/* packet-wai.c

 * Routines for WAI packet dissection

 * Based on: WAPI ISO submission - ISO/IEC JTC 1 N 9880 [ref: 1]

 *           chapter "8.1.4 WAI protocol"

 *

 * Written by Lukasz Kotasa <lukasz.kotasa@tieto.com>

 *            Lukasz Suchy  <lukasz.suchy@tieto.com>

 * Copyright 2010, Tieto.

 *

 * Wireshark - Network traffic analyzer

 * By Gerald Combs <gerald@wireshark.org>

 * Copyright 1998 Gerald Combs

 *

 * SPDX-License-Identifier: GPL-2.0-or-later

 */

/* Protocol reference:

 * http://isotc.iso.org/livelink/livelink?func=ll&objId=8500308&objAction=Open&ei=nt-RTKe1IJKTjAeepLS8BQ&usg=AFQjCNEn8hlU_SfoAGkM-X48JL_BL8bptA&sig2=JOHNPrqgCMO4q0cWhAfkow

 * (chapter: 8.1.4. WAI protocol)

 */

#include "config.h"

#include <epan/packet.h>

#include <epan/etypes.h>

#include <epan/reassemble.h>

#include <epan/tfs.h>

#include <wsutil/array.h>

#define WAI_SUB_PRE_AUTHENTICATION      0x01    /* pre-authentication start */

#define WAI_SUB_STAKEY_REQ              0x02    /* STAKey request */

#define WAI_SUB_AUTH_ACTIVATION         0x03    /* authentication activation */

#define WAI_SUB_ACCESS_AUTH_REQ         0x04    /* access authentication request */

#define WAI_SUB_ACCESS_AUTH_RESP        0x05    /* access authentication response */

#define WAI_SUB_CERT_AUTH_REQ           0x06    /* certificate authentication request */

#define WAI_SUB_CERT_AUTH_RESP          0x07    /* certificate authentication response */

#define WAI_SUB_UNICAST_KEY_REQ         0x08    /* unicast key negotiation request */

#define WAI_SUB_UNICAST_KEY_RESP        0x09    /* unicast key negotiation response */

#define WAI_SUB_UNICAST_KEY_CONFIRM     0x0A    /* unicast key negotiation confirmation */

#define WAI_SUB_MULTICAST_ANNOUNCE      0x0B    /* multicast key/STAKey announcement */

#define WAI_SUB_MULTICAST_ANNOUNCE_RESP 0x0C    /* multicast key/STAKey announcement response */

#define FLAG_BIT0       0x01

#define FLAG_BIT1       0x02

#define FLAG_BIT2       0x04

#define FLAG_BIT3       0x08

#define FLAG_BIT4       0x10

#define FLAG_BIT5       0x20

#define FLAG_BIT6       0x40

#define FLAG_BIT7       0x80

void proto_register_wai(void);

void proto_reg_handoff_wai(void);

static reassembly_table wai_reassembly_table;

static dissector_handle_t wai_handle;

static int proto_wai;

static int hf_wai_version;

static int hf_wai_type;

static int hf_wai_subtype;

static int hf_wai_reserved;

static int hf_wai_length;

static int hf_wai_seq;

static int hf_wai_fragm_seq;

static int hf_wai_flag;

static int hf_wai_data;

static int hf_wai_bk_rekeying_flag;

static int hf_wai_preauthentication_flag;

static int hf_wai_certificate_flag;

static int hf_wai_optional_flag;

static int hf_wai_usk_rekeying_flag;

static int hf_wai_negotiation_flag;

static int hf_wai_revoking_flag;

static int hf_wai_reserved_flag;

static int hf_wai_attr_type;

static int hf_wai_cert;

static int hf_wai_cert_id;

static int hf_wai_cert_data;

static int hf_wai_cert_len;

static int hf_wai_addid;

static int hf_wai_ae_mac;

static int hf_wai_asue_mac;

static int hf_wai_bkid;

static int hf_wai_uskid;

static int hf_wai_wie;

static int hf_wai_message_auth_code;

static int hf_wai_mskid;

static int hf_wai_data_pack_num;

static int hf_wai_key_data;

static int hf_wai_key_data_len;

static int hf_wai_key_data_content;

static int hf_wai_key_ann_id;

static int hf_wai_auth_id;

static int hf_wai_identity;

static int hf_wai_identity_id;

static int hf_wai_identity_len;

static int hf_wai_identity_data;

static int hf_wai_ecdh;

static int hf_wai_ecdh_id;

static int hf_wai_ecdh_len;

static int hf_wai_ecdh_content;

static int hf_wai_counter;

static int hf_wai_sta_key_id;

static int hf_wai_challenge;

static int hf_wai_cert_ver;

static int hf_wai_nonce;

static int hf_wai_ver_res;

static int hf_wai_sign_alg;

static int hf_wai_hash_alg_id;

static int hf_wai_sign_alg_id;

static int hf_wai_param;

static int hf_wai_param_id;

static int hf_wai_param_content;

static int hf_wai_sign_val;

static int hf_wai_sign_content;

static int hf_wai_sign;

static int hf_wai_identity_list;

static int hf_wai_reserved_byte;

static int hf_wai_no_of_ids;

static int hf_wai_access_res;

