Merge pull request #480 from jsebechlebsky/pptp_support

PPTP support (Enhanced GRE, PPP LCP, PPTP Control Connection)

scapy/config.py

@@ -391,7 +391,7 @@ contribs: a dict which can be used by contrib layers to store local configuratio
     geoip_city_ipv6 = '/usr/share/GeoIP/GeoIPCityv6.dat'
     load_layers = ["l2", "inet", "dhcp", "dns", "dot11", "gprs", "tls",
                    "hsrp", "inet6", "ir", "isakmp", "l2tp", "mgcp",
-                   "mobileip", "netbios", "netflow", "ntp", "ppp",
+                   "mobileip", "netbios", "netflow", "ntp", "ppp", "pptp",
                    "radius", "rip", "rtp", "skinny", "smb", "snmp",
                    "tftp", "x509", "bluetooth", "dhcp6", "llmnr",
                    "sctp", "vrrp", "ipsec", "lltd", "vxlan"]

scapy/layers/l2.py

@@ -968,6 +968,13 @@ class GRE(Packet):
                     ConditionalField(XIntField("key",None), lambda pkt:pkt.key_present==1),
                     ConditionalField(XIntField("seqence_number",None), lambda pkt:pkt.seqnum_present==1),
                     ]
+
+    @classmethod
+    def dispatch_hook(cls, _pkt=None, *args, **kargs):
+        if _pkt and struct.unpack("!H", _pkt[2:4])[0] == 0x880b:
+            return GRE_PPTP
+        return cls
+
     def post_build(self, p, pay):
         p += pay
         if self.chksum_present and self.chksum is None:
@@ -976,6 +983,37 @@ class GRE(Packet):
         return p
 
 
+class GRE_PPTP(GRE):
+
+    """
+    Enhanced GRE header used with PPTP
+    RFC 2637
+    """
+
+    name = "GRE PPTP"
+    fields_desc = [BitField("chksum_present", 0, 1),
+                   BitField("routing_present", 0, 1),
+                   BitField("key_present", 1, 1),
+                   BitField("seqnum_present", 0, 1),
+                   BitField("strict_route_source", 0, 1),
+                   BitField("recursion_control", 0, 3),
+                   BitField("acknum_present", 0, 1),
+                   BitField("flags", 0, 4),
+                   BitField("version", 1, 3),
+                   XShortEnumField("proto", 0x880b, ETHER_TYPES),
+                   ShortField("payload_len", None),
+                   ShortField("call_id", None),
+                   ConditionalField(XIntField("seqence_number", None), lambda pkt: pkt.seqnum_present == 1),
+                   ConditionalField(XIntField("ack_number", None), lambda pkt: pkt.acknum_present == 1)]
+
+    def post_build(self, p, pay):
+        p += pay
+        if self.payload_len is None:
+            pay_len = len(pay)
+            p = p[:4] + chr((pay_len >> 8) & 0xff) + chr(pay_len & 0xff) + p[6:]
+        return p
+
+
 ### *BSD loopback layer
 
 class LoIntEnumField(EnumField):

scapy/layers/ppp.py

@@ -11,13 +11,13 @@ PPP (Point to Point Protocol)
 
 import struct
 from scapy.packet import Packet, bind_layers
-from scapy.layers.l2 import Ether, CookedLinux
+from scapy.layers.l2 import Ether, CookedLinux, GRE_PPTP
 from scapy.layers.inet import IP
 from scapy.layers.inet6 import IPv6
 from scapy.fields import BitField, ByteEnumField, ByteField, \
-    ConditionalField, FieldLenField, IPField, PacketListField, \
-    ShortEnumField, ShortField, StrFixedLenField, StrLenField, XByteField, \
-    XShortField
+    ConditionalField, FieldLenField, IntField, IPField, LenField, \
+    PacketListField, PacketField, ShortEnumField, ShortField, \
+    StrFixedLenField, StrLenField, XByteField, XShortField
 
 
 class PPPoE(Packet):
@@ -339,6 +339,220 @@ class PPP_ECP(Packet):
                     FieldLenField("len" , None, fmt="H", length_of="options", adjust=lambda p,x:x+4 ),
                     PacketListField("options", [],  PPP_ECP_Option, length_from=lambda p:p.len-4,) ]
 
+### Link Control Protocol (RFC 1661)
