The Tcpdump Group git mirrors - tcpdump/blob - addrtoname.c

   1 /*
   2  * Copyright (c) 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997
   3  *      The Regents of the University of California.  All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that: (1) source code distributions
   7  * retain the above copyright notice and this paragraph in its entirety, (2)
   8  * distributions including binary code include the above copyright notice and
   9  * this paragraph in its entirety in the documentation or other materials
  10  * provided with the distribution, and (3) all advertising materials mentioning
  11  * features or use of this software display the following acknowledgement:
  12  * ``This product includes software developed by the University of California,
  13  * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
  14  * the University nor the names of its contributors may be used to endorse
  15  * or promote products derived from this software without specific prior
  16  * written permission.
  17  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
  18  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
  19  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  20  *
  21  *  Internet, ethernet, port, and protocol string to address
  22  *  and address to string conversion routines
  23  */
  24
  25 #ifdef HAVE_CONFIG_H
  26 #include <config.h>
  27 #endif
  28
  29 #ifdef HAVE_CASPER
  30 #include <libcasper.h>
  31 #include <casper/cap_dns.h>
  32 #endif /* HAVE_CASPER */
  33
  34 #include "netdissect-stdinc.h"
  35
  36 #ifndef NTOHL
  37 #define NTOHL(x)        (x) = ntohl(x)
  38 #define NTOHS(x)        (x) = ntohs(x)
  39 #define HTONL(x)        (x) = htonl(x)
  40 #define HTONS(x)        (x) = htons(x)
  41 #endif
  42
  43 #ifdef _WIN32
  44   /*
  45    * We have our own ether_ntohost(), reading from the system's
  46    * Ethernet address file.
  47    */
  48   #include "missing/win_ether_ntohost.h"
  49 #else
  50   #ifdef USE_ETHER_NTOHOST
  51     #if defined(NET_ETHERNET_H_DECLARES_ETHER_NTOHOST)
  52       /*
  53        * OK, just include <net/ethernet.h>.
  54        */
  55       #include <net/ethernet.h>
  56     #elif defined(NETINET_ETHER_H_DECLARES_ETHER_NTOHOST)
  57       /*
  58        * OK, just include <netinet/ether.h>
  59        */
  60       #include <netinet/ether.h>
  61     #elif defined(SYS_ETHERNET_H_DECLARES_ETHER_NTOHOST)
  62       /*
  63        * OK, just include <sys/ethernet.h>
  64        */
  65       #include <sys/ethernet.h>
  66     #elif defined(ARPA_INET_H_DECLARES_ETHER_NTOHOST)
  67       /*
  68        * OK, just include <arpa/inet.h>
  69        */
  70       #include <arpa/inet.h>
  71     #elif defined(NETINET_IF_ETHER_H_DECLARES_ETHER_NTOHOST)
  72       /*
  73        * OK, include <netinet/if_ether.h>, after all the other stuff we
  74        * need to include or define for its benefit.
  75        */
  76       #define NEED_NETINET_IF_ETHER_H
  77     #else
  78       /*
  79        * We'll have to declare it ourselves.
  80        * If <netinet/if_ether.h> defines struct ether_addr, include
  81        * it.  Otherwise, define it ourselves.
  82        */
  83       #ifdef HAVE_STRUCT_ETHER_ADDR
  84         #define NEED_NETINET_IF_ETHER_H
  85       #else /* HAVE_STRUCT_ETHER_ADDR */
  86         struct ether_addr {
  87                 unsigned char ether_addr_octet[6];
  88         };
  89       #endif /* HAVE_STRUCT_ETHER_ADDR */
  90     #endif /* what declares ether_ntohost() */
  91
  92     #ifdef NEED_NETINET_IF_ETHER_H
  93       #include <net/if.h>       /* Needed on some platforms */
  94       #include <netinet/in.h>   /* Needed on some platforms */
  95       #include <netinet/if_ether.h>
  96     #endif /* NEED_NETINET_IF_ETHER_H */
  97
  98     #ifndef HAVE_DECL_ETHER_NTOHOST
  99       /*
 100        * No header declares it, so declare it ourselves.
 101        */
 102       extern int ether_ntohost(char *, const struct ether_addr *);
 103     #endif /* !defined(HAVE_DECL_ETHER_NTOHOST) */
 104   #endif /* USE_ETHER_NTOHOST */
 105 #endif /* _WIN32 */
 106
 107 #include <pcap.h>
 108 #include <pcap-namedb.h>
 109 #ifndef HAVE_GETSERVENT
 110 #include <getservent.h>
 111 #endif
 112 #include <signal.h>
 113 #include <stdio.h>
 114 #include <string.h>
 115 #include <stdlib.h>
 116
 117 #include "netdissect.h"
 118 #include "addrtoname.h"
 119 #include "addrtostr.h"
 120 #include "ethertype.h"
 121 #include "llc.h"
 122 #include "extract.h"
 123 #include "oui.h"
 124
 125 /*
 126  * hash tables for whatever-to-name translations
 127  *
 128  * ndo_error() called on strdup(3) failure with S_ERR_ND_MEM_ALLOC status
 129  */
 130
 131 #define HASHNAMESIZE 4096
 132
 133 struct hnamemem {
 134         uint32_t addr;
 135         const char *name;
 136         struct hnamemem *nxt;
 137 };
 138
 139 static struct hnamemem hnametable[HASHNAMESIZE];
 140 static struct hnamemem tporttable[HASHNAMESIZE];
 141 static struct hnamemem uporttable[HASHNAMESIZE];
 142 static struct hnamemem eprototable[HASHNAMESIZE];
 143 static struct hnamemem dnaddrtable[HASHNAMESIZE];
 144 static struct hnamemem ipxsaptable[HASHNAMESIZE];
 145
 146 #ifdef _WIN32
 147 /*
 148  * fake gethostbyaddr for Win2k/XP
 149  * gethostbyaddr() returns incorrect value when AF_INET6 is passed
 150  * to 3rd argument.
