/* packet-knxip.c

 * Routines for KNXnet/IP dissection

 * By Jan Kessler <kessler@ise.de>

 * Copyright 2004, Jan Kessler <kessler@ise.de>

 *

 * Wireshark - Network traffic analyzer

 * By Gerald Combs <gerald@wireshark.org>

 * Copyright 1998 Gerald Combs

 *

 * SPDX-License-Identifier: GPL-2.0-or-later

 */

/*

 * See

 *

 *    https://my.knx.org/en/shop/knx-specifications

 *

 * for the specifications.

 */

#include "config.h"

#include <stdlib.h>

#include <string.h>

#include <epan/packet.h>

#include <epan/expert.h>

#include <epan/proto.h>

#include <epan/prefs.h>

#include <epan/proto_data.h>

#include <epan/to_str.h>

#include <epan/tvbuff.h>

#include <epan/strutil.h>

#include <epan/unit_strings.h>

#include <epan/iana-info.h>

#include <wsutil/to_str.h>

#include "packet-tcp.h"

#include "packet-udp.h"

#include "packet-knxip.h"

#include "packet-knxip_decrypt.h"

#define KIP_DEFAULT_PORT_RANGE "3671" /* IANA-assigned (EIBnet aka KNXnet) */

/* Other ports are commonly used, especially 3672 by KNX IP Gateways, but

 * not registered.

 */

#define ECDH_PUBLIC_VALUE_SIZE  32

#define KIP_HDR_LEN 6

 /* The following service families are defined for the

 version 1.0 KNXnet/IP implementation of the eFCP protocol

 */

#define KIP_SERVICE_CORE  0x02

#define KIP_SERVICE_MANAGEMENT  0x03

#define KIP_SERVICE_TUNNELING  0x04

#define KIP_SERVICE_ROUTING  0x05

#define KIP_SERVICE_REMOTE_LOGGING  0x06

#define KIP_SERVICE_REMOTE_DIAG_AND_CONFIG  0x07

#define KIP_SERVICE_OBJECT_SERVER  0x08

#define KIP_SERVICE_SECURITY  0x09

 /* The service codes for the core services (device discovery,

 self description and connection management) as defined in

 chapter 2 of the KNXnet/IP system specification

 */

#define KIP_SEARCH_REQUEST  0x0201

#define KIP_SEARCH_RESPONSE  0x0202

#define KIP_DESCRIPTION_REQUEST  0x0203

#define KIP_DESCRIPTION_RESPONSE  0x0204

#define KIP_CONNECT_REQUEST  0x0205

#define KIP_CONNECT_RESPONSE  0x0206

#define KIP_CONNECTIONSTATE_REQUEST  0x0207

#define KIP_CONNECTIONSTATE_RESPONSE  0x0208

#define KIP_DISCONNECT_REQUEST  0x0209

#define KIP_DISCONNECT_RESPONSE  0x020A

#define KIP_SEARCH_REQUEST_EXT  0x020B

#define KIP_SEARCH_RESPONSE_EXT  0x020C

 /* The service codes for the device management services

 (tunneling of cEMI local management procedures) as

 defined in chapter 3 of the KNXnet/IP system specification

 */

#define KIP_CONFIGURATION_REQUEST  0x0310

#define KIP_CONFIGURATION_ACK  0x0311

 /* The service codes for the tunneling services

 (transport of cEMI frames from service interface) as

 defined in chapter 4 of the KNXnet/IP system specification

 */

#define KIP_TUNNELING_REQUEST  0x0420

#define KIP_TUNNELING_ACK  0x0421

#define KIP_TUNNELING_FEATURE_GET  0x0422

#define KIP_TUNNELING_FEATURE_RESPONSE  0x0423

#define KIP_TUNNELING_FEATURE_SET  0x0424

#define KIP_TUNNELING_FEATURE_INFO  0x0425

 /* The service codes for the routing services

 (transport of cEMI frames between EIB couplers) as

 defined in chapter 5 of the KNXnet/IP system specification

 */

#define KIP_ROUTING_INDICATION  0x0530

#define KIP_ROUTING_LOST_MESSAGE  0x0531

#define KIP_ROUTING_BUSY  0x0532

#define KIP_ROUTING_SYSTEM_BROADCAST  0x0533

 /* The service codes for RemoteDiagAndConfig

 */

#define KIP_REMOTE_DIAG_REQUEST  0x0740

#define KIP_REMOTE_DIAG_RESPONSE  0x0741

#define KIP_REMOTE_CONFIG_REQUEST  0x0742

#define KIP_REMOTE_RESET_REQUEST  0x0743

 /* The service codes for KNX-IP Secure

 */

#define KIP_SECURE_WRAPPER  0x0950

#define KIP_SESSION_REQUEST  0x0951

#define KIP_SESSION_RESPONSE  0x0952

#define KIP_SESSION_AUTHENTICATE  0x0953

#define KIP_SESSION_STATUS  0x0954

#define KIP_TIMER_NOTIFY  0x0955

 /* KNXnet/IP host protocols */

#define KIP_IPV4_UDP  0x01

#define KIP_IPV4_TCP  0x02

 /* The different types of DIBs (Description Information Blocks)

 for the KNXnet/IP Core Discovery and Description services

 as defined in chapter 1 of the KNXnet/IP system specification

 */

#define KIP_DIB_DEVICE_INFO  0x01

#define KIP_DIB_SUPP_SVC_FAMILIES  0x02

#define KIP_DIB_IP_CONFIG  0x03

#define KIP_DIB_CUR_CONFIG  0x04

#define KIP_DIB_KNX_ADDRESSES  0x05

#define KIP_DIB_SECURED_SERVICE_FAMILIES  0x06

#define KIP_DIB_TUNNELING_INFO  0x07

#define KIP_DIB_EXTENDED_DEVICE_INFO  0x08

#define KIP_DIB_MFR_DATA  0xFE

 /* The different types of SRPs (Search Request Parameter Blocks)

 for the KNXnet/IP Core Discovery and Description services

 */

#define KIP_SRP_BY_PROGMODE  0x01

#define KIP_SRP_BY_MACADDR  0x02

#define KIP_SRP_BY_SERVICE  0x03

#define KIP_SRP_REQUEST_DIBS  0x04

 /* The different KNX medium types for the hardware (device info)