static int hf_wai_fragments;

static int hf_wai_fragment;

static int hf_wai_fragment_overlap;

static int hf_wai_fragment_overlap_conflicts;

static int hf_wai_fragment_multiple_tails;

static int hf_wai_fragment_too_long_fragment;

static int hf_wai_fragment_error;

static int hf_wai_fragment_count;

static int hf_wai_reassembled_in;

static int hf_wai_reassembled_length;

static int ett_wai;

static int ett_wai_data;

static int ett_wai_flags;

static int ett_wai_certificate;

static int ett_wai_mac;

static int ett_wai_identity;

static int ett_wai_key_data;

static int ett_wai_ecdh_param;

static int ett_wai_certificate_verification;

static int ett_wai_identity_list;

static int ett_wai_sign;

static int ett_wai_sign_alg;

static int ett_wai_sign_val;

static int ett_wai_parameter;

static int ett_wai_fragment;

static int ett_wai_fragments;

static const value_string wai_type_names [] = {

    { 1, "WAI protocol package"},

    { 0, NULL }

};

static const value_string wai_attr_type_names [] = {

    { 1, "Signature"},

    { 2, "Certificate Authentication Result"},

    { 3, "Identity List"},

    { 0, NULL }

};

static const value_string wai_ver_res_names [] = {

    { 0, "Certificate is valid" },

    { 1, "Certificate issuer is unknown"},

    { 2, "Root certificate is untrusted"},

    { 3, "Certificate time is invalid"},

    { 4, "Certificate signature is invalid"},

    { 5, "Certificate is revoked"},

    { 6, "Certificate is not valid in its proposed usage"},

    { 7, "Certificate revocation state is unknown"},

    { 8, "Certificate has an unknown error"},

    { 0, NULL }

};

static const value_string wai_access_res_names [] = {

    { 0, "Success" },

    { 1, "Unidentified certificate"},

    { 2, "Certificate Error"},

    { 3, "Prohibited by AE"},

    { 0, NULL }

};

static const fragment_items wai_frag_items = {

    /* Fragment subtrees */

    &ett_wai_fragment,

    &ett_wai_fragments,

    /* Fragment fields */

    &hf_wai_fragments,

    &hf_wai_fragment,

    &hf_wai_fragment_overlap,

    &hf_wai_fragment_overlap_conflicts,

    &hf_wai_fragment_multiple_tails,

    &hf_wai_fragment_too_long_fragment,

    &hf_wai_fragment_error,

    &hf_wai_fragment_count,

    /* Reassembled in field */

    &hf_wai_reassembled_in,

    /* Reassembled length field */

    &hf_wai_reassembled_length,

    /* Reassembled data field */

    NULL,

    /* Tag */

    "Message fragments"

};

static const value_string wai_subtype_names[] = {

    {  WAI_SUB_PRE_AUTHENTICATION,      "Pre-Authentication start" },

    {  WAI_SUB_STAKEY_REQ,              "STAKey request" },

    {  WAI_SUB_AUTH_ACTIVATION,         "Authentication activation" },

    {  WAI_SUB_ACCESS_AUTH_REQ,         "Access authentication request" },

    {  WAI_SUB_ACCESS_AUTH_RESP,        "Access authentication response" },

    {  WAI_SUB_CERT_AUTH_REQ,           "Certificate authentication request" },

    {  WAI_SUB_CERT_AUTH_RESP,          "Certificate authentication response" },

    {  WAI_SUB_UNICAST_KEY_REQ,         "Unicast key negotiation request" },

    {  WAI_SUB_UNICAST_KEY_RESP,        "Unicast key negotiation response" },

    {  WAI_SUB_UNICAST_KEY_CONFIRM,     "Unicast key negotiation confirmation" },

    {  WAI_SUB_MULTICAST_ANNOUNCE,      "Multicast key/STAKey announcement" },

    {  WAI_SUB_MULTICAST_ANNOUNCE_RESP, "Multicast key/STAKey announcement response" },

    { 0, NULL }

};

static value_string_ext wai_subtype_names_ext = VALUE_STRING_EXT_INIT(wai_subtype_names);

static const true_false_string wai_bk_rekeying_flag = {

    "Packet is a BK rekeying packet",

    "Packet is not a BK rekeying packet"

};

static const true_false_string wai_preauthentication_flag = {

    "Packet is a pre-authentication packet",

    "Packet is not a pre-authentication packet"

};

static const true_false_string  wai_certificate_flag = {

    "STA requires to verify the peers certificate",

    "STA doesn't require to verify the peers certificate"

};

static const true_false_string  wai_optional_flag = {

    "There are some optional fields in packet",

    "No optional fields in packet"

};

static const true_false_string  wai_usk_rekeying_flag = {

    "Packet is a USK rekeying packet",

    "Packet is not a USK rekeying packet"

};

static const true_false_string  wai_negotiation_flag = {

    "Packet is a STAKey negotiation packet",

    "Packet is not a STAKey negotiation packet"

};

static const true_false_string  wai_revoking_flag = {

    "STA delete a STAKey",

    "STA doesn't delete a STAKey"

};

static const true_false_string  wai_reserved_flag = {

    "reserved 1",

    "reserved 0"