 151  *
 152  * h_name in struct hostent is only valid.
 153  */
 154 static struct hostent *
 155 win32_gethostbyaddr(const char *addr, int len, int type)
 156 {
 157         static struct hostent host;
 158         static char hostbuf[NI_MAXHOST];
 159         char hname[NI_MAXHOST];
 160         struct sockaddr_in6 addr6;
 161
 162         host.h_name = hostbuf;
 163         switch (type) {
 164         case AF_INET:
 165                 return gethostbyaddr(addr, len, type);
 166                 break;
 167         case AF_INET6:
 168                 memset(&addr6, 0, sizeof(addr6));
 169                 addr6.sin6_family = AF_INET6;
 170                 memcpy(&addr6.sin6_addr, addr, len);
 171                 if (getnameinfo((struct sockaddr *)&addr6, sizeof(addr6),
 172                     hname, sizeof(hname), NULL, 0, 0)) {
 173                         return NULL;
 174                 } else {
 175                         strlcpy(host.h_name, hname, NI_MAXHOST);
 176                         return &host;
 177                 }
 178                 break;
 179         default:
 180                 return NULL;
 181         }
 182 }
 183 #define gethostbyaddr win32_gethostbyaddr
 184 #endif /* _WIN32 */
 185
 186 struct h6namemem {
 187         struct in6_addr addr;
 188         char *name;
 189         struct h6namemem *nxt;
 190 };
 191
 192 static struct h6namemem h6nametable[HASHNAMESIZE];
 193
 194 struct enamemem {
 195         u_short e_addr0;
 196         u_short e_addr1;
 197         u_short e_addr2;
 198         const char *e_name;
 199         u_char *e_nsap;                 /* used only for nsaptable[] */
 200         struct enamemem *e_nxt;
 201 };
 202
 203 static struct enamemem enametable[HASHNAMESIZE];
 204 static struct enamemem nsaptable[HASHNAMESIZE];
 205
 206 struct bsnamemem {
 207         u_short bs_addr0;
 208         u_short bs_addr1;
 209         u_short bs_addr2;
 210         const char *bs_name;
 211         u_char *bs_bytes;
 212         unsigned int bs_nbytes;
 213         struct bsnamemem *bs_nxt;
 214 };
 215
 216 static struct bsnamemem bytestringtable[HASHNAMESIZE];
 217
 218 struct protoidmem {
 219         uint32_t p_oui;
 220         u_short p_proto;
 221         const char *p_name;
 222         struct protoidmem *p_nxt;
 223 };
 224
 225 static struct protoidmem protoidtable[HASHNAMESIZE];
 226
 227 /*
 228  * A faster replacement for inet_ntoa().
 229  */
 230 const char *
 231 intoa(uint32_t addr)
 232 {
 233         char *cp;
 234         u_int byte;
 235         int n;
 236         static char buf[sizeof(".xxx.xxx.xxx.xxx")];
 237
 238         NTOHL(addr);
 239         cp = buf + sizeof(buf);
 240         *--cp = '\0';
 241
 242         n = 4;
 243         do {
 244                 byte = addr & 0xff;
 245                 *--cp = byte % 10 + '0';
 246                 byte /= 10;
 247                 if (byte > 0) {
 248                         *--cp = byte % 10 + '0';
 249                         byte /= 10;
 250                         if (byte > 0)
 251                                 *--cp = byte + '0';
 252                 }
 253                 *--cp = '.';
 254                 addr >>= 8;
 255         } while (--n > 0);
 256
 257         return cp + 1;
 258 }
 259
 260 static uint32_t f_netmask;
 261 static uint32_t f_localnet;
 262 #ifdef HAVE_CASPER
 263 extern cap_channel_t *capdns;
 264 #endif
 265
 266 /*
 267  * Return a name for the IP address pointed to by ap.  This address
 268  * is assumed to be in network byte order.
 269  *
 270  * NOTE: ap is *NOT* necessarily part of the packet data (not even if
 271  * this is being called with the "ipaddr_string()" macro), so you
 272  * *CANNOT* use the ND_TCHECK{2}/ND_TTEST{2} macros on it.  Furthermore,
 273  * even in cases where it *is* part of the packet data, the caller
 274  * would still have to check for a null return value, even if it's
 275  * just printing the return value with "%s" - not all versions of
 276  * printf print "(null)" with "%s" and a null pointer, some of them
 277  * don't check for a null pointer and crash in that case.
 278  *
 279  * The callers of this routine should, before handing this routine
 280  * a pointer to packet data, be sure that the data is present in
 281  * the packet buffer.  They should probably do those checks anyway,
 282  * as other data at that layer might not be IP addresses, and it
 283  * also needs to check whether they're present in the packet buffer.