+
+_PPP_lcptypes = {1: "Configure-Request",
+                 2: "Configure-Ack",
+                 3: "Configure-Nak",
+                 4: "Configure-Reject",
+                 5: "Terminate-Request",
+                 6: "Terminate-Ack",
+                 7: "Code-Reject",
+                 8: "Protocol-Reject",
+                 9: "Echo-Request",
+                10: "Echo-Reply",
+                11: "Discard-Request"}
+
+
+class PPP_LCP(Packet):
+    name = "PPP Link Control Protocol"
+    fields_desc = [ByteEnumField("code", 5, _PPP_lcptypes),
+                   XByteField("id", 0),
+                   FieldLenField("len", None, fmt="H", length_of="data",
+                                 adjust=lambda p, x: x + 4),
+                   StrLenField("data", "",
+                               length_from=lambda p:p.len-4)]
+
+    def extract_padding(self, pay):
+        return "",pay
+
+    @classmethod
+    def dispatch_hook(cls, _pkt = None, *args, **kargs):
+        if _pkt:
+            o = ord(_pkt[0])
+            if o in [1, 2, 3, 4]:
+                return PPP_LCP_Configure
+            elif o in [5,6]:
+                return PPP_LCP_Terminate
+            elif o == 7:
+                return PPP_LCP_Code_Reject
+            elif o == 8:
+                return PPP_LCP_Protocol_Reject
+            elif o in [9, 10]:
+                return PPP_LCP_Echo
+            elif o == 11:
+                return PPP_LCP_Discard_Request
+            else:
+                return cls
+        return cls
+
+
+_PPP_lcp_optiontypes = {1: "Maximum-Receive-Unit",
+                        2: "Async-Control-Character-Map",
+                        3: "Authentication-protocol",
+                        4: "Quality-protocol",
+                        5: "Magic-number",
+                        7: "Protocol-Field-Compression",
+                        8: "Address-and-Control-Field-Compression",
+                        13: "Callback"}
+
+
+class PPP_LCP_Option(Packet):
+    name = "PPP LCP Option"
+    fields_desc = [ByteEnumField("type", None, _PPP_lcp_optiontypes),
+                   FieldLenField("len", None, fmt="B", length_of="data",
+                                 adjust=lambda p,x:x+2),
+                   StrLenField("data", None, length_from=lambda p:p.len-2)]
+
+    def extract_padding(self, pay):
+        return "", pay
+
+    registered_options = {}
+
+    @classmethod
+    def register_variant(cls):
+        cls.registered_options[cls.type.default] = cls
+
+    @classmethod
+    def dispatch_hook(cls, _pkt=None, *args, **kargs):
+        if _pkt:
+            o = ord(_pkt[0])
+            return cls.registered_options.get(o, cls)
+        return cls
+
+
+class PPP_LCP_MRU_Option(PPP_LCP_Option):
+    fields_desc = [ByteEnumField("type", 1, _PPP_lcp_optiontypes),
+                   FieldLenField("len", 4, fmt="B", adjust=lambda p,x:4),
+                   ShortField("max_recv_unit", 1500)]
+
+_PPP_LCP_auth_protocols = {0xc023: "Password authentication protocol",
+                           0xc223: "Challenge-response authentication protocol",
+                           0xc227: "PPP Extensible authentication protocol"}
+
+_PPP_LCP_CHAP_algorithms = {5: "MD5",
+                            6: "SHA1",
+                            128: "MS-CHAP",
+                            129: "MS-CHAP-v2"}
+
+
+class PPP_LCP_ACCM_Option(PPP_LCP_Option):
+    fields_desc = [ByteEnumField("type", 2, _PPP_lcp_optiontypes),
+                   FieldLenField("len", 6, fmt="B"),
+                   BitField("accm", 0x00000000, 32)]
+
+
+def adjust_auth_len(pkt, x):
+    if pkt.auth_protocol == 0xc223:
+        return 5
+    elif pkt.auth_protocol == 0xc023:
+        return 4
