);

    } else {

      proto_tree_add_bitmask_with_flags(spx_tree, tvb, 0, hf_spx_connection_control,

                      ett_spx_connctrl, spx_flags, ENC_NA, BMT_NO_APPEND);

    }

  }

  datastream_type = tvb_get_uint8(tvb, 1);

  datastream_type_string = spx_datastream(datastream_type);

  if (datastream_type_string != NULL) {

    col_append_fstr(pinfo->cinfo, COL_INFO, " (%s)",

          datastream_type_string);

  }

  if (tree) {

    if (datastream_type_string != NULL) {

      proto_tree_add_uint_format_value(spx_tree, hf_spx_datastream_type, tvb,

               1, 1, datastream_type,

               "%s (0x%02X)",

               datastream_type_string,

               datastream_type);

    } else {

      proto_tree_add_uint_format_value(spx_tree, hf_spx_datastream_type, tvb,

               1, 1, datastream_type,

               "0x%02X",

               datastream_type);

    }

    proto_tree_add_item(spx_tree, hf_spx_src_id, tvb,  2, 2, ENC_BIG_ENDIAN);

    proto_tree_add_item(spx_tree, hf_spx_dst_id, tvb,  4, 2, ENC_BIG_ENDIAN);

  }

  spx_seq = tvb_get_ntohs(tvb, 6);

  if (tree) {

    proto_tree_add_uint(spx_tree, hf_spx_seq_nr, tvb,  6, 2, spx_seq);

    proto_tree_add_item(spx_tree, hf_spx_ack_nr, tvb,  8, 2, ENC_BIG_ENDIAN);

    proto_tree_add_item(spx_tree, hf_spx_all_nr, tvb, 10, 2, ENC_BIG_ENDIAN);

    /*  field exists on ALL SPXII packets EXCEPT the first packet of

     *  the session.  The first packet can be determined by checking

     *  the destination ID field for a value of 0xffff (65535) and

     *  that the SPXII bit is set in Connection Control.

     */

    if ((conn_ctrl & SPX_VII_PACKET) && tvb_get_ntohs(tvb, 4) != 0xffff) {

      proto_tree_add_item(spx_tree, hf_spx_neg_size, tvb, 12, 2, ENC_BIG_ENDIAN);

    }

  }

  /*

   * SPX is Connection Oriented and Delivery Guaranteed.

   * On the first pass, we need to flag retransmissions by the SPX

   * protocol, so that subdissectors know whether a packet was

   * retransmitted.

   *

   * We start out by creating a conversation for this direction of the

   * IPX session; we use "pinfo->srcport" twice, so that we have

   * separate conversations for the two directions.

   *

   * XXX - that might not work correctly if there's more than one

   * SPX session using that source port; can that happen?  If so,

   * we should probably use the direction, as well as the conversation,

   * as part of the hash key; if we do that, we can probably just

   * use CONVERSATION_IPX as the port type, and possibly get rid of CONVERSATION_NCP.

   *

   * According to

   *

   *  http://developer.novell.com/research/appnotes/1995/december/03/apv.htm

   *

   * the sequence number is not incremented for system packets, so

   * presumably that means there is no notion of a system packet

   * being retransmitted; that document also says that system

   * packets are used as "I'm still here" keepalives and as

   * acknowledgements (presumably meaning ACK-only packets), which

   * suggests that they might not be ACKed and thus might not

   * be retransmitted.

   */

  if (conn_ctrl & SPX_SYS_PACKET) {

    /*

     * It's a system packet, so it isn't a retransmission.

     */

    spx_rexmit_info_p = NULL;

  } else {

    /*

     * Not a system packet - check for retransmissions.

     */

    if (!pinfo->fd->visited) {

      conversation = find_conversation(pinfo->num, &pinfo->src,

          &pinfo->dst, CONVERSATION_NCP, pinfo->srcport,

          pinfo->srcport, 0);

      if (conversation == NULL) {

        /*

         * It's not part of any conversation - create

         * a new one.

         */

        conversation = conversation_new(pinfo->num, &pinfo->src,

            &pinfo->dst, CONVERSATION_NCP, pinfo->srcport,

            pinfo->srcport, 0);

      }

      /*

       * Now we'll hash the SPX header and use the result

       * of that, plus the conversation, as a hash key to

       * identify this packet.

       *

       * If we don't find it in the hash table, it's not a

       * retransmission, otherwise it is.  If we don't find

       * it, we enter it into the hash table, with the

       * frame number.

       * If we do, we attach to this frame a structure giving

       * the frame number of the original transmission, so

       * that we, and subdissectors, know it's a

       * retransmission.