};

static void

dissect_flag(tvbuff_t *tvb, unsigned offset, proto_tree *tree)

{

    proto_item *flag_item;

    proto_tree *flag_tree;

    flag_item = proto_tree_add_item(tree, hf_wai_flag, tvb, offset, 1, ENC_BIG_ENDIAN);

    flag_tree = proto_item_add_subtree (flag_item, ett_wai_flags);

    proto_tree_add_item (flag_tree, hf_wai_bk_rekeying_flag,       tvb, offset, 1, ENC_BIG_ENDIAN);

    proto_tree_add_item (flag_tree, hf_wai_preauthentication_flag, tvb, offset, 1, ENC_BIG_ENDIAN);

    proto_tree_add_item (flag_tree, hf_wai_certificate_flag,       tvb, offset, 1, ENC_BIG_ENDIAN);

    proto_tree_add_item (flag_tree, hf_wai_optional_flag,          tvb, offset, 1, ENC_BIG_ENDIAN);

    proto_tree_add_item (flag_tree, hf_wai_usk_rekeying_flag,      tvb, offset, 1, ENC_BIG_ENDIAN);

    proto_tree_add_item (flag_tree, hf_wai_negotiation_flag,       tvb, offset, 1, ENC_BIG_ENDIAN);

    proto_tree_add_item (flag_tree, hf_wai_revoking_flag,          tvb, offset, 1, ENC_BIG_ENDIAN);

    proto_tree_add_item (flag_tree, hf_wai_reserved_flag,          tvb, offset, 1, ENC_BIG_ENDIAN);

}

inline static void

dissect_bkid(tvbuff_t *tvb, unsigned offset, proto_tree *tree)

{

    proto_tree_add_item(tree, hf_wai_bkid, tvb, offset, 16, ENC_NA);

}

inline static void

dissect_uskid(tvbuff_t *tvb, unsigned offset, proto_tree *tree)

{

    proto_tree_add_item(tree, hf_wai_uskid, tvb, offset, 1, ENC_NA);

}

inline static void dissect_wie(tvbuff_t *tvb, unsigned offset, unsigned length, proto_tree *tree)

{

    proto_tree_add_item(tree, hf_wai_wie, tvb, offset, length, ENC_NA);

}

inline static void

dissect_message_auth_code(tvbuff_t *tvb, unsigned offset, proto_tree *tree)

{

    proto_tree_add_item(tree, hf_wai_message_auth_code, tvb, offset, 20, ENC_NA);

}

inline static void

dissect_mskid(tvbuff_t *tvb, unsigned offset, proto_tree *tree)

{

    proto_tree_add_item(tree, hf_wai_mskid, tvb, offset, 1, ENC_NA);

}

inline static void

dissect_key_announcement_identifier(tvbuff_t *tvb, unsigned offset, proto_tree *tree)

{

    proto_tree_add_item(tree, hf_wai_key_ann_id, tvb, offset, 16, ENC_NA);

}

inline static void

dissect_counter(tvbuff_t *tvb, unsigned offset, proto_tree *tree)

{

    proto_tree_add_item(tree, hf_wai_counter, tvb, offset, 16, ENC_NA);

}

inline static void

dissect_authentication_id(tvbuff_t *tvb, unsigned offset, proto_tree *tree)

{

    proto_tree_add_item(tree, hf_wai_auth_id, tvb, offset, 32, ENC_NA);

}

static void

dissect_addid(tvbuff_t *tvb, unsigned offset, proto_tree *tree)

{

    proto_item *mac_item;

    proto_tree *mac_tree;

    mac_item = proto_tree_add_string(tree, hf_wai_addid, tvb, offset, 12, "AE MAC and ASUE MAC addresses");

    mac_tree = proto_item_add_subtree(mac_item, ett_wai_mac);

    proto_tree_add_item(mac_tree, hf_wai_ae_mac,   tvb, offset,   6, ENC_NA);

    proto_tree_add_item(mac_tree, hf_wai_asue_mac, tvb, offset+6, 6, ENC_NA);

}

static uint16_t

dissect_identity(tvbuff_t * tvb, const uint16_t offset, proto_tree * tree,

   const char * const label)

{

    proto_tree *id_tree;

    proto_item *id_item;

    uint16_t    length;

    length = tvb_get_ntohs(tvb, offset+2);

    id_item = proto_tree_add_item(tree, hf_wai_identity, tvb, offset, length+4, ENC_NA);

    id_tree = proto_item_add_subtree(id_item, ett_wai_identity);

    proto_item_set_text(id_item, "%sIdentity", ((label==NULL)?"":label));

    proto_tree_add_item(id_tree, hf_wai_identity_id,   tvb, offset,   2, ENC_BIG_ENDIAN);

    proto_tree_add_item(id_tree, hf_wai_identity_len,  tvb, offset+2, 2, ENC_BIG_ENDIAN);

    proto_tree_add_item(id_tree, hf_wai_identity_data, tvb, offset+4, length, ENC_NA);

    return length + 4;

}

static int16_t

dissect_certificate(tvbuff_t * tvb, const int offset, proto_tree * tree,

                    const char * const label)