+    else:
+        return x + 4
+
+
+class PPP_LCP_Auth_Protocol_Option(PPP_LCP_Option):
+    fields_desc = [ByteEnumField("type", 3, _PPP_lcp_optiontypes),
+                   FieldLenField("len", None, fmt="B", length_of="data",
+                                 adjust=adjust_auth_len),
+                   ShortEnumField("auth_protocol", 0xc023, _PPP_LCP_auth_protocols),
+                   ConditionalField(StrLenField("data", '', length_from=lambda p:p.len-4),
+                                    lambda p:p.auth_protocol != 0xc223),
+                   ConditionalField(ByteEnumField("algorithm", 5, _PPP_LCP_CHAP_algorithms),
+                                    lambda p:p.auth_protocol == 0xc223)]
+
+
+_PPP_LCP_quality_protocols = {0xc025: "Link Quality Report"}
+
+
+class PPP_LCP_Quality_Protocol_Option(PPP_LCP_Option):
+    fields_desc = [ByteEnumField("type", 4, _PPP_lcp_optiontypes),
+                   FieldLenField("len", None, fmt="B", length_of="data",
+                                 adjust=lambda p,x:x+4),
+                   ShortEnumField("quality_protocol", 0xc025, _PPP_LCP_quality_protocols),
+                   StrLenField("data", "", length_from=lambda p:p.len-4)]
+
+
+class PPP_LCP_Magic_Number_Option(PPP_LCP_Option):
+    fields_desc = [ByteEnumField("type", 5, _PPP_lcp_optiontypes),
+                   FieldLenField("len", 6, fmt="B", adjust = lambda p,x:6),
+                   IntField("magic_number", None)]
+
+
+_PPP_lcp_callback_operations = {0: "Location determined by user authentication",
+                                1: "Dialing string",
+                                2: "Location identifier",
+                                3: "E.164 number",
+                                4: "Distinguished name"}
+
+
+class PPP_LCP_Callback_Option(PPP_LCP_Option):
+    fields_desc = [ByteEnumField("type", 13, _PPP_lcp_optiontypes),
+                   FieldLenField("len", None, fmt="B", length_of="message",
+                                 adjust=lambda p,x:x+3),
+                   ByteEnumField("operation", 0, _PPP_lcp_callback_operations),
+                   StrLenField("message", "", length_from=lambda p:p.len-3)]
+
+
+class PPP_LCP_Configure(PPP_LCP):
+    fields_desc = [ByteEnumField("code", 1, _PPP_lcptypes),
+                   XByteField("id", 0),
+                   FieldLenField("len", None, fmt="H", length_of="options",
+                                 adjust=lambda p,x:x+4),
+                   PacketListField("options", [], PPP_LCP_Option,
+                                   length_from=lambda p:p.len-4)]
+
+    def answers(self, other):
+        return isinstance(other, PPP_LCP_Configure) and self.code in [2, 3, 4]\
+           and other.code == 1 and other.id == self.id
+
+
+class PPP_LCP_Terminate(PPP_LCP):
+
+    def answers(self, other):
+        return isinstance(other, PPP_LCP_Terminate) and self.code == 6\
+           and other.code == 5 and other.id == self.id
+
+
+class PPP_LCP_Code_Reject(PPP_LCP):
+    fields_desc = [ByteEnumField("code", 7, _PPP_lcptypes),
+                   XByteField("id", 0),
+                   FieldLenField("len", None, fmt="H", length_of="rejected_packet",
+                                 adjust=lambda p,x:x+4),
+                   PacketField("rejected_packet", None, PPP_LCP)]
+
+
+class PPP_LCP_Protocol_Reject(PPP_LCP):
+    fields_desc = [ByteEnumField("code", 8, _PPP_lcptypes),
+                   XByteField("id", 0),
+                   FieldLenField("len", None, fmt="H", length_of="rejected_information",
+                                 adjust=lambda p,x:x+6),
+                   ShortEnumField("rejected_protocol", None, _PPP_proto),
+                   PacketField("rejected_information", None, Packet)]
