]> The Tcpdump Group git mirrors - tcpdump/blob - print-vqp.c
More bounds checking when fetching addresses and converting to strings.
[tcpdump] / print-vqp.c
1 /*
2 * Copyright (c) 1998-2006 The TCPDUMP project
3 *
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that: (1) source code
6 * distributions retain the above copyright notice and this paragraph
7 * in its entirety, and (2) distributions including binary code include
8 * the above copyright notice and this paragraph in its entirety in
9 * the documentation or other materials provided with the distribution.
10 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND
11 * WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, WITHOUT
12 * LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
13 * FOR A PARTICULAR PURPOSE.
14 *
15 * Original code by Carles Kishimoto <Carles.Kishimoto@bsc.es>
16 */
17
18 /* \summary: Cisco VLAN Query Protocol (VQP) printer */
19
20 #ifdef HAVE_CONFIG_H
21 #include <config.h>
22 #endif
23
24 #include "netdissect-stdinc.h"
25
26 #include "netdissect.h"
27 #include "extract.h"
28 #include "addrtoname.h"
29
30 #define VQP_VERSION 1
31
32 /*
33 * VQP common header
34 *
35 * 0 1 2 3
36 * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
37 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
38 * | Constant | Packet type | Error Code | nitems |
39 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
40 * | Packet Sequence Number (4 bytes) |
41 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
42 */
43
44 struct vqp_common_header_t {
45 nd_uint8_t version;
46 nd_uint8_t msg_type;
47 nd_uint8_t error_code;
48 nd_uint8_t nitems;
49 nd_uint32_t sequence;
50 };
51
52 struct vqp_obj_tlv_t {
53 nd_uint32_t obj_type;
54 nd_uint16_t obj_length;
55 };
56
57 #define VQP_OBJ_REQ_JOIN_PORT 0x01
58 #define VQP_OBJ_RESP_VLAN 0x02
59 #define VQP_OBJ_REQ_RECONFIRM 0x03
60 #define VQP_OBJ_RESP_RECONFIRM 0x04
61
62 static const struct tok vqp_msg_type_values[] = {
63 { VQP_OBJ_REQ_JOIN_PORT, "Request, Join Port"},
64 { VQP_OBJ_RESP_VLAN, "Response, VLAN"},
65 { VQP_OBJ_REQ_RECONFIRM, "Request, Reconfirm"},
66 { VQP_OBJ_RESP_RECONFIRM, "Response, Reconfirm"},
67 { 0, NULL}
68 };
69
70 static const struct tok vqp_error_code_values[] = {
71 { 0x00, "No error"},
72 { 0x03, "Access denied"},
73 { 0x04, "Shutdown port"},
74 { 0x05, "Wrong VTP domain"},
75 { 0, NULL}
76 };
77
78 /* FIXME the heading 0x0c looks ugly - those must be flags etc. */
79 #define VQP_OBJ_IP_ADDRESS 0x0c01
80 #define VQP_OBJ_PORT_NAME 0x0c02
81 #define VQP_OBJ_VLAN_NAME 0x0c03
82 #define VQP_OBJ_VTP_DOMAIN 0x0c04
83 #define VQP_OBJ_ETHERNET_PKT 0x0c05
84 #define VQP_OBJ_MAC_NULL 0x0c06
85 #define VQP_OBJ_MAC_ADDRESS 0x0c08
86
87 static const struct tok vqp_obj_values[] = {
88 { VQP_OBJ_IP_ADDRESS, "Client IP Address" },
89 { VQP_OBJ_PORT_NAME, "Port Name" },
90 { VQP_OBJ_VLAN_NAME, "VLAN Name" },
91 { VQP_OBJ_VTP_DOMAIN, "VTP Domain" },
92 { VQP_OBJ_ETHERNET_PKT, "Ethernet Packet" },
93 { VQP_OBJ_MAC_NULL, "MAC Null" },
94 { VQP_OBJ_MAC_ADDRESS, "MAC Address" },
95 { 0, NULL}
96 };
97
98 void
99 vqp_print(netdissect_options *ndo, const u_char *pptr, u_int len)
100 {
101 const struct vqp_common_header_t *vqp_common_header;
102 const struct vqp_obj_tlv_t *vqp_obj_tlv;
103
104 const u_char *tptr;
105 uint8_t version;
106 uint16_t vqp_obj_len;
107 uint32_t vqp_obj_type;
108 u_int tlen;
109 uint8_t nitems;
110
111 ndo->ndo_protocol = "vqp";
112 tptr=pptr;
113 tlen = len;
114 vqp_common_header = (const struct vqp_common_header_t *)pptr;
115 ND_TCHECK_SIZE(vqp_common_header);
116 if (sizeof(struct vqp_common_header_t) > tlen)
117 goto trunc;
118 version = GET_U_1(vqp_common_header->version);
119
120 /*
121 * Sanity checking of the header.