       */

      src = tvb_get_ntohs(tvb, 0)+tvb_get_ntohs(tvb, 2)+tvb_get_ntohs(tvb, 4)+tvb_get_ntohs(tvb, 6)+tvb_get_ntohs(tvb, 8);

      pkt_value = spx_hash_lookup(conversation, src, spx_seq);

      if (pkt_value == NULL) {

        /*

         * Not found in the hash table.

         * Enter it into the hash table.

         */

        pkt_value = spx_hash_insert(conversation, src,

            spx_seq);

        pkt_value->spx_ack = tvb_get_ntohs(tvb, 8);

        pkt_value->spx_all = tvb_get_ntohs(tvb, 10);

        pkt_value->num = pinfo->num;

        /*

         * This is not a retransmission, so we shouldn't

         * have any retransmission indicator.

         */

        spx_rexmit_info_p = NULL;

      } else {

        /*

         * Found in the hash table.  Mark this frame as

         * a retransmission.

         */

        spx_rexmit_info_p = wmem_new(wmem_file_scope(), spx_rexmit_info);

        spx_rexmit_info_p->num = pkt_value->num;

        p_add_proto_data(wmem_file_scope(), pinfo, proto_spx, 0,

            spx_rexmit_info_p);

      }

    } else {

      /*

       * Do we have per-packet SPX data for this frame?

       * If so, it's a retransmission, and the per-packet

       * data indicates which frame had the original

       * transmission.

       */

      spx_rexmit_info_p = (spx_rexmit_info *)p_get_proto_data(wmem_file_scope(), pinfo,

          proto_spx, 0);

    }

  }

  /*

   * It's a retransmission if we have a retransmission indicator.

   * Flag this as a retransmission, but don't pass it to the

   * subdissector.

   */

  if (spx_rexmit_info_p != NULL) {

    col_add_fstr(pinfo->cinfo, COL_INFO,

          "[Retransmission] Original Packet %u",

          spx_rexmit_info_p->num);

    if (tree) {

      proto_tree_add_uint_format(spx_tree, hf_spx_rexmt_frame,

          tvb, 0, 0, spx_rexmit_info_p->num,

          "This is a retransmission of frame %u",

          spx_rexmit_info_p->num);

      if (tvb_reported_length_remaining(tvb, hdr_len) > 0) {

        proto_tree_add_item(spx_tree, hf_spx_rexmt_data, tvb, hdr_len, -1, ENC_NA);

      }

    }

    return tvb_captured_length(tvb);

  }

  if (tvb_reported_length_remaining(tvb, hdr_len) > 0) {

    /*

     * Call subdissectors based on the IPX socket numbers; a

     * subdissector might have registered with our IPX socket

     * dissector table rather than the IPX dissector's socket

     * dissector table.

     *

     * Assume the lower-numbered socket number is more likely

     * to be the right one, along the lines of what we do for

     * TCP and UDP.  We've seen NCP packets with a type of NCP,

     * a source socket of IPX_SOCKET_NCP, and a destination

     * socket of IPX_SOCKET_IPX_MESSAGE, and we've seen NCP

     * packets with a type of NCP, a source socket of

     * IPX_SOCKET_IPX_MESSAGE, and a destination socket of

     * IPX_SOCKET_NCP.

     */

    if (pinfo->srcport > pinfo->destport) {

      low_socket = pinfo->destport;

      high_socket = pinfo->srcport;

    } else {

      low_socket = pinfo->srcport;

      high_socket = pinfo->destport;

    }

    /*

     * Pass information to subdissectors.

     */

    spx_infox.eom = conn_ctrl & SPX_EOM;

    spx_infox.datastream_type = datastream_type;

    next_tvb = tvb_new_subset_remaining(tvb, hdr_len);

    if (dissector_try_uint_with_data(spx_socket_dissector_table, low_socket,

        next_tvb, pinfo, tree, false, &spx_infox))

    {

      return tvb_captured_length(tvb);

    }

    if (dissector_try_uint_with_data(spx_socket_dissector_table, high_socket,

        next_tvb, pinfo, tree, false, &spx_infox))

    {

      return tvb_captured_length(tvb);

    }

    call_data_dissector(next_tvb, pinfo, tree);

  }

  return tvb_captured_length(tvb);

}

/* ================================================================= */

/* IPX Message                                                       */

/* ================================================================= */

static int

dissect_ipxmsg(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_)