 284  */
 285 const char *
 286 ipaddr_string(netdissect_options *ndo, const u_char *ap)
 287 {
 288         struct hostent *hp;
 289         uint32_t addr;
 290         struct hnamemem *p;
 291
 292         memcpy(&addr, ap, sizeof(addr));
 293         p = &hnametable[addr & (HASHNAMESIZE-1)];
 294         for (; p->nxt; p = p->nxt) {
 295                 if (p->addr == addr)
 296                         return (p->name);
 297         }
 298         p->addr = addr;
 299         p->nxt = newhnamemem(ndo);
 300
 301         /*
 302          * Print names unless:
 303          *      (1) -n was given.
 304          *      (2) Address is foreign and -f was given. (If -f was not
 305          *          given, f_netmask and f_localnet are 0 and the test
 306          *          evaluates to true)
 307          */
 308         if (!ndo->ndo_nflag &&
 309             (addr & f_netmask) == f_localnet) {
 310 #ifdef HAVE_CASPER
 311                 if (capdns != NULL) {
 312                         hp = cap_gethostbyaddr(capdns, (char *)&addr, 4,
 313                             AF_INET);
 314                 } else
 315 #endif
 316                         hp = gethostbyaddr((char *)&addr, 4, AF_INET);
 317                 if (hp) {
 318                         char *dotp;
 319
 320                         p->name = strdup(hp->h_name);
 321                         if (p->name == NULL)
 322                                 (*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
 323                                         "ipaddr_string: strdup(hp->h_name)");
 324                         if (ndo->ndo_Nflag) {
 325                                 /* Remove domain qualifications */
 326                                 dotp = strchr(p->name, '.');
 327                                 if (dotp)
 328                                         *dotp = '\0';
 329                         }
 330                         return (p->name);
 331                 }
 332         }
 333         p->name = strdup(intoa(addr));
 334         if (p->name == NULL)
 335                 (*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
 336                                   "ipaddr_string: strdup(intoa(addr))");
 337         return (p->name);
 338 }
 339
 340 /*
 341  * Return a name for the IP6 address pointed to by ap.  This address
 342  * is assumed to be in network byte order.
 343  */
 344 const char *
 345 ip6addr_string(netdissect_options *ndo, const u_char *ap)
 346 {
 347         struct hostent *hp;
 348         union {
 349                 struct in6_addr addr;
 350                 struct for_hash_addr {
 351                         char fill[14];
 352                         uint16_t d;
 353                 } addra;
 354         } addr;
 355         struct h6namemem *p;
 356         const char *cp;
 357         char ntop_buf[INET6_ADDRSTRLEN];
 358
 359         memcpy(&addr, ap, sizeof(addr));
 360         p = &h6nametable[addr.addra.d & (HASHNAMESIZE-1)];
 361         for (; p->nxt; p = p->nxt) {
 362                 if (memcmp(&p->addr, &addr, sizeof(addr)) == 0)
 363                         return (p->name);
 364         }
 365         p->addr = addr.addr;
 366         p->nxt = newh6namemem(ndo);
 367
 368         /*
 369          * Do not print names if -n was given.
 370          */
 371         if (!ndo->ndo_nflag) {
 372 #ifdef HAVE_CASPER
 373                 if (capdns != NULL) {
 374                         hp = cap_gethostbyaddr(capdns, (char *)&addr,
 375                             sizeof(addr), AF_INET6);
 376                 } else
 377 #endif
 378                         hp = gethostbyaddr((char *)&addr, sizeof(addr),
 379                             AF_INET6);
 380                 if (hp) {
 381                         char *dotp;
 382
 383                         p->name = strdup(hp->h_name);
 384                         if (p->name == NULL)
 385                                 (*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
 386                                         "ip6addr_string: strdup(hp->h_name)");
 387                         if (ndo->ndo_Nflag) {
 388                                 /* Remove domain qualifications */
 389                                 dotp = strchr(p->name, '.');
 390                                 if (dotp)
 391                                         *dotp = '\0';
 392                         }
 393                         return (p->name);
 394                 }
 395         }
 396         cp = addrtostr6(ap, ntop_buf, sizeof(ntop_buf));
 397         p->name = strdup(cp);
 398         if (p->name == NULL)
 399                 (*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
 400                                   "ip6addr_string: strdup(cp)");
 401         return (p->name);
 402 }
 403
 404 static const char hex[16] = {
 405         '0', '1', '2', '3', '4', '5', '6', '7',
 406         '8', '9', 'a', 'b', 'c', 'd', 'e', 'f'
 407 };
 408
 409 /* Find the hash node that corresponds the ether address 'ep' */
 410
 411 static struct enamemem *