 DIB as defined in AN033 Common EMI Specification

 */

#define KIP_KNXTYPE_TP0  0x01

#define KIP_KNXTYPE_TP1  0x02

#define KIP_KNXTYPE_PL110  0x04

#define KIP_KNXTYPE_PL132  0x08

#define KIP_KNXTYPE_RF  0x10

#define KIP_KNXTYPE_IP  0x20

 /* KNXnet/IP connection types */

#define KIP_DEVICE_MGMT_CONNECTION  0x03

#define KIP_TUNNEL_CONNECTION  0x04

#define KIP_REMLOG_CONNECTION  0x06

#define KIP_REMCONF_CONNECTION  0x07

#define KIP_OBJSVR_CONNECTION  0x08

 /* Tunneling v2 feature ids */

#define KIP_TUNNELING_FEATURE_ID_SUPPORTED_EMI_TYPE  0x01

#define KIP_TUNNELING_FEATURE_ID_HOST_DEVICE_DEVICE_DESCRIPTOR_TYPE_0  0x02

#define KIP_TUNNELING_FEATURE_ID_BUS_CONNECTION_STATUS 0x03

#define KIP_TUNNELING_FEATURE_ID_KNX_MANUFACTURER_CODE 0x04

#define KIP_TUNNELING_FEATURE_ID_ACTIVE_EMI_TYPE 0x05

#define KIP_TUNNELING_FEATURE_ID_INDIVIDUAL_ADDRESS 0x06

#define KIP_TUNNELING_FEATURE_ID_MAX_APDU_LENGTH 0x07

#define KIP_TUNNELING_FEATURE_ID_INFO_SERVICE_ENABLE 0x08

 /* KNXnet/IP tunnel types */

#define TUNNEL_LINKLAYER  0x02

#define TUNNEL_RAW  0x04

#define TUNNEL_BUSMONITOR  0x80

 /* KNXnet/IP error codes */

#define KIP_E_NO_ERROR  0x00

#define KIP_E_CONNECTION_ID  0x21

#define KIP_E_CONNECTION_TYPE  0x22

#define KIP_E_CONNECTION_OPTION  0x23

#define KIP_E_NO_MORE_CONNECTIONS  0x24

#define KIP_E_NO_MORE_UNIQUE_CONNECTIONS  0x25

#define KIP_E_DATA_CONNECTION  0x26

#define KIP_E_KNX_CONNECTION  0x27

#define KIP_E_TUNNELING_LAYER  0x29

/* KNXnet/IP remote selection types */

#define SELECT_PROGMODE  0x01

#define SELECT_MACADDRESS  0x02

/* SESSION_STATUS codes */

#define SESSION_STATUS_AUTHENTICATION_SUCCESS  0x00

#define SESSION_STATUS_AUTHENTICATION_FAILED  0x01

#define SESSION_STATUS_UNAUTHENTICATED  0x02

#define SESSION_STATUS_TIMEOUT  0x03

#define SESSION_STATUS_KEEPALIVE  0x04

#define SESSION_STATUS_CLOSE  0x05

/* Initialize the protocol identifier that is needed for the

 protocol hook and to register the fields in the protocol tree

*/

static int proto_knxip;

/* Initialize the registered fields identifiers. These fields

 will be registered with the protocol during initialization.

 Protocol fields are like type definitions. The protocol dissector

 later on adds items of these types to the protocol tree.

*/

static int hf_bytes;

static int hf_folder;

static int hf_knxip_header_length;

static int hf_knxip_protocol_version;

static int hf_knxip_service_id;

static int hf_knxip_service_family;

static int hf_knxip_service_type;

static int hf_knxip_total_length;

static int hf_knxip_structure_length;

static int hf_knxip_host_protocol;

static int hf_knxip_ip_address;

static int hf_knxip_port;

static int hf_knxip_description_type;

static int hf_knxip_knx_medium;

static int hf_knxip_knx_medium_flags_ip;

static int hf_knxip_knx_medium_flags_rf;

static int hf_knxip_knx_medium_flags_pl132;

static int hf_knxip_knx_medium_flags_pl110;

static int hf_knxip_knx_medium_flags_tp1;

static int hf_knxip_knx_medium_flags_tp0;

static int hf_knxip_device_status;

static int hf_knxip_program_mode;

static int hf_knxip_knx_address;

static int hf_knxip_knx_tunnel_usable;

static int hf_knxip_knx_tunnel_authorized;

static int hf_knxip_knx_tunnel_free;

static int hf_knxip_project_id;

static int hf_knxip_project_number;

static int hf_knxip_installation_number;

static int hf_knxip_serial_number;

static int hf_knxip_multicast_address;

static int hf_knxip_mac_address;

static int hf_knxip_friendly_name;

static int hf_knxip_service_version;

static int hf_knxip_security_version;

static int hf_knxip_manufacturer_code;

static int hf_knxip_connection_type;

static int hf_knxip_knx_layer;

static int hf_knxip_reserved;

static int hf_knxip_channel;

static int hf_knxip_status;

static int hf_knxip_seq_counter;

static int hf_knxip_ip_subnet;

static int hf_knxip_ip_gateway;

static int hf_knxip_ip_assign;

static int hf_knxip_ip_assign_auto;

static int hf_knxip_ip_assign_dhcp;

static int hf_knxip_ip_assign_bootp;

static int hf_knxip_ip_assign_manual;

static int hf_knxip_ip_caps;

static int hf_knxip_ip_dhcp;

static int hf_knxip_ip_caps_auto;

static int hf_knxip_ip_caps_dhcp;

static int hf_knxip_ip_caps_bootp;

static int hf_knxip_tunnel_feature;

static int hf_knxip_routing_loss;

static int hf_knxip_busy_time;

static int hf_knxip_busy_control;

static int hf_knxip_selector;

static int hf_knxip_max_apdu_length;

static int hf_knxip_medium_status;

static int hf_knxip_mask_version;

static int hf_knxip_srp_mandatory;

static int hf_knxip_srp_type;

static int hf_knxip_reset_command;

static int hf_knxip_session;

static int hf_knxip_tag;

static int hf_knxip_user;

static int hf_knxip_session_status;