+
+
+class PPP_LCP_Echo(PPP_LCP):
+     fields_desc = [ByteEnumField("code", 9, _PPP_lcptypes),
+                    XByteField("id", 0),
+                    FieldLenField("len", None, fmt="H", length_of="data",
+                                 adjust=lambda p,x:x+8),
+                    IntField("magic_number", None),
+                    StrLenField("data", "", length_from=lambda p:p.len-8)]
+
+     def answers(self, other):
+         return isinstance(other, PPP_LCP_Echo) and self.code == 10\
+            and other.code == 9 and self.id == other.id
+
+
+class PPP_LCP_Discard_Request(PPP_LCP):
+    fields_desc = [ByteEnumField("code", 11, _PPP_lcptypes),
+                   XByteField("id", 0),
+                   FieldLenField("len", None, fmt="H", length_of="data",
+                                 adjust=lambda p,x:x+8),
+                   IntField("magic_number", None),
+                   StrLenField("data", "", length_from=lambda p:p.len-8)]
+
+
 bind_layers( Ether,         PPPoED,        type=0x8863)
 bind_layers( Ether,         PPPoE,         type=0x8864)
 bind_layers( CookedLinux,   PPPoED,        proto=0x8863)
@@ -349,5 +563,7 @@ bind_layers( PPP,           IP,            proto=0x0021)
 bind_layers( PPP,           IPv6,          proto=0x0057)
 bind_layers( PPP,           PPP_IPCP,      proto=0x8021)
 bind_layers( PPP,           PPP_ECP,       proto=0x8053)
+bind_layers( PPP,           PPP_LCP,       proto=0xc021)
 bind_layers( Ether,         PPP_IPCP,      type=0x8021)
 bind_layers( Ether,         PPP_ECP,       type=0x8053)
+bind_layers( GRE_PPTP,      PPP,           proto=0x880b)

scapy/layers/pptp.py

+## This file is part of Scapy
+## See http://www.secdev.org/projects/scapy for more informations
+## Copyright (C) Jan Sebechlebsky <sebechlebskyjan@gmail.com>
+## This program is published under a GPLv2 license
+
+"""
+PPTP (Point to Point Tunneling Protocol)
+
+[RFC 2637]
+"""
+
+from scapy.packet import Packet, bind_layers
+from scapy.layers.inet import TCP
+from scapy.fields import ByteEnumField, FieldLenField, FlagsField, IntField, IntEnumField,\
+                         LenField, XIntField, ShortField, ShortEnumField, StrFixedLenField,\
+                         StrLenField, XShortField, XByteField
+
+_PPTP_MAGIC_COOKIE = 0x1a2b3c4d
+
+_PPTP_msg_type = {1: "Control Message",
+                  2: "Managemenent Message"}
+
+_PPTP_ctrl_msg_type = {  # Control Connection Management
+                       1: "Start-Control-Connection-Request",
+                       2: "Start-Control-Connection-Reply",
+                       3: "Stop-Control-Connection-Request",
+                       4: "Stop-Control-Connection-Reply",
+                       5: "Echo-Request",
+                       6: "Echo-Reply",
+                       # Call Management
+                       7: "Outgoing-Call-Request",
+                       8: "Outgoing-Call-Reply",
+                       9: "Incoming-Call-Request",
+                       10: "Incoming-Call-Reply",
+                       11: "Incoming-Call-Connected",
+                       12: "Call-Clear-Request",
+                       13: "Call-Disconnect-Notify",
+                       # Error Reporting
+                       14: "WAN-Error-Notify",
+                       # PPP Session Control
+                       15: "Set-Link-Info"}
+
+_PPTP_general_error_code = {0: "None",
+                            1: "Not-Connected",
+                            2: "Bad-Format",
+                            3: "Bad-Value",
+                            4: "No-Resource",
+                            5: "Bad-Call ID",
+                            6: "PAC-Error"}
+
+
+class PPTP(Packet):
+    name = "PPTP"