 412 lookup_emem(netdissect_options *ndo, const u_char *ep)
 413 {
 414         u_int i, j, k;
 415         struct enamemem *tp;
 416
 417         k = (ep[0] << 8) | ep[1];
 418         j = (ep[2] << 8) | ep[3];
 419         i = (ep[4] << 8) | ep[5];
 420
 421         tp = &enametable[(i ^ j) & (HASHNAMESIZE-1)];
 422         while (tp->e_nxt)
 423                 if (tp->e_addr0 == i &&
 424                     tp->e_addr1 == j &&
 425                     tp->e_addr2 == k)
 426                         return tp;
 427                 else
 428                         tp = tp->e_nxt;
 429         tp->e_addr0 = i;
 430         tp->e_addr1 = j;
 431         tp->e_addr2 = k;
 432         tp->e_nxt = (struct enamemem *)calloc(1, sizeof(*tp));
 433         if (tp->e_nxt == NULL)
 434                 (*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC, "lookup_emem: calloc");
 435
 436         return tp;
 437 }
 438
 439 /*
 440  * Find the hash node that corresponds to the bytestring 'bs'
 441  * with length 'nlen'
 442  */
 443
 444 static struct bsnamemem *
 445 lookup_bytestring(netdissect_options *ndo, const u_char *bs,
 446                   const unsigned int nlen)
 447 {
 448         struct bsnamemem *tp;
 449         u_int i, j, k;
 450
 451         if (nlen >= 6) {
 452                 k = (bs[0] << 8) | bs[1];
 453                 j = (bs[2] << 8) | bs[3];
 454                 i = (bs[4] << 8) | bs[5];
 455         } else if (nlen >= 4) {
 456                 k = (bs[0] << 8) | bs[1];
 457                 j = (bs[2] << 8) | bs[3];
 458                 i = 0;
 459         } else
 460                 i = j = k = 0;
 461
 462         tp = &bytestringtable[(i ^ j) & (HASHNAMESIZE-1)];
 463         while (tp->bs_nxt)
 464                 if (nlen == tp->bs_nbytes &&
 465                     tp->bs_addr0 == i &&
 466                     tp->bs_addr1 == j &&
 467                     tp->bs_addr2 == k &&
 468                     memcmp((const char *)bs, (const char *)(tp->bs_bytes), nlen) == 0)
 469                         return tp;
 470                 else
 471                         tp = tp->bs_nxt;
 472
 473         tp->bs_addr0 = i;
 474         tp->bs_addr1 = j;
 475         tp->bs_addr2 = k;
 476
 477         tp->bs_bytes = (u_char *) calloc(1, nlen);
 478         if (tp->bs_bytes == NULL)
 479                 (*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
 480                                   "lookup_bytestring: calloc");
 481
 482         memcpy(tp->bs_bytes, bs, nlen);
 483         tp->bs_nbytes = nlen;
 484         tp->bs_nxt = (struct bsnamemem *)calloc(1, sizeof(*tp));
 485         if (tp->bs_nxt == NULL)
 486                 (*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
 487                                   "lookup_bytestring: calloc");
 488
 489         return tp;
 490 }
 491
 492 /* Find the hash node that corresponds the NSAP 'nsap' */
 493
 494 static struct enamemem *
 495 lookup_nsap(netdissect_options *ndo, const u_char *nsap,
 496             u_int nsap_length)
 497 {
 498         u_int i, j, k;
 499         struct enamemem *tp;
 500         const u_char *ensap;
 501
 502         if (nsap_length > 6) {
 503                 ensap = nsap + nsap_length - 6;
 504                 k = (ensap[0] << 8) | ensap[1];
 505                 j = (ensap[2] << 8) | ensap[3];
 506                 i = (ensap[4] << 8) | ensap[5];
 507         }
 508         else
 509                 i = j = k = 0;
 510
 511         tp = &nsaptable[(i ^ j) & (HASHNAMESIZE-1)];
 512         while (tp->e_nxt)
 513                 if (nsap_length == tp->e_nsap[0] &&
 514                     tp->e_addr0 == i &&
 515                     tp->e_addr1 == j &&
 516                     tp->e_addr2 == k &&
 517                     memcmp((const char *)nsap,
 518                         (char *)&(tp->e_nsap[1]), nsap_length) == 0)
 519                         return tp;
 520                 else
 521                         tp = tp->e_nxt;
 522         tp->e_addr0 = i;
 523         tp->e_addr1 = j;
 524         tp->e_addr2 = k;
 525         tp->e_nsap = (u_char *)malloc(nsap_length + 1);
 526         if (tp->e_nsap == NULL)
 527                 (*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC, "lookup_nsap: malloc");
 528         tp->e_nsap[0] = (u_char)nsap_length;    /* guaranteed < ISONSAP_MAX_LENGTH */
 529         memcpy((char *)&tp->e_nsap[1], (const char *)nsap, nsap_length);
 530         tp->e_nxt = (struct enamemem *)calloc(1, sizeof(*tp));
 531         if (tp->e_nxt == NULL)
 532                 (*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC, "lookup_nsap: calloc");
 533
 534         return tp;
 535 }
 536
 537 /* Find the hash node that corresponds the protoid 'pi'. */
 538
 539 static struct protoidmem *
 540 lookup_protoid(netdissect_options *ndo, const u_char *pi)
 541 {
 542         u_int i, j;
 543         struct protoidmem *tp;
 544
 545         /* 5 octets won't be aligned */
 546         i = (((pi[0] << 8) + pi[1]) << 8) + pi[2];