/* Initialize the subtree pointers. These pointers are needed to

 display the protocol in a structured tree. Subtrees hook on

 already defined fields or (the topmost) on the protocol itself

*/

static int ett_kip;

static int ett_efcp;

static int ett_service;

static int ett_hpai;

static int ett_dib;

static int ett_medium;

static int ett_status;

static int ett_projectid;

static int ett_service_family;

static int ett_ip_assignment;

static int ett_cri;

static int ett_crd;

static int ett_cnhdr;

static int ett_loss;

static int ett_busy;

static int ett_selector;

static int ett_decrypted;

static int ett_tunnel;

/* Set up the value_string tables for the service families

 and the service types (note that the service types in KNXnet/IP

 version 1.0 are unique even across service families...)

*/

static const value_string knxip_service_family_vals[] = {

  { KIP_SERVICE_CORE, "Core" },

  { KIP_SERVICE_MANAGEMENT, "Device Management" },

  { KIP_SERVICE_TUNNELING, "Tunneling" },

  { KIP_SERVICE_ROUTING, "Routing" },

  { KIP_SERVICE_REMOTE_LOGGING, "Remote Logging" },

  { KIP_SERVICE_REMOTE_DIAG_AND_CONFIG, "Remote Diag And Config" },

  { KIP_SERVICE_OBJECT_SERVER, "Object Server" },

  { KIP_SERVICE_SECURITY, "Security" },

  { 0, NULL}

};

static const value_string knxip_service_type_vals[] = {

  { KIP_SEARCH_REQUEST, "Search Request" },

  { KIP_SEARCH_RESPONSE, "Search Response" },

  { KIP_DESCRIPTION_REQUEST, "Description Request" },

  { KIP_DESCRIPTION_RESPONSE, "Description Response" },

  { KIP_CONNECT_REQUEST, "Connect Request" },

  { KIP_CONNECT_RESPONSE, "Connect Response" },

  { KIP_CONNECTIONSTATE_REQUEST, "Connection State Request" },

  { KIP_CONNECTIONSTATE_RESPONSE, "Connection State Response" },

  { KIP_DISCONNECT_REQUEST, "Disconnect Request" },

  { KIP_DISCONNECT_RESPONSE, "Disconnect Response" },

  { KIP_SEARCH_REQUEST_EXT, "Search Request Extended" },

  { KIP_SEARCH_RESPONSE_EXT, "Search Response Extended" },

  { KIP_CONFIGURATION_REQUEST, "Configuration Request" },

  { KIP_CONFIGURATION_ACK, "Configuration Acknowledgement" },

  { KIP_TUNNELING_REQUEST, "Tunneling Request" },

  { KIP_TUNNELING_ACK, "Tunneling Acknowledgement" },

  { KIP_TUNNELING_FEATURE_GET, "Tunneling Feature Get" },

  { KIP_TUNNELING_FEATURE_RESPONSE, "Tunneling Feature Response" },

  { KIP_TUNNELING_FEATURE_SET, "Tunneling Feature Set" },

  { KIP_TUNNELING_FEATURE_INFO, "Tunneling Feature Info" },

  { KIP_ROUTING_INDICATION, "Routing Indication" },

  { KIP_ROUTING_LOST_MESSAGE, "Routing Loss" },

  { KIP_ROUTING_BUSY, "Routing Busy" },

  { KIP_ROUTING_SYSTEM_BROADCAST, "Routing System Broadcast" },

  { KIP_REMOTE_DIAG_REQUEST, "Remote Diagnostic Request" },

  { KIP_REMOTE_DIAG_RESPONSE, "Remote Diagnostic Response" },

  { KIP_REMOTE_CONFIG_REQUEST, "Remote Configuration Request" },

  { KIP_REMOTE_RESET_REQUEST, "Remote Reset Request" },

  { KIP_SECURE_WRAPPER, "Secure Wrapper" },

  { KIP_SESSION_REQUEST, "Session Request" },

  { KIP_SESSION_RESPONSE, "Session Response" },

  { KIP_SESSION_AUTHENTICATE, "Session Authenticate" },

  { KIP_SESSION_STATUS, "Session Status" },

  { KIP_TIMER_NOTIFY, "Timer Notify" },

  { 0, NULL}

};