+    fields_desc = [FieldLenField("len", None, fmt="H", length_of="data",
+                                 adjust=lambda p, x: x + 12),
+                   ShortEnumField("type", 1, _PPTP_msg_type),
+                   XIntField("magic_cookie", _PPTP_MAGIC_COOKIE),
+                   ShortEnumField("ctrl_msg_type", 1, _PPTP_ctrl_msg_type),
+                   XShortField("reserved_0", 0x0000),
+                   StrLenField("data", "",length_from=lambda p: p.len - 12)]
+
+    registered_options = {}
+
+    @classmethod
+    def register_variant(cls):
+        cls.registered_options[cls.ctrl_msg_type.default] = cls
+
+    @classmethod
+    def dispatch_hook(cls, _pkt=None, *args, **kargs):
+        if _pkt:
+            o = ord(_pkt[9])
+            return cls.registered_options.get(o, cls)
+        return cls
+
+
+_PPTP_FRAMING_CAPABILITIES_FLAGS = ["Asynchronous Framing supported",
+                                    "Synchronous Framing supported"]
+
+_PPTP_BEARER_CAPABILITIES_FLAGS = ["Analog access supported",
+                                   "Digital access supported"]
+
+
+class PPTPStartControlConnectionRequest(PPTP):
+    name = "PPTP Start Control Connection Request"
+    fields_desc = [LenField("len", 156),
+                   ShortEnumField("type", 1, _PPTP_msg_type),
+                   XIntField("magic_cookie", _PPTP_MAGIC_COOKIE),
+                   ShortEnumField("ctrl_msg_type", 1, _PPTP_ctrl_msg_type),
+                   XShortField("reserved_0", 0x0000),
+                   ShortField("protocol_version", 1),
+                   XShortField("reserved_1", 0x0000),
+                   FlagsField("framing_capabilities", 0, 32,
+                              _PPTP_FRAMING_CAPABILITIES_FLAGS),
+                   FlagsField("bearer_capabilities", 0, 32,
+                              _PPTP_BEARER_CAPABILITIES_FLAGS),
+                   ShortField("maximum_channels", 65535),
+                   ShortField("firmware_revision", 256),
+                   StrFixedLenField("host_name", "linux", 64),
+                   StrFixedLenField("vendor_string", "", 64)]
+
+_PPTP_start_control_connection_result = {1: "OK",
+                                         2: "General error",
+                                         3: "Command channel already exists",
+                                         4: "Not authorized",
+                                         5: "Unsupported protocol version"}
+
+
+class PPTPStartControlConnectionReply(PPTP):
+    name = "PPTP Start Control Connection Reply"
+    fields_desc = [LenField("len", 156),
+                   ShortEnumField("type", 1, _PPTP_msg_type),
+                   XIntField("magic_cookie", _PPTP_MAGIC_COOKIE),
+                   ShortEnumField("ctrl_msg_type", 2, _PPTP_ctrl_msg_type),
+                   XShortField("reserved_0", 0x0000),
+                   ShortField("protocol_version", 1),
+                   ByteEnumField("result_code", 1,
+                                 _PPTP_start_control_connection_result),
+                   ByteEnumField("error_code", 0, _PPTP_general_error_code),
+                   FlagsField("framing_capabilities", 0, 32,
+                              _PPTP_FRAMING_CAPABILITIES_FLAGS),
+                   FlagsField("bearer_capabilities", 0, 32,
+                              _PPTP_BEARER_CAPABILITIES_FLAGS),
+                   ShortField("maximum_channels", 65535),
+                   ShortField("firmware_revision", 256),
+                   StrFixedLenField("host_name", "linux", 64),
+                   StrFixedLenField("vendor_string", "", 64)]
+
+    def answers(self, other):
+        return isinstance(other, PPTPStartControlConnectionRequest)
+
+