 547         j =   (pi[3] << 8) + pi[4];
 548         /* XXX should be endian-insensitive, but do big-endian testing  XXX */
 549
 550         tp = &protoidtable[(i ^ j) & (HASHNAMESIZE-1)];
 551         while (tp->p_nxt)
 552                 if (tp->p_oui == i && tp->p_proto == j)
 553                         return tp;
 554                 else
 555                         tp = tp->p_nxt;
 556         tp->p_oui = i;
 557         tp->p_proto = j;
 558         tp->p_nxt = (struct protoidmem *)calloc(1, sizeof(*tp));
 559         if (tp->p_nxt == NULL)
 560                 (*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC, "lookup_protoid: calloc");
 561
 562         return tp;
 563 }
 564
 565 const char *
 566 etheraddr_string(netdissect_options *ndo, const u_char *ep)
 567 {
 568         int i;
 569         char *cp;
 570         struct enamemem *tp;
 571         int oui;
 572         char buf[BUFSIZE];
 573
 574         tp = lookup_emem(ndo, ep);
 575         if (tp->e_name)
 576                 return (tp->e_name);
 577 #ifdef USE_ETHER_NTOHOST
 578         if (!ndo->ndo_nflag) {
 579                 char buf2[BUFSIZE];
 580
 581                 if (ether_ntohost(buf2, (const struct ether_addr *)ep) == 0) {
 582                         tp->e_name = strdup(buf2);
 583                         if (tp->e_name == NULL)
 584                                 (*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
 585                                         "etheraddr_string: strdup(buf2)");
 586                         return (tp->e_name);
 587                 }
 588         }
 589 #endif
 590         cp = buf;
 591         oui = EXTRACT_BE_U_3(ep);
 592         *cp++ = hex[*ep >> 4 ];
 593         *cp++ = hex[*ep++ & 0xf];
 594         for (i = 5; --i >= 0;) {
 595                 *cp++ = ':';
 596                 *cp++ = hex[*ep >> 4 ];
 597                 *cp++ = hex[*ep++ & 0xf];
 598         }
 599
 600         if (!ndo->ndo_nflag) {
 601                 nd_snprintf(cp, BUFSIZE - (2 + 5*3), " (oui %s)",
 602                     tok2str(oui_values, "Unknown", oui));
 603         } else
 604                 *cp = '\0';
 605         tp->e_name = strdup(buf);
 606         if (tp->e_name == NULL)
 607                 (*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
 608                                   "etheraddr_string: strdup(buf)");
 609         return (tp->e_name);
 610 }
 611
 612 const char *
 613 le64addr_string(netdissect_options *ndo, const u_char *ep)
 614 {
 615         const unsigned int len = 8;
 616         u_int i;
 617         char *cp;
 618         struct bsnamemem *tp;
 619         char buf[BUFSIZE];
 620
 621         tp = lookup_bytestring(ndo, ep, len);
 622         if (tp->bs_name)
 623                 return (tp->bs_name);
 624
 625         cp = buf;
 626         for (i = len; i > 0 ; --i) {
 627                 *cp++ = hex[*(ep + i - 1) >> 4];
 628                 *cp++ = hex[*(ep + i - 1) & 0xf];
 629                 *cp++ = ':';
 630         }
 631         cp --;
 632
 633         *cp = '\0';
 634
 635         tp->bs_name = strdup(buf);
 636         if (tp->bs_name == NULL)
 637                 (*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
 638                                   "le64addr_string: strdup(buf)");
 639
 640         return (tp->bs_name);
 641 }
 642
 643 const char *
 644 linkaddr_string(netdissect_options *ndo, const u_char *ep,
 645                 const unsigned int type, const unsigned int len)
 646 {
 647         u_int i;
 648         char *cp;
 649         struct bsnamemem *tp;
 650
 651         if (len == 0)
 652                 return ("<empty>");
 653
 654         if (type == LINKADDR_ETHER && len == MAC_ADDR_LEN)
 655                 return (etheraddr_string(ndo, ep));
 656
 657         if (type == LINKADDR_FRELAY)
 658                 return (q922_string(ndo, ep, len));
 659
 660         tp = lookup_bytestring(ndo, ep, len);
 661         if (tp->bs_name)
 662                 return (tp->bs_name);
 663
 664         tp->bs_name = cp = (char *)malloc(len*3);
 665         if (tp->bs_name == NULL)
 666                 (*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
 667                                   "linkaddr_string: malloc");
 668         *cp++ = hex[*ep >> 4];
 669         *cp++ = hex[*ep++ & 0xf];
 670         for (i = len-1; i > 0 ; --i) {
 671                 *cp++ = ':';
 672                 *cp++ = hex[*ep >> 4];
 673                 *cp++ = hex[*ep++ & 0xf];
 674         }
 675         *cp = '\0';
 676         return (tp->bs_name);
 677 }
 678
 679 const char *
 680 etherproto_string(netdissect_options *ndo, u_short port)
 681 {
 682         char *cp;
 683         struct hnamemem *tp;
 684         uint32_t i = port;
 685         char buf[sizeof("0000")];
 686
 687         for (tp = &eprototable[i & (HASHNAMESIZE-1)]; tp->nxt; tp = tp->nxt)
 688                 if (tp->addr == i)
 689                         return (tp->name);
 690
 691         tp->addr = i;
 692         tp->nxt = newhnamemem(ndo);
 693