static const value_string svc_vals[] = {  /* abbreviated service names */

  { KIP_SEARCH_REQUEST, "SearchReq" },

  { KIP_SEARCH_RESPONSE, "SearchResp" },

  { KIP_DESCRIPTION_REQUEST, "DescrReq" },

  { KIP_DESCRIPTION_RESPONSE, "DescrResp" },

  { KIP_CONNECT_REQUEST, "ConnectReq" },

  { KIP_CONNECT_RESPONSE, "ConnectResp" },

  { KIP_CONNECTIONSTATE_REQUEST, "ConnStateReq" },

  { KIP_CONNECTIONSTATE_RESPONSE, "ConnStateResp" },

  { KIP_DISCONNECT_REQUEST, "DisconnectReq" },

  { KIP_DISCONNECT_RESPONSE, "DisconnectResp" },

  { KIP_SEARCH_REQUEST_EXT, "SearchReqExt" },

  { KIP_SEARCH_RESPONSE_EXT, "SearchRespExt" },

  { KIP_CONFIGURATION_REQUEST, "ConfigReq" },

  { KIP_CONFIGURATION_ACK, "ConfigAck" },

  { KIP_TUNNELING_REQUEST, "TunnelReq" },

  { KIP_TUNNELING_ACK, "TunnelAck" },

  { KIP_TUNNELING_FEATURE_GET, "TunnelFeatureGet" },

  { KIP_TUNNELING_FEATURE_RESPONSE, "TunnelFeatureResp" },

  { KIP_TUNNELING_FEATURE_SET, "TunnelFeatureSet" },

  { KIP_TUNNELING_FEATURE_INFO, "TunnelFeatureInfo" },

  { KIP_ROUTING_INDICATION, "RoutingInd" },

  { KIP_ROUTING_LOST_MESSAGE, "RoutingLoss" },

  { KIP_ROUTING_BUSY, "RoutingBusy" },

  { KIP_ROUTING_SYSTEM_BROADCAST, "RoutingSBC" },

  { KIP_REMOTE_DIAG_REQUEST, "RemoteDiagReq" },

  { KIP_REMOTE_DIAG_RESPONSE, "RemoteDiagResp" },

  { KIP_REMOTE_CONFIG_REQUEST, "RemoteConfigReq" },

  { KIP_REMOTE_RESET_REQUEST, "RemoteResetReq" },

  { KIP_SECURE_WRAPPER, "SecureWrapper" },

  { KIP_SESSION_REQUEST, "SessionReq" },

  { KIP_SESSION_RESPONSE, "SessionResp" },

  { KIP_SESSION_AUTHENTICATE, "SessionAuth" },

  { KIP_SESSION_STATUS, "SessionStatus" },

  { KIP_TIMER_NOTIFY, "TimerNotify" },

  { 0, NULL}

};

static const value_string host_protocol_vals[] = {

  { KIP_IPV4_UDP, "IPv4 UDP" },

  { KIP_IPV4_TCP, "IPv4 TCP" },

  { 0, NULL}

};

static const value_string description_type_vals[] = {

  { KIP_DIB_DEVICE_INFO, "Device Information" },

  { KIP_DIB_SUPP_SVC_FAMILIES, "Supported Service Families" },

  { KIP_DIB_IP_CONFIG, "IP Configuration" },

  { KIP_DIB_CUR_CONFIG, "Current Configuration" },

  { KIP_DIB_KNX_ADDRESSES, "KNX Addresses" },

  { KIP_DIB_SECURED_SERVICE_FAMILIES, "Secured Service Families" },

  { KIP_DIB_TUNNELING_INFO, "Tunneling Information" },

  { KIP_DIB_EXTENDED_DEVICE_INFO, "Extended Device Information" },

  { KIP_DIB_MFR_DATA, "Manufacturer Data" },

  { 0, NULL}

};

static const value_string descr_type_vals[] = {  /* abbreviated DIB names */

  { KIP_DIB_DEVICE_INFO, "DevInfo" },

  { KIP_DIB_SUPP_SVC_FAMILIES, "SuppSvc" },

  { KIP_DIB_IP_CONFIG, "IpConfig" },

  { KIP_DIB_CUR_CONFIG, "CurConfig" },

  { KIP_DIB_KNX_ADDRESSES, "KnxAddr" },

  { KIP_DIB_SECURED_SERVICE_FAMILIES, "SecSvcFam" },

  { KIP_DIB_TUNNELING_INFO, "TunnelInfo" },

  { KIP_DIB_EXTENDED_DEVICE_INFO, "ExtDevInfo" },

  { KIP_DIB_MFR_DATA, "MfrData" },

  { 0, NULL}

};

#if 0

static const value_string search_request_parameter_type_vals[] = {

  { KIP_SRP_BY_PROGMODE, "By programming mode" },

  { KIP_SRP_BY_MACADDR, "By MAC address" },

  { KIP_SRP_BY_SERVICE, "By service" },

  { KIP_SRP_REQUEST_DIBS, "Request DIBs" },

  { 0, NULL }

};

#endif

static const value_string srp_type_vals[] = {  /* abbreviated SRP names */

  { KIP_SRP_BY_PROGMODE, "ProgMode" },

  { KIP_SRP_BY_MACADDR, "MacAddr" },

  { KIP_SRP_BY_SERVICE, "Service" },

  { KIP_SRP_REQUEST_DIBS, "Dibs" },

  { 0, NULL }

};

static const value_string medium_type_vals[] = {

  { KIP_KNXTYPE_TP0, "TP0" },

  { KIP_KNXTYPE_TP1, "TP1" },

  { KIP_KNXTYPE_PL110, "PL110" },

  { KIP_KNXTYPE_PL132, "PL132" },

  { KIP_KNXTYPE_RF, "RF" },

  { KIP_KNXTYPE_IP, "IP" },

  { 0, NULL}

};

static const value_string connection_type_vals[] = {

  { KIP_DEVICE_MGMT_CONNECTION, "Device Management Connection" },

  { KIP_TUNNEL_CONNECTION, "Tunneling Connection" },

  { KIP_REMLOG_CONNECTION, "Remote Logging Connection" },

  { KIP_REMCONF_CONNECTION, "Remote Configuration Connection" },

  { KIP_OBJSVR_CONNECTION, "Object Server Connection" },

  { 0, NULL}

};

static const value_string conn_type_vals[] = {

  { KIP_DEVICE_MGMT_CONNECTION, "Config" },

  { KIP_TUNNEL_CONNECTION, "Tunnel" },

  { KIP_REMLOG_CONNECTION, "RemoteLogging" },

  { KIP_REMCONF_CONNECTION, "RemoteConfig" },

  { KIP_OBJSVR_CONNECTION, "ObjectServer" },

  { 0, NULL }

};