{

    proto_item  *certificate_item;

    proto_tree  *certificate_tree;

    proto_item  *id_item;

    uint16_t     length;

    uint16_t     id;

    const char *id_name = "unknown";

    id = tvb_get_ntohs(tvb, offset);

    if (id == 1) {

        id_name = "X.509 v3";

    } else if (id == 2){

        id_name = "GBW";

    }

    length = tvb_get_ntohs(tvb, offset+2);

    certificate_item = proto_tree_add_item(tree, hf_wai_cert, tvb, offset, length+4, ENC_NA);

    proto_item_set_text(certificate_item, "%sCertificate",  ((label==NULL)?"":label));

    certificate_tree = proto_item_add_subtree(certificate_item, ett_wai_certificate);

    id_item = proto_tree_add_item(certificate_tree, hf_wai_cert_id, tvb, offset, 2, ENC_BIG_ENDIAN);

    proto_item_set_text(id_item, "Certificate Identifier: %s (%#x)", id_name, id);

    proto_tree_add_item(certificate_tree, hf_wai_cert_len,  tvb, offset+2, 2, ENC_BIG_ENDIAN);

    proto_tree_add_item(certificate_tree, hf_wai_cert_data, tvb, offset+4, length, ENC_NA);

    return length + 4;

}

static uint16_t

dissect_ecdh_parameter(tvbuff_t * tvb, const int offset, proto_tree * tree)

{

    proto_item  *ecdh_item;

    proto_tree  *ecdh_tree;

    proto_item  *ecdh_id_item;

    uint8_t      ecdh_id;

    uint16_t     ecdh_len;

    const char *id_name = "unknown";

    ecdh_id = tvb_get_uint8(tvb, offset);

    if (ecdh_id == 1) {

        id_name = "OID";

    } else if (ecdh_id == 2) {

        id_name = "Detailed parameter";

    }

    ecdh_len = tvb_get_ntohs(tvb, offset+1);

    ecdh_item = proto_tree_add_item(tree, hf_wai_ecdh,  tvb, offset, ecdh_len+3, ENC_NA);

    ecdh_tree = proto_item_add_subtree(ecdh_item, ett_wai_ecdh_param);

    ecdh_id_item = proto_tree_add_item(ecdh_tree, hf_wai_ecdh_id, tvb, offset, 1, ENC_BIG_ENDIAN);

    proto_item_set_text(ecdh_id_item, "ID: %s (%#x)", id_name, ecdh_id);

    proto_tree_add_item(ecdh_tree, hf_wai_ecdh_len,     tvb, offset+1, 2, ENC_BIG_ENDIAN);

    proto_tree_add_item(ecdh_tree, hf_wai_ecdh_content, tvb, offset+3, ecdh_len, ENC_NA);

    return ecdh_len + 3;

}

static uint16_t

dissect_challenge(tvbuff_t *tvb, unsigned offset, proto_tree *tree, const char * const label)

{

    proto_item    *challenge_item;

    const uint16_t challenge_length = 32;

    challenge_item = proto_tree_add_item(tree, hf_wai_challenge, tvb, offset, 32, ENC_NA);

    proto_item_append_text(challenge_item, "(%schallenge)",  ((label==NULL)?"":label));

    return challenge_length;

}

static uint16_t

dissect_key_data(tvbuff_t *tvb, unsigned offset, proto_tree *tree, const char *const label)

{

    proto_item  *key_data_item;

    proto_tree  *key_data_tree;

    uint8_t     length;

    length = tvb_get_uint8(tvb, offset);

    key_data_item = proto_tree_add_item(tree, hf_wai_key_data, tvb, offset, length+1, ENC_NA);

    proto_item_set_text(key_data_item, "%sKey Data", ((label==NULL)?"":label));

    key_data_tree = proto_item_add_subtree(key_data_item, ett_wai_key_data);

    proto_tree_add_item(key_data_tree, hf_wai_key_data_len, tvb, offset, 1, ENC_BIG_ENDIAN);

    if (length > 0) {

        proto_tree_add_item(key_data_tree, hf_wai_key_data_content, tvb, offset+1, length, ENC_NA);

    }

    return length + 1;

}

static unsigned

dissect_multiple_certificate(tvbuff_t * tvb, unsigned offset, proto_tree *tree)

{

    proto_item *multicert_item;

    proto_tree *multicert_tree;

    proto_item *nonce_1_item;

    proto_item *nonce_2_item;

    unsigned    length;

    length = tvb_get_ntohs(tvb, offset+1);

    multicert_item = proto_tree_add_item(tree, hf_wai_cert_ver, tvb, offset, length+3, ENC_NA);

    multicert_tree = proto_item_add_subtree(multicert_item, ett_wai_certificate_verification);

    proto_tree_add_item(multicert_tree, hf_wai_attr_type, tvb, offset, 1, ENC_BIG_ENDIAN);

    offset += 1;

    proto_tree_add_item(multicert_tree, hf_wai_length, tvb, offset, 2, ENC_BIG_ENDIAN);

    offset += 2;

    nonce_1_item = proto_tree_add_item(multicert_tree, hf_wai_nonce, tvb, offset, 32, ENC_NA);

    offset += 32;

    proto_item_append_text(nonce_1_item, " 1");

    nonce_2_item = proto_tree_add_item(multicert_tree, hf_wai_nonce, tvb, offset, 32, ENC_NA);

    offset += 32;

    proto_item_append_text(nonce_2_item, " 2");

    proto_tree_add_item(multicert_tree, hf_wai_ver_res, tvb, offset, 1, ENC_BIG_ENDIAN);

    offset += 1;

    offset += dissect_certificate(tvb, offset, multicert_tree, "1 ");

    proto_tree_add_item(multicert_tree, hf_wai_ver_res, tvb, offset, 1, ENC_BIG_ENDIAN);

    offset += 1;

    dissect_certificate(tvb, offset, multicert_tree, "2 ");

    return length + 3;