+_PPTP_stop_control_connection_reason = {1: "None",
+                                        2: "Stop-Protocol",
+                                        3: "Stop-Local-Shutdown"}
+
+
+class PPTPStopControlConnectionRequest(PPTP):
+    name = "PPTP Stop Control Connection Request"
+    fields_desc = [LenField("len", 16),
+                   ShortEnumField("type", 1, _PPTP_msg_type),
+                   XIntField("magic_cookie", _PPTP_MAGIC_COOKIE),
+                   ShortEnumField("ctrl_msg_type", 3, _PPTP_ctrl_msg_type),
+                   XShortField("reserved_0", 0x0000),
+                   ByteEnumField("reason", 1,
+                                 _PPTP_stop_control_connection_reason),
+                   XByteField("reserved_1", 0x00),
+                   XShortField("reserved_2", 0x0000)]
+
+_PPTP_stop_control_connection_result = {1: "OK",
+                                        2: "General error"}
+
+
+class PPTPStopControlConnectionReply(PPTP):
+    name = "PPTP Stop Control Connection Reply"
+    fields_desc = [LenField("len", 16),
+                   ShortEnumField("type", 1, _PPTP_msg_type),
+                   XIntField("magic_cookie", _PPTP_MAGIC_COOKIE),
+                   ShortEnumField("ctrl_msg_type", 4, _PPTP_ctrl_msg_type),
+                   XShortField("reserved_0", 0x0000),
+                   ByteEnumField("result_code", 1,
+                                 _PPTP_stop_control_connection_result),
+                   ByteEnumField("error_code", 0, _PPTP_general_error_code),
+                   XShortField("reserved_2", 0x0000)]
+
+    def answers(self, other):
+        return isinstance(other, PPTPStopControlConnectionRequest)
+
+
+class PPTPEchoRequest(PPTP):
+    name = "PPTP Echo Request"
+    fields_desc = [LenField("len", 16),
+                   ShortEnumField("type", 1, _PPTP_msg_type),
+                   XIntField("magic_cookie", _PPTP_MAGIC_COOKIE),
+                   ShortEnumField("ctrl_msg_type", 5, _PPTP_ctrl_msg_type),
+                   XShortField("reserved_0", 0x0000),
+                   IntField("identifier", None)]
+
+_PPTP_echo_result = {1: "OK",
+                     2: "General error"}
+
+
+class PPTPEchoReply(PPTP):
+    name = "PPTP Echo Reply"
+    fields_desc = [LenField("len", 20),
+                   ShortEnumField("type", 1, _PPTP_msg_type),
+                   XIntField("magic_cookie", _PPTP_MAGIC_COOKIE),
+                   ShortEnumField("ctrl_msg_type", 6, _PPTP_ctrl_msg_type),
+                   XShortField("reserved_0", 0x0000),
+                   IntField("identifier", None),
+                   ByteEnumField("result_code", 1, _PPTP_echo_result),
+                   ByteEnumField("error_code", 0, _PPTP_general_error_code),
+                   XShortField("reserved_1", 0x0000)]
+
+    def answers(self, other):
+        return isinstance(other, PPTPEchoRequest) and other.identifier == self.identifier
+
+_PPTP_bearer_type = {1: "Analog channel",
+                     2: "Digital channel",
+                     3: "Any type of channel"}
+
+_PPTP_framing_type = {1: "Asynchronous framing",
+                      2: "Synchronous framing",
+                      3: "Any type of framing"}
+
+
+class PPTPOutgoingCallRequest(PPTP):
+    name = "PPTP Outgoing Call Request"
+    fields_desc = [LenField("len", 168),
+                   ShortEnumField("type", 1, _PPTP_msg_type),
+                   XIntField("magic_cookie", _PPTP_MAGIC_COOKIE),
+                   ShortEnumField("ctrl_msg_type", 7, _PPTP_ctrl_msg_type),
+                   XShortField("reserved_0", 0x0000),
+                   ShortField("call_id", 1),
+                   ShortField("call_serial_number", 0),
+                   IntField("minimum_bps", 32768),