static const value_string tunneling_feature_id_vals[] = {

  { KIP_TUNNELING_FEATURE_ID_SUPPORTED_EMI_TYPE, "SupportedEmiType" },

  { KIP_TUNNELING_FEATURE_ID_HOST_DEVICE_DEVICE_DESCRIPTOR_TYPE_0, "MaskVersion" },

  { KIP_TUNNELING_FEATURE_ID_BUS_CONNECTION_STATUS, "BusStatus" },

  { KIP_TUNNELING_FEATURE_ID_KNX_MANUFACTURER_CODE, "Manufacturer" },

  { KIP_TUNNELING_FEATURE_ID_ACTIVE_EMI_TYPE, "ActiveEmiType" },

  { KIP_TUNNELING_FEATURE_ID_INDIVIDUAL_ADDRESS, "IndividualAddress" },

  { KIP_TUNNELING_FEATURE_ID_MAX_APDU_LENGTH, "MaxApduLength" },

  { KIP_TUNNELING_FEATURE_ID_INFO_SERVICE_ENABLE, "InfoServiceEnable" },

  { 0, NULL }

};

static const value_string knx_layer_vals[] = {

  { TUNNEL_LINKLAYER, "LinkLayer" },

  { TUNNEL_RAW, "Raw" },

  { TUNNEL_BUSMONITOR, "Busmonitor" },

  { 0, NULL}

};

static const value_string error_vals[] = {

  { KIP_E_NO_ERROR, "OK" },

  { KIP_E_CONNECTION_ID, "E_CONNECTION_ID" },

  { KIP_E_CONNECTION_TYPE, "E_CONNECTION_TYPE" },

  { KIP_E_CONNECTION_OPTION, "E_CONNECTION_OPTION" },

  { KIP_E_NO_MORE_CONNECTIONS, "E_NO_MORE_CONNECTIONS" },

  { KIP_E_NO_MORE_UNIQUE_CONNECTIONS, "E_NO_MORE_UNIQUE_CONNECTIONS" },

  { KIP_E_DATA_CONNECTION, "E_DATA_CONNECTION" },

  { KIP_E_KNX_CONNECTION, "E_KNX_CONNECTION" },

  { KIP_E_TUNNELING_LAYER, "E_TUNNELING_LAYER" },

  { 0, NULL}

};

static const value_string session_status_vals[] = {

  { SESSION_STATUS_AUTHENTICATION_SUCCESS, "STATUS_AUTHENTICATION_SUCCESS" },

  { SESSION_STATUS_AUTHENTICATION_FAILED, "STATUS_AUTHENTICATION_FAILED" },

  { SESSION_STATUS_UNAUTHENTICATED, "STATUS_UNAUTHENTICATED" },

  { SESSION_STATUS_TIMEOUT, "STATUS_TIMEOUT" },

  { SESSION_STATUS_KEEPALIVE, "STATUS_KEEPALIVE" },

  { SESSION_STATUS_CLOSE, "STATUS_CLOSE" },

  { 0, NULL }

};

static int* const knx_ip_assign_flags[] = {

  &hf_knxip_ip_assign_auto,

  &hf_knxip_ip_assign_dhcp,

  &hf_knxip_ip_assign_bootp,

  &hf_knxip_ip_assign_manual,

  NULL

};

uint8_t knxip_error;

uint8_t knxip_host_protocol;

expert_field ei_knxip_error;

expert_field ei_knxip_warning;

static bool pref_desegment = true;

static const char* pref_key_texts[ MAX_KNX_DECRYPTION_KEYS ];

//static const char* authentication_code_text;

//static const char* password_hash_text;

static const char* pref_key_file_name;

static const char* pref_key_file_pwd;

static const char* pref_key_info_file_name;

/* KNX decryption keys

*/

uint8_t knx_decryption_keys[ MAX_KNX_DECRYPTION_KEYS ][ KNX_KEY_LENGTH ];

uint8_t knx_decryption_key_count;

/* Forward declarations

*/

static int dissect_knxip( tvbuff_t* tvb, packet_info* pinfo, proto_tree* tree, void* data _U_ );

void proto_reg_handoff_knxip( void );

void proto_register_knxip( void );

/* Add raw data to list view, tree view, and parent folder

*/

static proto_item* knxip_tree_add_data( proto_tree* tree, tvbuff_t* tvb, int offset, int length, column_info* cinfo, proto_item* item,

  const char* name, const char* text1, const char* text2 )

{

  proto_item* new_item = proto_tree_add_bytes_format( tree, hf_bytes, tvb, offset, length, NULL, "%s: $", name );

  if( text1 ) col_append_str( cinfo, COL_INFO, text1 );

  if( text2 ) proto_item_append_text( item, "%s", text2 );

  while( length > 0 )

  {

    uint8_t value = tvb_get_uint8( tvb, offset );

    if( text1 ) col_append_fstr( cinfo, COL_INFO, "%02X", value );

    if( text2 ) proto_item_append_text( item, "%02X", value );

    proto_item_append_text( new_item, " %02X", value );

    offset++;

    length--;

  }

  return new_item;

}

/* Show unknown or unexpected data

*/

static proto_item* knxip_tree_add_unknown_data( proto_tree* tree, tvbuff_t* tvb, int offset, int length )

{

  return proto_tree_add_bytes_format( tree, hf_bytes, tvb, offset, length, NULL, "? Unknown data (%d bytes)", length );

}

static uint8_t hex_to_knx_key( const char* text, uint8_t key[ KNX_KEY_LENGTH ] )

{

  size_t n_bytes = 0;

  uint8_t* bytes = convert_string_to_hex( text, &n_bytes );

  if( bytes == NULL )

  {

    n_bytes = 0;

  }

  else

  {

    if( n_bytes )

    {

      if( n_bytes > KNX_KEY_LENGTH ) n_bytes = KNX_KEY_LENGTH;

      if( n_bytes ) memcpy( key, bytes, n_bytes );

      while( n_bytes < KNX_KEY_LENGTH ) key[ n_bytes++ ] = 0;