{

  proto_tree  *msg_tree;

  proto_item  *ti;

  uint8_t   conn_number, sig_char;

  col_set_str(pinfo->cinfo, COL_PROTOCOL, "IPX MSG");

  col_clear(pinfo->cinfo, COL_INFO);

  conn_number = tvb_get_uint8(tvb, 0);

  sig_char = tvb_get_uint8(tvb, 1);

  col_add_fstr(pinfo->cinfo, COL_INFO,

      "%s, Connection %d",

      val_to_str_const(sig_char, ipxmsg_sigchar_vals, "Unknown Signature Character"), conn_number);

  if (tree) {

    ti = proto_tree_add_item(tree, proto_ipxmsg, tvb, 0, -1, ENC_NA);

    msg_tree = proto_item_add_subtree(ti, ett_ipxmsg);

    proto_tree_add_uint(msg_tree, hf_msg_conn, tvb, 0, 1, conn_number);

    proto_tree_add_uint(msg_tree, hf_msg_sigchar, tvb, 1, 1, sig_char);

  }

  return tvb_captured_length(tvb);

}

/* ================================================================= */

/* IPX RIP                                                           */

/* ================================================================= */

static const value_string ipxrip_packet_vals[] = {

  { IPX_RIP_REQUEST,    "Request"},

  { IPX_RIP_RESPONSE,   "Response"},

  { 0,            NULL}

};

static int

dissect_ipxrip(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_)

{

  proto_tree  *rip_tree;

  proto_item  *ti, *hidden_item;

  uint16_t    operation, ticks;

  unsigned    cursor;

  unsigned    available_length;

  col_set_str(pinfo->cinfo, COL_PROTOCOL, "IPX RIP");

  col_clear(pinfo->cinfo, COL_INFO);

  operation = tvb_get_ntohs(tvb, 0);

  /* rip_types 0 and 1 are valid, anything else becomes 2 or "Unknown" */

  col_set_str(pinfo->cinfo, COL_INFO, val_to_str_const(operation, ipxrip_packet_vals, "Unknown"));

  if (tree) {

    ti = proto_tree_add_item(tree, proto_ipxrip, tvb, 0, -1, ENC_NA);

    rip_tree = proto_item_add_subtree(ti, ett_ipxrip);

    proto_tree_add_item(rip_tree, hf_ipxrip_packet_type, tvb, 0, 2, ENC_BIG_ENDIAN);

    switch(operation)

    {

    case IPX_RIP_REQUEST:

      hidden_item = proto_tree_add_boolean(rip_tree,

                 hf_ipxrip_request,

                 tvb, 0, 2, 1);

      proto_item_set_hidden(hidden_item);

      break;

    case IPX_RIP_RESPONSE:

      hidden_item = proto_tree_add_boolean(rip_tree,

                 hf_ipxrip_response,

                 tvb, 0, 2, 1);

      proto_item_set_hidden(hidden_item);

      break;

    }

    available_length = tvb_reported_length(tvb);

    for (cursor =  2; cursor < available_length; cursor += 8) {

      ticks = tvb_get_ntohs(tvb, cursor+6);

      proto_tree_add_item(rip_tree, hf_ipxrip_route_vector, tvb, cursor, 4, ENC_NA);

      proto_tree_add_item(rip_tree, hf_ipxrip_hops, tvb, cursor+4, 2, ENC_BIG_ENDIAN);

      if (operation == IPX_RIP_REQUEST - 1) {

        proto_tree_add_item(rip_tree, hf_ipxrip_ticks, tvb, cursor+6, 2, ENC_BIG_ENDIAN);

      }

      else {

        proto_tree_add_uint_format_value(rip_tree, hf_ipxrip_ticks, tvb, cursor+6, 2, ticks,

          "%d ms", ticks * 1000 / 18);

      }

    }

  }

  return tvb_captured_length(tvb);

}

/* ================================================================= */

/* IPX Serialization                                                 */

/* ================================================================= */

static int

dissect_serialization(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_)

{

  proto_tree  *ser_tree = NULL;

  proto_item  *ti;

  col_set_str(pinfo->cinfo, COL_PROTOCOL, "NW_SERIAL");

  col_clear(pinfo->cinfo, COL_INFO);

  if (tree) {

    ti = proto_tree_add_item(tree, proto_serialization, tvb, 0, -1,

        ENC_NA);

    ser_tree = proto_item_add_subtree(ti, ett_serialization);

  }

  col_add_fstr(pinfo->cinfo, COL_INFO, "Serial number %s",

        tvb_bytes_to_str(pinfo->pool, tvb, 0, 6));

  proto_tree_add_item(ser_tree, hf_serial_number, tvb, 0, 6, ENC_NA);

  return tvb_captured_length(tvb);

}

/*

 * Some of these are from ncpfs, others are from the book,

 * others are from the page at

 *

 *  http://www.iana.org/assignments/novell-sap-numbers

 *

 * and some from the page at

 *

 *  http://www.rware.demon.co.uk/ipxsap.htm

 *

 * (see also the page at

 *

 *  http://developer.novell.com/research/appnotes/1998/february/03/06.htm

 *

 * which has a huge list - but many of the entries list only the

 * organization owning the SAP type, not what the type is for).