122 */
123 if (version != VQP_VERSION) {
124 ND_PRINT("VQP version %u packet not supported",
125 version);
126 return;
127 }
128
129 /* in non-verbose mode just lets print the basic Message Type */
130 if (ndo->ndo_vflag < 1) {
131 ND_PRINT("VQPv%u %s Message, error-code %s (%u), length %u",
132 version,
133 tok2str(vqp_msg_type_values, "unknown (%u)",GET_U_1(vqp_common_header->msg_type)),
134 tok2str(vqp_error_code_values, "unknown (%u)",GET_U_1(vqp_common_header->error_code)),
135 GET_U_1(vqp_common_header->error_code),
136 len);
137 return;
138 }
139
140 /* ok they seem to want to know everything - lets fully decode it */
141 nitems = GET_U_1(vqp_common_header->nitems);
142 ND_PRINT("\n\tVQPv%u, %s Message, error-code %s (%u), seq 0x%08x, items %u, length %u",
143 version,
144 tok2str(vqp_msg_type_values, "unknown (%u)",GET_U_1(vqp_common_header->msg_type)),
145 tok2str(vqp_error_code_values, "unknown (%u)",GET_U_1(vqp_common_header->error_code)),
146 GET_U_1(vqp_common_header->error_code),
147 GET_BE_U_4(vqp_common_header->sequence),
148 nitems,
149 len);
150
151 /* skip VQP Common header */
152 tptr+=sizeof(struct vqp_common_header_t);
153 tlen-=sizeof(struct vqp_common_header_t);
154
155 while (nitems != 0 && tlen != 0) {
156
157 vqp_obj_tlv = (const struct vqp_obj_tlv_t *)tptr;
158 ND_TCHECK_SIZE(vqp_obj_tlv);
159 if (sizeof(struct vqp_obj_tlv_t) > tlen)
160 goto trunc;
161 vqp_obj_type = GET_BE_U_4(vqp_obj_tlv->obj_type);
162 vqp_obj_len = GET_BE_U_2(vqp_obj_tlv->obj_length);
163 tptr+=sizeof(struct vqp_obj_tlv_t);
164 tlen-=sizeof(struct vqp_obj_tlv_t);
165
166 ND_PRINT("\n\t %s Object (0x%08x), length %u, value: ",
167 tok2str(vqp_obj_values, "Unknown", vqp_obj_type),
168 vqp_obj_type, vqp_obj_len);
169
170 /* basic sanity check */
171 if (vqp_obj_type == 0 || vqp_obj_len ==0) {
172 return;
173 }
174
175 /* did we capture enough for fully decoding the object ? */
176 ND_TCHECK_LEN(tptr, vqp_obj_len);
177 if (vqp_obj_len > tlen)
178 goto trunc;
179
180 switch(vqp_obj_type) {
181 case VQP_OBJ_IP_ADDRESS:
182 if (vqp_obj_len != 4)
183 goto trunc;
184 ND_PRINT("%s (0x%08x)", GET_IPADDR_STRING(tptr),
185 GET_BE_U_4(tptr));
186 break;
187 /* those objects have similar semantics - fall through */
188 case VQP_OBJ_PORT_NAME:
189 case VQP_OBJ_VLAN_NAME:
190 case VQP_OBJ_VTP_DOMAIN:
191 case VQP_OBJ_ETHERNET_PKT:
192 (void)nd_printzp(ndo, tptr, vqp_obj_len, NULL);
193 break;
194 /* those objects have similar semantics - fall through */
195 case VQP_OBJ_MAC_ADDRESS:
196 case VQP_OBJ_MAC_NULL:
197 if (vqp_obj_len != MAC_ADDR_LEN)
198 goto trunc;
199 ND_PRINT("%s", GET_ETHERADDR_STRING(tptr));
200 break;
201 default:
202 if (ndo->ndo_vflag <= 1)
203 print_unknown_data(ndo,tptr, "\n\t ", vqp_obj_len);
204 break;
205 }
206 tptr += vqp_obj_len;
207 tlen -= vqp_obj_len;
208 nitems--;
209 }
210 return;
211 trunc:
212 nd_print_trunc(ndo);
213 }