 694         cp = buf;
 695         NTOHS(port);
 696         *cp++ = hex[port >> 12 & 0xf];
 697         *cp++ = hex[port >> 8 & 0xf];
 698         *cp++ = hex[port >> 4 & 0xf];
 699         *cp++ = hex[port & 0xf];
 700         *cp++ = '\0';
 701         tp->name = strdup(buf);
 702         if (tp->name == NULL)
 703                 (*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
 704                                   "etherproto_string: strdup(buf)");
 705         return (tp->name);
 706 }
 707
 708 #define ISONSAP_MAX_LENGTH 20
 709 const char *
 710 isonsap_string(netdissect_options *ndo, const u_char *nsap,
 711                u_int nsap_length)
 712 {
 713         u_int nsap_idx;
 714         char *cp;
 715         struct enamemem *tp;
 716
 717         if (nsap_length < 1 || nsap_length > ISONSAP_MAX_LENGTH)
 718                 return ("isonsap_string: illegal length");
 719
 720         tp = lookup_nsap(ndo, nsap, nsap_length);
 721         if (tp->e_name)
 722                 return tp->e_name;
 723
 724         tp->e_name = cp = (char *)malloc(sizeof("xx.xxxx.xxxx.xxxx.xxxx.xxxx.xxxx.xxxx.xxxx.xxxx.xx"));
 725         if (cp == NULL)
 726                 (*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
 727                                   "isonsap_string: malloc");
 728
 729         for (nsap_idx = 0; nsap_idx < nsap_length; nsap_idx++) {
 730                 *cp++ = hex[*nsap >> 4];
 731                 *cp++ = hex[*nsap++ & 0xf];
 732                 if (((nsap_idx & 1) == 0) &&
 733                      (nsap_idx + 1 < nsap_length)) {
 734                         *cp++ = '.';
 735                 }
 736         }
 737         *cp = '\0';
 738         return (tp->e_name);
 739 }
 740
 741 const char *
 742 tcpport_string(netdissect_options *ndo, u_short port)
 743 {
 744         struct hnamemem *tp;
 745         uint32_t i = port;
 746         char buf[sizeof("00000")];
 747
 748         for (tp = &tporttable[i & (HASHNAMESIZE-1)]; tp->nxt; tp = tp->nxt)
 749                 if (tp->addr == i)
 750                         return (tp->name);
 751
 752         tp->addr = i;
 753         tp->nxt = newhnamemem(ndo);
 754
 755         (void)nd_snprintf(buf, sizeof(buf), "%u", i);
 756         tp->name = strdup(buf);
 757         if (tp->name == NULL)
 758                 (*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
 759                                   "tcpport_string: strdup(buf)");
 760         return (tp->name);
 761 }
 762
 763 const char *
 764 udpport_string(netdissect_options *ndo, u_short port)
 765 {
 766         struct hnamemem *tp;
 767         uint32_t i = port;
 768         char buf[sizeof("00000")];
 769
 770         for (tp = &uporttable[i & (HASHNAMESIZE-1)]; tp->nxt; tp = tp->nxt)
 771                 if (tp->addr == i)
 772                         return (tp->name);
 773
 774         tp->addr = i;
 775         tp->nxt = newhnamemem(ndo);
 776
 777         (void)nd_snprintf(buf, sizeof(buf), "%u", i);
 778         tp->name = strdup(buf);
 779         if (tp->name == NULL)
 780                 (*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
 781                                   "udpport_string: strdup(buf)");
 782         return (tp->name);
 783 }
 784
 785 const char *
 786 ipxsap_string(netdissect_options *ndo, u_short port)
 787 {
 788         char *cp;
 789         struct hnamemem *tp;
 790         uint32_t i = port;
 791         char buf[sizeof("0000")];
 792
 793         for (tp = &ipxsaptable[i & (HASHNAMESIZE-1)]; tp->nxt; tp = tp->nxt)
 794                 if (tp->addr == i)
 795                         return (tp->name);
 796
 797         tp->addr = i;
 798         tp->nxt = newhnamemem(ndo);
 799
 800         cp = buf;
 801         NTOHS(port);
 802         *cp++ = hex[port >> 12 & 0xf];
 803         *cp++ = hex[port >> 8 & 0xf];
 804         *cp++ = hex[port >> 4 & 0xf];
 805         *cp++ = hex[port & 0xf];
 806         *cp++ = '\0';
 807         tp->name = strdup(buf);
 808         if (tp->name == NULL)
 809                 (*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
 810                                   "ipxsap_string: strdup(buf)");
 811         return (tp->name);
 812 }
 813
 814 static void
 815 init_servarray(netdissect_options *ndo)
 816 {
 817         struct servent *sv;
 818         struct hnamemem *table;
 819         int i;
 820         char buf[sizeof("0000000000")];
 821
 822         while ((sv = getservent()) != NULL) {
 823                 int port = ntohs(sv->s_port);
 824                 i = port & (HASHNAMESIZE-1);
 825                 if (strcmp(sv->s_proto, "tcp") == 0)
 826                         table = &tporttable[i];
 827                 else if (strcmp(sv->s_proto, "udp") == 0)
 828                         table = &uporttable[i];
 829                 else
 830                         continue;
 831
 832                 while (table->name)
 833                         table = table->nxt;
 834                 if (ndo->ndo_nflag) {
 835                         (void)nd_snprintf(buf, sizeof(buf), "%d", port);