 */

static const value_string novell_server_vals[] = {

  { 0x0000, "Unknown" },

  { 0x0001, "User" },

  { 0x0002, "User Group" },

  { 0x0003, "Print Queue or Print Group" },

  { 0x0004, "File Server (SLIST source)" },

  { 0x0005, "Job Server" },

  { 0x0006, "Gateway" },

  { 0x0007, "Print Server or Silent Print Server" },

  { 0x0008, "Archive Queue" },

  { 0x0009, "Archive Server" },

  { 0x000a, "Job Queue" },

  { 0x000b, "Administration" },

  { 0x000F, "Novell TI-RPC" },

  { 0x0017, "Diagnostics" },

  { 0x0020, "NetBIOS" },

  { 0x0021, "NAS SNA Gateway" },

  { 0x0023, "NACS Async Gateway or Asynchronous Gateway" },

  { 0x0024, "Remote Bridge or Routing Service" },

  { 0x0026, "Bridge Server or Asynchronous Bridge Server" },

  { 0x0027, "TCP/IP Gateway Server" },

  { 0x0028, "Point to Point (Eicon) X.25 Bridge Server" },

  { 0x0029, "Eicon 3270 Gateway" },

  { 0x002a, "CHI Corp" },

  { 0x002c, "PC Chalkboard" },

  { 0x002d, "Time Synchronization Server or Asynchronous Timer" },

  { 0x002e, "ARCserve 5.0 / Palindrome Backup Director 4.x (PDB4)" },

  { 0x0045, "DI3270 Gateway" },

  { 0x0047, "Advertising Print Server" },

  { 0x004a, "NetBlazer Modems" },

  { 0x004b, "Btrieve VAP/NLM 5.0" },

  { 0x004c, "NetWare SQL VAP/NLM Server" },

  { 0x004d, "Xtree Network Version/NetWare XTree" },

  { 0x0050, "Btrieve VAP 4.11" },

  { 0x0052, "QuickLink (Cubix)" },

  { 0x0053, "Print Queue User" },

  { 0x0058, "Multipoint X.25 Eicon Router" },

  { 0x0060, "STLB/NLM" },

  { 0x0064, "ARCserve" },

  { 0x0066, "ARCserve 3.0" },

  { 0x0072, "WAN Copy Utility" },

  { 0x007a, "TES-NetWare for VMS" },

  { 0x0092, "WATCOM Debugger or Emerald Tape Backup Server" },

  { 0x0095, "DDA OBGYN" },

  { 0x0098, "NetWare Access Server (Asynchronous gateway)" },

  { 0x009a, "NetWare for VMS II or Named Pipe Server" },

  { 0x009b, "NetWare Access Server" },

  { 0x009e, "Portable NetWare Server or SunLink NVT" },

  { 0x00a1, "Powerchute APC UPS NLM" },

  { 0x00aa, "LAWserve" },

  { 0x00ac, "Compaq IDA Status Monitor" },

  { 0x0100, "PIPE STAIL" },

  { 0x0102, "LAN Protect Bindery" },

  { 0x0103, "Oracle DataBase Server" },

  { 0x0107, "NetWare 386 or RSPX Remote Console" },

  { 0x010f, "Novell SNA Gateway" },

  { 0x0111, "Test Server" },

  { 0x0112, "Print Server (HP)" },

  { 0x0114, "CSA MUX (f/Communications Executive)" },

  { 0x0115, "CSA LCA (f/Communications Executive)" },

  { 0x0116, "CSA CM (f/Communications Executive)" },

  { 0x0117, "CSA SMA (f/Communications Executive)" },

  { 0x0118, "CSA DBA (f/Communications Executive)" },

  { 0x0119, "CSA NMA (f/Communications Executive)" },

  { 0x011a, "CSA SSA (f/Communications Executive)" },

  { 0x011b, "CSA STATUS (f/Communications Executive)" },

  { 0x011e, "CSA APPC (f/Communications Executive)" },

  { 0x0126, "SNA TEST SSA Profile" },

  { 0x012a, "CSA TRACE (f/Communications Executive)" },

  { 0x012b, "NetWare for SAA" },

  { 0x012e, "IKARUS virus scan utility" },

  { 0x0130, "Communications Executive" },

  { 0x0133, "NNS Domain Server or NetWare Naming Services Domain" },

  { 0x0135, "NetWare Naming Services Profile" },

  { 0x0137, "NetWare 386 Print Queue or NNS Print Queue" },

  { 0x0141, "LAN Spool Server (Vap, Intel)" },

  { 0x0152, "IRMALAN Gateway" },

  { 0x0154, "Named Pipe Server" },

  { 0x0166, "NetWare Management" },