    }

    g_free( bytes );

  }

  return n_bytes != 0;

}

static proto_item* knxip_tree_add_status( proto_tree* tree, tvbuff_t* tvb, int offset )

{

  return proto_tree_add_item( tree, hf_knxip_status, tvb, offset, 1, ENC_BIG_ENDIAN );

}

static proto_item* knxip_tree_add_reserved( proto_tree* tree, tvbuff_t* tvb, int offset, packet_info* pinfo, uint8_t* p_ok )

{

  proto_item* new_item = proto_tree_add_item( tree, hf_knxip_reserved, tvb, offset, 1, ENC_BIG_ENDIAN );

  if( tvb_get_uint8( tvb, offset ) )

  {

    proto_item_prepend_text( new_item, "? " );

    expert_add_info_format( pinfo, new_item, KIP_ERROR, "Expected: 0x00" );

    if( p_ok ) *p_ok = 0;

  }

  return new_item;

}

static proto_item* knxip_tree_add_missing_reserved( proto_tree* tree, tvbuff_t* tvb, int offset, packet_info* pinfo )

{

  proto_item* new_item = proto_tree_add_expert_format( tree, pinfo, KIP_ERROR, tvb, offset, 0, "? Reserved: expected 1 byte" );

  return new_item;

}

static void knxip_item_illegal_length( proto_item* length_item, packet_info* pinfo, const char* info )

{

  proto_item_prepend_text( length_item, "? " );

  expert_add_info_format( pinfo, length_item, KIP_ERROR, "%s", info );

}

static proto_item* knxip_tree_add_knx_address( proto_tree* tree, int hfindex, tvbuff_t* tvb, int offset, char** output, wmem_allocator_t* output_scope )

{

  uint16_t value = tvb_get_ntohs( tvb, offset );

  *output = wmem_strdup_printf(output_scope, "%u.%u.%u", (value >> 12) & 0xF, (value >> 8) & 0xF, value & 0xFF);

  proto_item* new_item = proto_tree_add_item( tree, hfindex, tvb, offset, 2, ENC_BIG_ENDIAN );

  proto_item_append_text( new_item, " = %s", *output);

  return new_item;

}

/* Dissect HPAI field

*/

static uint8_t dissect_hpai( tvbuff_t* tvb, packet_info* pinfo, proto_item* item, proto_tree* tree, int* p_offset, uint8_t* p_ok, char* name, uint8_t check_protocol )

{

  uint8_t ok = 1;

  int offset = *p_offset;

  int remaining_len = tvb_captured_length_remaining( tvb, offset );

  uint8_t struct_len = (remaining_len <= 0) ? 0 : tvb_get_uint8( tvb, offset );

  int eff_struct_len = (struct_len <= remaining_len) ? struct_len : remaining_len;

  proto_item* hpai_item = proto_tree_add_none_format( tree, hf_folder, tvb, offset, eff_struct_len, "HPAI %s Endpoint", name );

  wmem_strbuf_t* info = wmem_strbuf_new(pinfo->pool, "???");

  if( struct_len <= 0 )

  {

    proto_item_prepend_text( hpai_item, "Missing " );

    expert_add_info_format( pinfo, hpai_item, KIP_ERROR, "Expected: 8 bytes" );

    ok = 0;

  }

  else

  {

    /* 1 byte Structure Length */

    proto_tree* hpai_tree = proto_item_add_subtree( hpai_item, ett_hpai );

    proto_item* length_item = proto_tree_add_uint( hpai_tree, hf_knxip_structure_length, tvb, offset, 1, struct_len);

    proto_item* node;

    int end_pos = offset + eff_struct_len;

    offset++;

    if( struct_len != 8 )

    {

      knxip_item_illegal_length( length_item, pinfo, "Expected: 8 bytes" );

      ok = 0;

    }

    if( struct_len > remaining_len )

    {

      expert_add_info_format( pinfo, length_item, KIP_ERROR, "Available: %u bytes", remaining_len );

      struct_len = (uint8_t) remaining_len;

      if( ok )

      {

        proto_item_prepend_text( length_item, "? " );

        ok = 0;

      }

    }

    else if( struct_len < 2 )

    {

      expert_add_info_format( pinfo, hpai_item, KIP_ERROR, "Missing 1 byte Host Protocol" );

      ok = 0;

    }

    else

    {

      /* 1 byte Host Protocol */

      uint8_t host_protocol = tvb_get_uint8( tvb, offset );

      const char* host_protocol_name = "???";

      uint8_t protocol_error = 0;

      node = proto_tree_add_item( hpai_tree, hf_knxip_host_protocol, tvb, offset, 1, ENC_BIG_ENDIAN );

      if( host_protocol == KIP_IPV4_UDP )

      {

        host_protocol_name = "UDP";

        if( check_protocol )

        {

          if( knxip_host_protocol != IP_PROTO_UDP && knxip_host_protocol != IP_PROTO_UDPLITE )

          {

            protocol_error = 1;

          }

        }

      }

      else if( host_protocol == KIP_IPV4_TCP )

      {

        host_protocol_name = "TCP";

        if( check_protocol )

        {

          if( knxip_host_protocol != IP_PROTO_TCP )

          {

            protocol_error = 1;

          }

        }

      }

      else

      {

        protocol_error = 2;

      }

      if( protocol_error )

      {

        proto_item_prepend_text( node, "? " );

        expert_add_info_format( pinfo, node, KIP_ERROR, (protocol_error == 1) ? "Wrong Host Protocol" : "Expected: 0x01 or 0x02" );

        ok = 0;

      }

      offset++;

      if( struct_len < 6 )

      {

        expert_add_info_format( pinfo, hpai_item, KIP_ERROR, "Missing 4 bytes IP Address" );

        ok = 0;