+                   IntField("maximum_bps", 2147483648),
+                   IntEnumField("bearer_type", 3, _PPTP_bearer_type),
+                   IntEnumField("framing_type", 3, _PPTP_framing_type),
+                   ShortField("pkt_window_size", 16),
+                   ShortField("pkt_proc_delay", 0),
+                   ShortField('phone_number_len', 0),
+                   XShortField("reserved_1", 0x0000),
+                   StrFixedLenField("phone_number", '', 64),
+                   StrFixedLenField("subaddress", '', 64)]
+
+_PPTP_result_code = {1: "Connected",
+                     2: "General error",
+                     3: "No Carrier",
+                     4: "Busy",
+                     5: "No dial tone",
+                     6: "Time-out",
+                     7: "Do not accept"}
+
+
+class PPTPOutgoingCallReply(PPTP):
+    name = "PPTP Outgoing Call Reply"
+    fields_desc = [LenField("len", 32),
+                   ShortEnumField("type", 1, _PPTP_msg_type),
+                   XIntField("magic_cookie", _PPTP_MAGIC_COOKIE),
+                   ShortEnumField("ctrl_msg_type", 8, _PPTP_ctrl_msg_type),
+                   XShortField("reserved_0", 0x0000),
+                   ShortField("call_id", 1),
+                   ShortField("peer_call_id", 1),
+                   ByteEnumField("result_code", 1, _PPTP_result_code),
+                   ByteEnumField("error_code", 0, _PPTP_general_error_code),
+                   ShortField("cause_code", 0),
+                   IntField("connect_speed", 100000000),
+                   ShortField("pkt_window_size", 16),
+                   ShortField("pkt_proc_delay", 0),
+                   IntField("channel_id", 0)]
+
+    def answers(self, other):
+        return isinstance(other, PPTPOutgoingCallRequest) and other.call_id == self.peer_call_id
+
+
+class PPTPIncomingCallRequest(PPTP):
+    name = "PPTP Incoming Call Request"
+    fields_desc = [LenField("len", 220),
+                   ShortEnumField("type", 1, _PPTP_msg_type),
+                   XIntField("magic_cookie", _PPTP_MAGIC_COOKIE),
+                   ShortEnumField("ctrl_msg_type", 9, _PPTP_ctrl_msg_type),
+                   XShortField("reserved_0", 0x0000),
+                   ShortField("call_id", 1),
+                   ShortField("call_serial_number", 1),
+                   IntEnumField("bearer_type", 3, _PPTP_bearer_type),
+                   IntField("channel_id", 0),
+                   ShortField("dialed_number_len", 0),
+                   ShortField("dialing_number_len", 0),
+                   StrFixedLenField("dialed_number", "", 64),
+                   StrFixedLenField("dialing_number", "", 64),
+                   StrFixedLenField("subaddress", "", 64)]
+
+
+class PPTPIncomingCallReply(PPTP):
+    name = "PPTP Incoming Call Reply"
+    fields_desc = [LenField("len", 148),
+                   ShortEnumField("type", 1, _PPTP_msg_type),
+                   XIntField("magic_cookie", _PPTP_MAGIC_COOKIE),
+                   ShortEnumField("ctrl_msg_type", 10, _PPTP_ctrl_msg_type),
+                   XShortField("reserved_0", 0x0000),
+                   ShortField("call_id", 1),
+                   ShortField("peer_call_id", 1),
+                   ByteEnumField("result_code", 1, _PPTP_result_code),
+                   ByteEnumField("error_code", 0, _PPTP_general_error_code),
+                   ShortField("pkt_window_size", 64),
+                   ShortField("pkt_transmit_delay", 0),
+                   XShortField("reserved_1", 0x0000)]
+
+    def answers(self, other):
+        return isinstance(other, PPTPIncomingCallRequest) and other.call_id == self.peer_call_id
+
+
+class PPTPIncomingCallConnected(PPTP):
+    name = "PPTP Incoming Call Connected"