}

static unsigned

dissect_identity_list(tvbuff_t *tvb, unsigned offset, proto_tree *tree)

{

    proto_item *id_list_item;

    proto_tree *id_list_tree;

    uint16_t    length;

    uint16_t    no_of_ids;

    uint16_t    i;

    length = tvb_get_ntohs(tvb, offset+1);

    id_list_item = proto_tree_add_item(tree, hf_wai_identity_list, tvb, offset, length+3, ENC_NA);

    id_list_tree = proto_item_add_subtree(id_list_item, ett_wai_identity_list);

    proto_tree_add_item(id_list_tree, hf_wai_attr_type, tvb, offset, 1, ENC_BIG_ENDIAN);

    offset += 1;

    proto_tree_add_item(id_list_tree, hf_wai_length, tvb, offset, 2, ENC_BIG_ENDIAN);

    offset += 2;

    proto_tree_add_item(id_list_tree, hf_wai_reserved_byte, tvb, offset, 1, ENC_BIG_ENDIAN);

    offset += 1;

    proto_tree_add_item_ret_uint16(id_list_tree, hf_wai_no_of_ids, tvb, offset, 2, ENC_BIG_ENDIAN, &no_of_ids);

    offset += 2;

    for(i=0; i < no_of_ids; i++) {

        char number[6] = {0};

        snprintf(number, 6, "%d", i);

        offset += dissect_identity(tvb, offset, id_list_tree, number);

    }

    return length + 3;

}

static uint16_t

dissect_signature_algorithm(tvbuff_t *tvb, unsigned offset, proto_tree *tree)

{

    proto_item *sa_item;

    proto_tree *sa_tree;

    proto_item *param_item;

    proto_tree *param_tree;

    proto_item *alg_name_item;

    proto_item *sig_name_item;

    uint16_t    length;

    uint8_t     alg_id;

    uint8_t     sig_id;

    uint16_t    param_len;

    length  = tvb_get_ntohs(tvb, offset);

    sa_item = proto_tree_add_item(tree, hf_wai_sign_alg, tvb, offset,  length+2, ENC_NA);

    sa_tree = proto_item_add_subtree(sa_item, ett_wai_sign_alg);

    proto_tree_add_item(sa_tree, hf_wai_length, tvb, offset, 2, ENC_BIG_ENDIAN);

    offset += 2;

    alg_name_item = proto_tree_add_item_ret_uint8(sa_tree, hf_wai_hash_alg_id, tvb, offset, 1, ENC_BIG_ENDIAN, &alg_id);

    if (1 == alg_id) {

        proto_item_set_text(alg_name_item, "Algorithm Identifier: SHA-256  (0x01)");

    }

    offset += 1;

    sig_name_item = proto_tree_add_item_ret_uint8(sa_tree, hf_wai_sign_alg_id, tvb, offset, 1, ENC_BIG_ENDIAN, &sig_id);

    if (1 == sig_id) {

        proto_item_set_text(sig_name_item, "Signature Algorithm Identifier: ECDSA-192  (0x01)");

    }

    offset += 1;

    param_len  = tvb_get_ntohs(tvb, offset+1);

    param_item = proto_tree_add_item(sa_tree, hf_wai_param, tvb, offset,  param_len+3, ENC_NA);

    param_tree = proto_item_add_subtree(param_item, ett_wai_parameter);

    proto_tree_add_item(param_tree, hf_wai_param_id, tvb, offset, 1, ENC_NA);

    offset += 1;

    proto_tree_add_item(param_tree, hf_wai_length, tvb, offset, 2, ENC_BIG_ENDIAN);

    offset += 2;

    proto_tree_add_item(param_tree, hf_wai_param_content, tvb, offset, param_len, ENC_NA);

    return length + 2;

}

static uint16_t

dissect_signature_value(tvbuff_t *tvb, unsigned offset, proto_tree *tree)

{

    proto_item *sv_item;

    proto_tree *sv_tree;

    uint16_t    length = 0;

    length  = tvb_get_ntohs(tvb, offset);

    sv_item = proto_tree_add_item(tree, hf_wai_sign_val, tvb, offset,  length+2, ENC_NA);

    sv_tree = proto_item_add_subtree(sv_item, ett_wai_sign_val);

    proto_tree_add_item(sv_tree, hf_wai_length, tvb, offset, 2, ENC_BIG_ENDIAN);

    offset += 2;

    proto_tree_add_item(sv_tree, hf_wai_sign_content, tvb, offset, length, ENC_NA);

    return length + 2;

}

static uint16_t

dissect_signature(tvbuff_t *tvb, unsigned offset, proto_tree *tree, const char *const label)