      }

      else

      {

        /* 4 bytes IP Address */

        ws_in4_addr addr_ipv4;

        node = proto_tree_add_item_ret_ipv4(hpai_tree, hf_knxip_ip_address, tvb, offset, 4, ENC_BIG_ENDIAN, &addr_ipv4);

        if( host_protocol == KIP_IPV4_TCP && addr_ipv4 != 0 )

        {

          proto_item_prepend_text( node, "? " );

          expert_add_info_format( pinfo, node, KIP_ERROR, "Expected: 0.0.0.0" );

          ok = 0;

        }

        offset += 4;

        info = wmem_strbuf_new(pinfo->pool, ip_addr_to_str(pinfo->pool, &addr_ipv4));

        wmem_strbuf_append_c(info, ':');

        if( struct_len < 8 )

        {

          expert_add_info_format( pinfo, hpai_item, KIP_ERROR, "Missing 2 bytes Port Number" );

          ok = 0;

        }

        else

        {

          /* 2 bytes Port Number */

          uint32_t port = tvb_get_ntohs( tvb, offset );

          node = proto_tree_add_item_ret_uint( hpai_tree, hf_knxip_port, tvb, offset, 2, ENC_BIG_ENDIAN, &port);

          wmem_strbuf_append_printf(info, "%u", port);

          if( host_protocol == KIP_IPV4_TCP && port != 0 )

          {

            proto_item_prepend_text( node, "? " );

            expert_add_info_format( pinfo, node, KIP_ERROR, "Expected: 0" );

            ok = 0;

          }

          offset += 2;

        }

      }

      if( offset < end_pos )

      {

        knxip_tree_add_unknown_data( hpai_tree, tvb, offset, end_pos - offset );

        ok = 0;

      }

      proto_item_append_text( hpai_item, ": %s %s", wmem_strbuf_get_str(info), host_protocol_name );

    }

  }

  col_append_fstr( pinfo->cinfo, COL_INFO, " @%s", wmem_strbuf_get_str(info));

  proto_item_append_text( item, ", %s @ %s", name, wmem_strbuf_get_str(info));

  if( !ok )

  {

    proto_item_prepend_text( hpai_item, "? " );

    if( p_ok ) *p_ok = 0;

  }

  *p_offset += struct_len;

  return struct_len;

}

/* Dissect CRI (= Connection Request Information)

*/

static uint8_t dissect_cri( tvbuff_t* tvb, packet_info* pinfo, proto_item* item, proto_tree* tree, int* p_offset, uint8_t* p_ok )

{

  int offset = *p_offset;

  int remaining_len = tvb_captured_length_remaining( tvb, offset );

  uint8_t struct_len = (remaining_len <= 0) ? 0 : tvb_get_uint8( tvb, offset );

  int eff_struct_len = (struct_len <= remaining_len) ? struct_len : remaining_len;

  proto_item* cri_item = proto_tree_add_none_format( tree, hf_folder, tvb, offset, eff_struct_len, "CRI" );

  uint8_t conn_type = 0;

  const char* conn_type_name = NULL;

  uint8_t ok = 0;

  char* extra_text = NULL;

  if( struct_len <= 0 )

  {

    proto_item_prepend_text( cri_item, "Missing " );

    expert_add_info_format( pinfo, cri_item, KIP_ERROR, "Expected: min 2 bytes" );

    //ok = 0;

  }

  else

  {

    proto_tree* cri_tree = proto_item_add_subtree( cri_item, ett_cri );

    proto_item* length_item = proto_tree_add_uint(cri_tree, hf_knxip_structure_length, tvb, offset, 1, struct_len);

    proto_item* type_item = NULL;

    uint8_t length_ok = 1;

    if( struct_len > remaining_len )

    {

      expert_add_info_format( pinfo, length_item, KIP_ERROR, "Available: %u bytes", remaining_len );

      struct_len = (uint8_t) remaining_len;

      //ok = 0;

      length_ok = 0;

    }

    if( struct_len < 2 )

    {

      expert_add_info_format( pinfo, cri_item, KIP_ERROR, "Missing 1 byte Connection Type" );

      //ok = 0;

    }

    else

    {

      conn_type = tvb_get_uint8( tvb, offset + 1 );

      type_item = proto_tree_add_item( cri_tree, hf_knxip_connection_type, tvb, offset + 1, 1, ENC_BIG_ENDIAN );

      conn_type_name = try_val_to_str( conn_type, connection_type_vals );

      if( !conn_type_name )

      {

        proto_item_prepend_text( type_item, "? " );

        expert_add_info_format( pinfo, type_item, KIP_ERROR, "Unknown" );

        //ok = 0;

        if( struct_len > 2 )

        {

          knxip_tree_add_unknown_data( cri_tree, tvb, offset + 2, struct_len - 2 );

        }

      }

      else

      {

        proto_item_append_text( cri_item, " %s", conn_type_name );

        ok = 1;

        switch( conn_type )

        {

        case KIP_DEVICE_MGMT_CONNECTION:

        case KIP_REMLOG_CONNECTION:

        case KIP_REMCONF_CONNECTION:

        case KIP_OBJSVR_CONNECTION:

          if( struct_len > 2 )

          {

            expert_add_info_format( pinfo, length_item, KIP_ERROR, "Expected: 2 bytes" );

            length_ok = 0;

            knxip_tree_add_unknown_data( cri_tree, tvb, offset + 2, struct_len - 2 );

            ok = 0;

          }

          break;

        case KIP_TUNNEL_CONNECTION:

          if( (struct_len != 4) && (struct_len != 6) )

          {

            expert_add_info_format( pinfo, length_item, KIP_ERROR, "Expected: 4 or 6 bytes" );

            length_ok = 0;

            ok = 0;

          }

          if( struct_len >= 3 )