+    fields_desc = [LenField("len", 28),
+                   ShortEnumField("type", 1, _PPTP_msg_type),
+                   XIntField("magic_cookie", _PPTP_MAGIC_COOKIE),
+                   ShortEnumField("ctrl_msg_type", 11, _PPTP_ctrl_msg_type),
+                   XShortField("reserved_0", 0x0000),
+                   ShortField("peer_call_id", 1),
+                   XShortField("reserved_1", 0x0000),
+                   IntField("connect_speed", 100000000),
+                   ShortField("pkt_window_size", 64),
+                   ShortField("pkt_transmit_delay", 0),
+                   IntEnumField("framing_type", 1, _PPTP_framing_type)]
+
+    def answers(self, other):
+        return isinstance(other, PPTPIncomingCallReply) and other.call_id == self.peer_call_id
+
+
+class PPTPCallClearRequest(PPTP):
+    name = "PPTP Call Clear Request"
+    fields_desc = [LenField("len", 16),
+                   ShortEnumField("type", 1, _PPTP_msg_type),
+                   XIntField("magic_cookie", _PPTP_MAGIC_COOKIE),
+                   ShortEnumField("ctrl_msg_type", 12, _PPTP_ctrl_msg_type),
+                   XShortField("reserved_0", 0x0000),
+                   ShortField("call_id", 1),
+                   XShortField("reserved_1", 0x0000)]
+
+_PPTP_call_disconnect_result = {1: "Lost Carrier",
+                                2: "General error",
+                                3: "Admin Shutdown",
+                                4: "Request"}
+
+
+class PPTPCallDisconnectNotify(PPTP):
+    name = "PPTP Call Disconnect Notify"
+    fields_desc = [LenField("len", 148),
+                   ShortEnumField("type", 1, _PPTP_msg_type),
+                   XIntField("magic_cookie", _PPTP_MAGIC_COOKIE),
+                   ShortEnumField("ctrl_msg_type", 13, _PPTP_ctrl_msg_type),
+                   XShortField("reserved_0", 0x0000),
+                   ShortField("call_id", 1),
+                   ByteEnumField("result_code", 1,
+                                 _PPTP_call_disconnect_result),
+                   ByteEnumField("error_code", 0, _PPTP_general_error_code),
+                   ShortField("cause_code", 0),
+                   XShortField("reserved_1", 0x0000),
+                   StrFixedLenField("call_statistic", "", 128)]
+
+
+class PPTPWANErrorNotify(PPTP):
+    name = "PPTP WAN Error Notify"
+    fields_desc = [LenField("len", 40),
+                   ShortEnumField("type", 1, _PPTP_msg_type),
+                   XIntField("magic_cookie", _PPTP_MAGIC_COOKIE),
+                   ShortEnumField("ctrl_msg_type", 14, _PPTP_ctrl_msg_type),
+                   XShortField("reserved_0", 0x0000),
+                   ShortField("peer_call_id", 1),
+                   XShortField("reserved_1", 0x0000),
+                   IntField("crc_errors", 0),
+                   IntField("framing_errors", 0),
+                   IntField("hardware_overruns", 0),
+                   IntField("buffer_overruns", 0),
+                   IntField("time_out_errors", 0),
+                   IntField("alignment_errors", 0)]
+
+
+class PPTPSetLinkInfo(PPTP):
+    name = "PPTP Set Link Info"
+    fields_desc = [LenField("len", 24),
+                   ShortEnumField("type", 1, _PPTP_msg_type),
+                   XIntField("magic_cookie", _PPTP_MAGIC_COOKIE),
+                   ShortEnumField("ctrl_msg_type", 15, _PPTP_ctrl_msg_type),
+                   XShortField("reserved_0", 0x0000),
+                   ShortField("peer_call_id", 1),
+                   XShortField("reserved_1", 0x0000),
+                   XIntField("send_accm", 0x00000000),
+                   XIntField("receive_accm", 0x00000000)]
+
+bind_layers(TCP, PPTP, sport=1723)
+bind_layers(TCP, PPTP, dport=1723)