{

    proto_item *ss_item;

    proto_tree *ss_tree;

    unsigned    length = 0;

    length  = tvb_get_ntohs(tvb, offset+1);

    ss_item = proto_tree_add_item(tree, hf_wai_sign, tvb, offset, length+3, ENC_NA);

    proto_item_set_text(ss_item, "%s", (label==NULL)?"Signature":label);

    ss_tree = proto_item_add_subtree(ss_item, ett_wai_sign);

    proto_tree_add_item(ss_tree, hf_wai_attr_type, tvb, offset, 1, ENC_BIG_ENDIAN);

    offset += 1;

    proto_tree_add_item(ss_tree, hf_wai_length, tvb, offset, 2, ENC_BIG_ENDIAN);

    offset += 2;

    offset += dissect_identity(tvb, offset, ss_tree, NULL);

    offset += dissect_signature_algorithm(tvb, offset, ss_tree);

    dissect_signature_value(tvb, offset, ss_tree);

    return length + 3;

}

static void

dissect_wai_data(tvbuff_t *tvb, proto_tree *tree, uint8_t subtype, uint16_t lenx)

{

    proto_item  *data_item;

    proto_tree  *data_tree;

    const char *type_name;

    data_item = proto_tree_add_item(tree, hf_wai_data, tvb, 0, lenx, ENC_NA);

    data_tree = proto_item_add_subtree (data_item, ett_wai_data);

    type_name = val_to_str_ext_const(subtype, &wai_subtype_names_ext, "Unknown type");

    proto_item_set_text(data_item, "%s data (%d bytes)", type_name, lenx);

    switch (subtype) {

        case WAI_SUB_PRE_AUTHENTICATION:

        {

            /* Chapter 8.1.4.6 Preauthentication [ref: 1] */

            dissect_flag(tvb, 0, data_tree);

            dissect_uskid(tvb, 1, data_tree);

            dissect_addid(tvb, 2, data_tree);

            dissect_counter(tvb, 14, data_tree);

            dissect_message_auth_code(tvb, 30, data_tree);

            break;

        }

        case WAI_SUB_STAKEY_REQ:

        {

            /* Chapter 8.1.4.5 STAKey Establishment procedure [ref: 1] */

            dissect_flag(tvb, 0, data_tree);

            proto_tree_add_item(data_tree, hf_wai_sta_key_id, tvb, 1, 1, ENC_BIG_ENDIAN);

            dissect_uskid(tvb, 2, data_tree);

            dissect_addid(tvb, 3, data_tree);

            dissect_counter(tvb, 15, data_tree);

            dissect_message_auth_code(tvb, 31, data_tree);

            break;

        }

        case WAI_SUB_AUTH_ACTIVATION:

        {

            /* Chapter 8.1.4.2.1 WAI Authentication Activation  [ref: 1] */

            uint16_t offset = 0;

            dissect_flag(tvb, offset, data_tree);

            offset += 1;

            dissect_authentication_id(tvb, offset, data_tree);

            offset += 32;

            offset += dissect_identity(tvb, offset, data_tree, "Local ASU ");

            offset += dissect_certificate(tvb, offset, data_tree, "STE AE ");

            dissect_ecdh_parameter(tvb, offset, data_tree);

            break;

        }

        case WAI_SUB_ACCESS_AUTH_REQ:

        {

            /* Chapter 8.1.4.2.2 Access WAI Authentication Request  [ref: 1] */

            uint16_t offset = 0;

            uint8_t optional_field;

            optional_field = tvb_get_uint8(tvb, 0) & FLAG_BIT3;

            dissect_flag(tvb, offset, data_tree);

            offset += 1;

            dissect_authentication_id(tvb, offset, data_tree);

            offset += 32;

            offset += dissect_challenge(tvb, offset, data_tree, "ASUE ");

            offset += dissect_key_data(tvb, offset, data_tree, "ASUE ");

            offset += dissect_identity(tvb, offset, data_tree, "STA AE ");

            offset += dissect_certificate(tvb, offset, data_tree, "STA ASUE ");

            offset += dissect_ecdh_parameter(tvb, offset, data_tree);

            if (optional_field) {

                offset += dissect_identity_list(tvb, offset, data_tree);

            }

            dissect_signature(tvb, offset, data_tree, "ASUE Signature");

            break;

        }

        case WAI_SUB_ACCESS_AUTH_RESP:

        {

            /* Chapter 8.1.4.2.5 Access WAI Authentication Response  [ref: 1] */

            uint16_t offset = 0;

            uint8_t optional_field;

            optional_field = tvb_get_uint8(tvb, 0) & FLAG_BIT3;

            dissect_flag(tvb, offset, data_tree);

            offset += 1;

            offset += dissect_challenge(tvb, offset, data_tree, "ASUE ");

            offset += dissect_challenge(tvb, offset, data_tree, "AE ");

            proto_tree_add_item(data_tree, hf_wai_access_res, tvb, offset, 1, ENC_BIG_ENDIAN);

            offset += 1;

            offset += dissect_key_data(tvb, offset, data_tree, "ASUE ");

            offset += dissect_key_data(tvb, offset, data_tree, "AE ");

            offset += dissect_identity(tvb, offset, data_tree, "STA AE ");

            offset += dissect_identity(tvb, offset, data_tree, "STA ASUE ");

            if (optional_field) {

                unsigned  length = 0;

                offset += dissect_multiple_certificate(tvb, offset, data_tree);

                offset += dissect_signature(tvb, offset, data_tree, "Server Signature trusted by ASUE");

                length  = tvb_get_ntohs(tvb, offset+1);

                if (length + 3 + offset + 1 < lenx)

                    offset += dissect_signature(tvb, offset, data_tree, "Server Signature trusted by AE");