          {

            uint8_t knx_layer = tvb_get_uint8( tvb, offset + 2 );

            const char* knx_layer_name = try_val_to_str( knx_layer, knx_layer_vals );

            proto_item* layer_item = proto_tree_add_item( cri_tree, hf_knxip_knx_layer, tvb, offset + 2, 1, ENC_BIG_ENDIAN );

            proto_item_append_text( cri_item, ", Layer: %s", knx_layer_name ? knx_layer_name : "Unknown" );

            if( !knx_layer_name )

            {

              proto_item_prepend_text( layer_item, "? " );

              expert_add_info_format( pinfo, layer_item, KIP_ERROR, "Expected: 0x02" );

              ok = 0;

            }

            if( struct_len < 4 )

            {

              expert_add_info_format( pinfo, cri_item, KIP_ERROR, "Missing Reserved byte" );

              ok = 0;

            }

            else

            {

              knxip_tree_add_reserved( cri_tree, tvb, offset + 3, pinfo, &ok );

            }

            if( struct_len >= 6 )

            {

              knxip_tree_add_knx_address( cri_tree, hf_knxip_knx_address, tvb, offset + 4, &extra_text, pinfo->pool );

            }

            if( struct_len > 6 )

            {

              knxip_tree_add_unknown_data( cri_tree, tvb, offset + 6, struct_len - 6 );

              ok = 0;

            }

          }

          break;

        }

      }

    }

    if( !length_ok )

    {

      proto_item_prepend_text( length_item, "? " );

    }

  }

  conn_type_name = try_val_to_str( conn_type, conn_type_vals );

  if( !conn_type_name )

  {

    ok = 0;

  }

  else

  {

    if( pinfo )

    {

      column_info* cinfo = pinfo->cinfo;

      col_prepend_fstr( cinfo, COL_INFO, "%s ", conn_type_name );

      if (extra_text != NULL)

      {

        col_append_fstr( cinfo, COL_INFO, ", %s", extra_text);

      }

    }

    proto_item_append_text( item, ", %s", conn_type_name );

    if (extra_text != NULL)

    {

      proto_item_append_text( item, ", %s", extra_text);

    }

  }

  if( !ok )

  {

    proto_item_prepend_text( cri_item, "? " );

    if( p_ok ) *p_ok = 0;

  }

  *p_offset += struct_len;

  return struct_len;

}

/* Dissect CRD (= Connection Response Data)

*/

static uint8_t dissect_crd( tvbuff_t* tvb, packet_info* pinfo, proto_item* item, proto_tree* tree, int* p_offset, uint8_t* p_ok )

{

  int offset = *p_offset;

  int remaining_len = tvb_captured_length_remaining( tvb, offset );

  uint8_t struct_len = (remaining_len <= 0) ? 0 : tvb_get_uint8( tvb, offset );

  int eff_struct_len = (struct_len <= remaining_len) ? struct_len : remaining_len;

  proto_item* crd_item = proto_tree_add_none_format( tree, hf_folder, tvb, offset, eff_struct_len, "CRD" );

  uint8_t conn_type = 0;

  const char* conn_type_name = NULL;

  uint8_t ok = 0;

  if( struct_len <= 0 )

  {

    proto_item_prepend_text( crd_item, "Missing " );

    expert_add_info_format( pinfo, crd_item, KIP_ERROR, "Expected: min 2 bytes" );

    //ok = 0;

  }

  else

  {

    proto_tree* crd_tree = proto_item_add_subtree( crd_item, ett_crd );

    proto_item* length_item = proto_tree_add_uint(crd_tree, hf_knxip_structure_length, tvb, offset, 1, struct_len);

    proto_item* type_item = NULL;

    uint8_t length_ok = 1;

    if( struct_len > remaining_len )

    {

      expert_add_info_format( pinfo, length_item, KIP_ERROR, "Available: %u bytes", remaining_len );

      struct_len = (uint8_t) remaining_len;

      //ok = 0;

      length_ok = 0;

    }

    if( struct_len < 2 )

    {

      expert_add_info_format( pinfo, crd_item, KIP_ERROR, "Missing 1 byte Connection Type" );

      //ok = 0;

    }

    else

    {

      conn_type = tvb_get_uint8( tvb, offset + 1 );

      type_item = proto_tree_add_item( crd_tree, hf_knxip_connection_type, tvb, offset + 1, 1, ENC_BIG_ENDIAN );

      conn_type_name = try_val_to_str( conn_type, connection_type_vals );

      if( !conn_type_name )

      {

        proto_item_prepend_text( type_item, "? " );

        expert_add_info_format( pinfo, type_item, KIP_ERROR, "Unknown" );

        //ok = 0;

        if( struct_len > 2 )

        {

          knxip_tree_add_unknown_data( crd_tree, tvb, offset + 2, struct_len - 2 );

        }

      }

      else

      {

        proto_item_append_text( crd_item, " %s", conn_type_name );

        ok = 1;

        switch( conn_type )

        {

        case KIP_DEVICE_MGMT_CONNECTION:

        case KIP_REMLOG_CONNECTION:

        case KIP_REMCONF_CONNECTION:

        case KIP_OBJSVR_CONNECTION:

          if( struct_len > 2 )

          {

            expert_add_info_format( pinfo, length_item, KIP_ERROR, "Expected: 2 bytes" );

            knxip_tree_add_unknown_data( crd_tree, tvb, offset + 2, struct_len - 2 );

            ok = 0;

            length_ok = 0;

          }

          break;

        case KIP_TUNNEL_CONNECTION:

          if( struct_len != 4 )

          {

            expert_add_info_format( pinfo, length_item, KIP_ERROR, "Expected: 4 bytes" );

            ok = 0;

            length_ok = 0;

          }

          if( struct_len < 4 )

          {

            expert_add_info_format( pinfo, crd_item, KIP_ERROR, "Missing 2 bytes KNX Address" );

            //ok = 0;

            if( struct_len > 2 )

            {

              knxip_tree_add_unknown_data( crd_tree, tvb, offset + 2, struct_len - 2 );

            }