 836                         table->name = strdup(buf);
 837                 } else
 838                         table->name = strdup(sv->s_name);
 839                 if (table->name == NULL)
 840                         (*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
 841                                           "init_servarray: strdup");
 842
 843                 table->addr = port;
 844                 table->nxt = newhnamemem(ndo);
 845         }
 846         endservent();
 847 }
 848
 849 static const struct eproto {
 850         const char *s;
 851         u_short p;
 852 } eproto_db[] = {
 853         { "pup", ETHERTYPE_PUP },
 854         { "xns", ETHERTYPE_NS },
 855         { "ip", ETHERTYPE_IP },
 856         { "ip6", ETHERTYPE_IPV6 },
 857         { "arp", ETHERTYPE_ARP },
 858         { "rarp", ETHERTYPE_REVARP },
 859         { "sprite", ETHERTYPE_SPRITE },
 860         { "mopdl", ETHERTYPE_MOPDL },
 861         { "moprc", ETHERTYPE_MOPRC },
 862         { "decnet", ETHERTYPE_DN },
 863         { "lat", ETHERTYPE_LAT },
 864         { "sca", ETHERTYPE_SCA },
 865         { "lanbridge", ETHERTYPE_LANBRIDGE },
 866         { "vexp", ETHERTYPE_VEXP },
 867         { "vprod", ETHERTYPE_VPROD },
 868         { "atalk", ETHERTYPE_ATALK },
 869         { "atalkarp", ETHERTYPE_AARP },
 870         { "loopback", ETHERTYPE_LOOPBACK },
 871         { "decdts", ETHERTYPE_DECDTS },
 872         { "decdns", ETHERTYPE_DECDNS },
 873         { (char *)0, 0 }
 874 };
 875
 876 static void
 877 init_eprotoarray(netdissect_options *ndo)
 878 {
 879         int i;
 880         struct hnamemem *table;
 881
 882         for (i = 0; eproto_db[i].s; i++) {
 883                 int j = htons(eproto_db[i].p) & (HASHNAMESIZE-1);
 884                 table = &eprototable[j];
 885                 while (table->name)
 886                         table = table->nxt;
 887                 table->name = eproto_db[i].s;
 888                 table->addr = htons(eproto_db[i].p);
 889                 table->nxt = newhnamemem(ndo);
 890         }
 891 }
 892
 893 static const struct protoidlist {
 894         const u_char protoid[5];
 895         const char *name;
 896 } protoidlist[] = {
 897         {{ 0x00, 0x00, 0x0c, 0x01, 0x07 }, "CiscoMLS" },
 898         {{ 0x00, 0x00, 0x0c, 0x20, 0x00 }, "CiscoCDP" },
 899         {{ 0x00, 0x00, 0x0c, 0x20, 0x01 }, "CiscoCGMP" },
 900         {{ 0x00, 0x00, 0x0c, 0x20, 0x03 }, "CiscoVTP" },
 901         {{ 0x00, 0xe0, 0x2b, 0x00, 0xbb }, "ExtremeEDP" },
 902         {{ 0x00, 0x00, 0x00, 0x00, 0x00 }, NULL }
 903 };
 904
 905 /*
 906  * SNAP proto IDs with org code 0:0:0 are actually encapsulated Ethernet
 907  * types.
 908  */
 909 static void
 910 init_protoidarray(netdissect_options *ndo)
 911 {
 912         int i;
 913         struct protoidmem *tp;
 914         const struct protoidlist *pl;
 915         u_char protoid[5];
 916
 917         protoid[0] = 0;
 918         protoid[1] = 0;
 919         protoid[2] = 0;
 920         for (i = 0; eproto_db[i].s; i++) {
 921                 u_short etype = htons(eproto_db[i].p);
 922
 923                 memcpy((char *)&protoid[3], (char *)&etype, 2);
 924                 tp = lookup_protoid(ndo, protoid);
 925                 tp->p_name = strdup(eproto_db[i].s);
 926                 if (tp->p_name == NULL)
 927                         (*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
 928                                 "init_protoidarray: strdup(eproto_db[i].s)");
 929         }
 930         /* Hardwire some SNAP proto ID names */
 931         for (pl = protoidlist; pl->name != NULL; ++pl) {
 932                 tp = lookup_protoid(ndo, pl->protoid);
 933                 /* Don't override existing name */
 934                 if (tp->p_name != NULL)
 935                         continue;
 936
 937                 tp->p_name = pl->name;
 938         }
 939 }
 940
 941 static const struct etherlist {
 942         const u_char addr[6];
 943         const char *name;
 944 } etherlist[] = {
 945         {{ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff }, "Broadcast" },
 946         {{ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }, NULL }
 947 };
 948
 949 /*
 950  * Initialize the ethers hash table.  We take two different approaches
 951  * depending on whether or not the system provides the ethers name
 952  * service.  If it does, we just wire in a few names at startup,
 953  * and etheraddr_string() fills in the table on demand.  If it doesn't,
 954  * then we suck in the entire /etc/ethers file at startup.  The idea
 955  * is that parsing the local file will be fast, but spinning through
 956  * all the ethers entries via NIS & next_etherent might be very slow.
 957  *
 958  * XXX pcap_next_etherent doesn't belong in the pcap interface, but
 959  * since the pcap module already does name-to-address translation,
 960  * it's already does most of the work for the ethernet address-to-name
 961  * translation, so we just pcap_next_etherent as a convenience.