            }

            dissect_signature(tvb, offset, data_tree, "AE Signature");

            break;

        }

        case WAI_SUB_CERT_AUTH_REQ:

        {

            /* Chapter 8.1.4.2.3 Certificate Authentication Request  [ref: 1] */

            uint16_t offset = 0;

            uint8_t optional_field;

            optional_field = tvb_get_uint8(tvb, 0) & FLAG_BIT3;

            dissect_addid(tvb, offset, data_tree);

            offset += 12;

            offset += dissect_challenge(tvb, offset, data_tree, "AE ");

            offset += dissect_challenge(tvb, offset, data_tree, "ASUE ");

            offset += dissect_certificate(tvb, offset, data_tree, "STE ASUE ");

            offset += dissect_certificate(tvb, offset, data_tree, "STE AE ");

            if (optional_field) {

                dissect_identity_list(tvb, offset, data_tree);

            }

            break;

        }

        case WAI_SUB_CERT_AUTH_RESP:

        {

            /* Chapter 8.1.4.2.4 Certificate Authentication Response  [ref: 1] */

            uint16_t offset = 0;

            dissect_addid(tvb, offset, data_tree);

            offset += 12;

            offset += dissect_multiple_certificate(tvb, offset, data_tree);

            offset += dissect_signature(tvb, offset, data_tree, "Server Signature trusted by ASUE");

            if (offset < lenx)

                dissect_signature(tvb, offset, data_tree, "Server Signature trusted by AE");

            break;

        }

        case WAI_SUB_UNICAST_KEY_REQ:

        {

            /* Chapter 8.1.4.3.1 Unicast Key Negotiation Request [ref: 1] */

            dissect_flag(tvb, 0, data_tree);

            dissect_bkid(tvb, 1, data_tree);

            dissect_uskid(tvb, 17, data_tree);

            dissect_addid(tvb, 18, data_tree);

            dissect_challenge(tvb, 30, data_tree , "AE ");

            break;

        }

        case WAI_SUB_UNICAST_KEY_RESP:

        {

            /* Chapter 8.1.4.3.2 Unicast Key Negotiation Response [ref: 1] */

            tvbuff_t *next_tvb;

            unsigned  length = 0;

            dissect_flag(tvb, 0, data_tree);

            dissect_bkid(tvb, 1, data_tree);

            dissect_uskid(tvb, 17, data_tree);

            dissect_addid(tvb, 18, data_tree);

            dissect_challenge(tvb, 30, data_tree, "ASUE ");

            dissect_challenge(tvb, 62, data_tree, "AE ");

            next_tvb = tvb_new_subset_remaining(tvb, 96);

            length = tvb_reported_length(next_tvb);

            dissect_wie(next_tvb, 0, length-20, data_tree);

            dissect_message_auth_code(next_tvb, length-20, data_tree);

            break;

        }

        case WAI_SUB_UNICAST_KEY_CONFIRM:

        {

            /* Chapter 8.1.4.3.3 Unicast Key Negotiation Confirmation [ref: 1] */

            tvbuff_t *next_tvb;

            unsigned  length = 0;

            dissect_flag(tvb, 0, data_tree);

            dissect_bkid(tvb, 1, data_tree);

            dissect_uskid(tvb, 17, data_tree);

            dissect_addid(tvb, 18, data_tree);

            dissect_challenge(tvb, 30, data_tree, "ASUE ");

            next_tvb = tvb_new_subset_remaining(tvb, 62);

            length = tvb_reported_length(next_tvb);

            dissect_wie(next_tvb, 0, length-20, data_tree);

            dissect_message_auth_code(next_tvb, length-20, data_tree);

            break;

        }

        case WAI_SUB_MULTICAST_ANNOUNCE:

        {

            /* Chapter 8.1.4.4.1 Multicast Key/STAKey Announcement [ref: 1] */

            uint16_t offset = 0;

            dissect_flag(tvb, offset, data_tree);

            offset += 1;

            dissect_mskid(tvb, offset, data_tree);

            offset += 1;

            dissect_uskid(tvb, offset, data_tree);

            offset += 1;

            dissect_addid(tvb, offset, data_tree);

            offset += 12;

            proto_tree_add_item(data_tree, hf_wai_data_pack_num, tvb, offset, 16, ENC_NA);

            offset += 16;

            dissect_key_announcement_identifier(tvb, offset, data_tree);

            offset += 16;

            offset += dissect_key_data(tvb, offset, data_tree, NULL);

            dissect_message_auth_code(tvb, offset, data_tree);

            break;

        }

        case WAI_SUB_MULTICAST_ANNOUNCE_RESP:

        {

            /* Chapter 8.1.4.4.2 Multicast Key/STAKey Announcement Response [ref: 1] */

            dissect_flag(tvb,  0, data_tree);

            dissect_mskid(tvb, 1, data_tree);

            dissect_uskid(tvb, 2, data_tree);

            dissect_addid(tvb, 3, data_tree);

            dissect_key_announcement_identifier(tvb, 15, data_tree);

            dissect_message_auth_code(tvb, 31, data_tree);

            break;

        }

        default:

            break;

    }

}

static int

dissect_wai(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_)

{

/* Format of WAPI protocol packet in WAI authentication system

0      2      3         4         6         8        10        11      12

-------------------------------------------------------------------------------

| Ver. | Type | Subtype | Reserved | Length | packet  |  fragm. | flag | data |

|                                           | seq. no | seq. no |             |

|-----------------------------------------------------------------------------|

Figure 18 from [ref:1]

*/

#define WAI_MESSAGE_LENGTH 12   /*Length of all fields without 'Data' field*/

#define WAI_DATA_OFFSET    WAI_MESSAGE_LENGTH

    uint16_t       version;

    uint8_t        subtype;

    uint16_t       length;

    uint16_t       packet_num;

    uint8_t        fragment_num;

    uint8_t        flags;

    fragment_head *frag_msg;

    proto_tree    *wai_tree     = NULL;

    tvbuff_t      *next_tvb;

    tvbuff_t      *new_tvb;

    const char    *subtype_name = "Unknown type";

    length = tvb_get_ntohs(tvb, 6)-WAI_MESSAGE_LENGTH;

    subtype = tvb_get_uint8(tvb, 3);

    /* quick sanity check */

    if ((length != tvb_reported_length (tvb)-WAI_MESSAGE_LENGTH) ||

        (subtype > WAI_SUB_MULTICAST_ANNOUNCE_RESP)) {

        return 0;

    }

    col_set_str(pinfo->cinfo, COL_PROTOCOL, "WAI");

    col_clear(pinfo->cinfo, COL_INFO);

    version = tvb_get_ntohs(tvb, 0);

    if (version == 1) {

        subtype_name = val_to_str_ext_const(subtype, &wai_subtype_names_ext, "Unknown type");

    }

    col_append_str(pinfo->cinfo, COL_INFO, subtype_name);

    /* Field lengths and offsets in WAI protocol described above */

    packet_num   = tvb_get_ntohs(tvb, 8);

    fragment_num = tvb_get_uint8(tvb, 10);

    flags        = tvb_get_uint8(tvb, 11);

    if (tree) {

        proto_item *wai_item;

        wai_item = proto_tree_add_item(tree, proto_wai, tvb, 0, -1, ENC_NA);

        proto_item_set_text (wai_item, "WAI Protocol (%s)",

                                val_to_str_ext_const(subtype, &wai_subtype_names_ext, "Unknown type"));

        wai_tree = proto_item_add_subtree(wai_item, ett_wai);

        /* Field lengths and offsets in WAI protocol described above */

        proto_tree_add_item(wai_tree, hf_wai_version,   tvb, 0,  2, ENC_BIG_ENDIAN);

        proto_tree_add_item(wai_tree, hf_wai_type,      tvb, 2,  1, ENC_BIG_ENDIAN);

        proto_tree_add_item(wai_tree, hf_wai_subtype,   tvb, 3,  1, ENC_BIG_ENDIAN);

        proto_tree_add_item(wai_tree, hf_wai_reserved,  tvb, 4,  2, ENC_BIG_ENDIAN);

        proto_tree_add_item(wai_tree, hf_wai_length,    tvb, 6,  2, ENC_BIG_ENDIAN);

        proto_tree_add_item(wai_tree, hf_wai_seq,       tvb, 8,  2, ENC_BIG_ENDIAN);

        proto_tree_add_item(wai_tree, hf_wai_fragm_seq, tvb, 10, 1, ENC_BIG_ENDIAN);

        proto_tree_add_item(wai_tree, hf_wai_flag,      tvb, 11, 1, ENC_BIG_ENDIAN);

    }

    frag_msg =  fragment_add_seq_check (&wai_reassembly_table,

                                        tvb, WAI_DATA_OFFSET,

                                        pinfo,

                                        packet_num,

                                        NULL,

                                        fragment_num,

                                        length,

                                        flags);

    next_tvb = tvb_new_subset_remaining(tvb, WAI_DATA_OFFSET);

    /* Replace INFO column if message is fragmented and call data dissector */

    if (flags) {

        col_add_fstr(pinfo->cinfo, COL_INFO,

                     "Fragment (%d) of message, data not dissected", fragment_num);

        process_reassembled_data(tvb, WAI_DATA_OFFSET, pinfo,

                                 "Reassembled WAI", frag_msg, &wai_frag_items,

                                 NULL, wai_tree);

        call_data_dissector(next_tvb, pinfo, tree);

    } else {

        /* If this is the last fragment of fragmented message, then reassamble and dissect

           otherwise only dissect */

        if (fragment_num > 0) {

            new_tvb = process_reassembled_data(tvb, WAI_DATA_OFFSET, pinfo,

                                               "Reassembled WAI", frag_msg, &wai_frag_items,

                                               NULL, wai_tree);