 962  */
 963 static void
 964 init_etherarray(netdissect_options *ndo)
 965 {
 966         const struct etherlist *el;
 967         struct enamemem *tp;
 968 #ifdef USE_ETHER_NTOHOST
 969         char name[256];
 970 #else
 971         struct pcap_etherent *ep;
 972         FILE *fp;
 973
 974         /* Suck in entire ethers file */
 975         fp = fopen(PCAP_ETHERS_FILE, "r");
 976         if (fp != NULL) {
 977                 while ((ep = pcap_next_etherent(fp)) != NULL) {
 978                         tp = lookup_emem(ndo, ep->addr);
 979                         tp->e_name = strdup(ep->name);
 980                         if (tp->e_name == NULL)
 981                                 (*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
 982                                         "init_etherarray: strdup(ep->addr)");
 983                 }
 984                 (void)fclose(fp);
 985         }
 986 #endif
 987
 988         /* Hardwire some ethernet names */
 989         for (el = etherlist; el->name != NULL; ++el) {
 990                 tp = lookup_emem(ndo, el->addr);
 991                 /* Don't override existing name */
 992                 if (tp->e_name != NULL)
 993                         continue;
 994
 995 #ifdef USE_ETHER_NTOHOST
 996                 /*
 997                  * Use YP/NIS version of name if available.
 998                  */
 999                 if (ether_ntohost(name, (const struct ether_addr *)el->addr) == 0) {
1000                         tp->e_name = strdup(name);
1001                         if (tp->e_name == NULL)
1002                                 (*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
1003                                         "init_etherarray: strdup(name)");
1004                         continue;
1005                 }
1006 #endif
1007                 tp->e_name = el->name;
1008         }
1009 }
1010
1011 static const struct tok ipxsap_db[] = {
1012         { 0x0000, "Unknown" },
1013         { 0x0001, "User" },
1014         { 0x0002, "User Group" },
1015         { 0x0003, "PrintQueue" },
1016         { 0x0004, "FileServer" },
1017         { 0x0005, "JobServer" },
1018         { 0x0006, "Gateway" },
1019         { 0x0007, "PrintServer" },
1020         { 0x0008, "ArchiveQueue" },
1021         { 0x0009, "ArchiveServer" },
1022         { 0x000a, "JobQueue" },
1023         { 0x000b, "Administration" },
1024         { 0x000F, "Novell TI-RPC" },
1025         { 0x0017, "Diagnostics" },
1026         { 0x0020, "NetBIOS" },
1027         { 0x0021, "NAS SNA Gateway" },
1028         { 0x0023, "NACS AsyncGateway" },
1029         { 0x0024, "RemoteBridge/RoutingService" },
1030         { 0x0026, "BridgeServer" },
1031         { 0x0027, "TCP/IP Gateway" },
1032         { 0x0028, "Point-to-point X.25 BridgeServer" },
1033         { 0x0029, "3270 Gateway" },
1034         { 0x002a, "CHI Corp" },
1035         { 0x002c, "PC Chalkboard" },
1036         { 0x002d, "TimeSynchServer" },
1037         { 0x002e, "ARCserve5.0/PalindromeBackup" },
1038         { 0x0045, "DI3270 Gateway" },
1039         { 0x0047, "AdvertisingPrintServer" },
1040         { 0x004a, "NetBlazerModems" },
1041         { 0x004b, "BtrieveVAP" },
1042         { 0x004c, "NetwareSQL" },
1043         { 0x004d, "XtreeNetwork" },
1044         { 0x0050, "BtrieveVAP4.11" },
1045         { 0x0052, "QuickLink" },
1046         { 0x0053, "PrintQueueUser" },
1047         { 0x0058, "Multipoint X.25 Router" },
1048         { 0x0060, "STLB/NLM" },
1049         { 0x0064, "ARCserve" },
1050         { 0x0066, "ARCserve3.0" },
1051         { 0x0072, "WAN CopyUtility" },
1052         { 0x007a, "TES-NetwareVMS" },
1053         { 0x0092, "WATCOM Debugger/EmeraldTapeBackupServer" },
1054         { 0x0095, "DDA OBGYN" },
1055         { 0x0098, "NetwareAccessServer" },
1056         { 0x009a, "Netware for VMS II/NamedPipeServer" },
1057         { 0x009b, "NetwareAccessServer" },
1058         { 0x009e, "PortableNetwareServer/SunLinkNVT" },
1059         { 0x00a1, "PowerchuteAPC UPS" },
1060         { 0x00aa, "LAWserve" },
1061         { 0x00ac, "CompaqIDA StatusMonitor" },
1062         { 0x0100, "PIPE STAIL" },
1063         { 0x0102, "LAN ProtectBindery" },
1064         { 0x0103, "OracleDataBaseServer" },
1065         { 0x0107, "Netware386/RSPX RemoteConsole" },
1066         { 0x010f, "NovellSNA Gateway" },
1067         { 0x0111, "TestServer" },
1068         { 0x0112, "HP PrintServer" },
1069         { 0x0114, "CSA MUX" },
1070         { 0x0115, "CSA LCA" },
1071         { 0x0116, "CSA CM" },
1072         { 0x0117, "CSA SMA" },
1073         { 0x0118, "CSA DBA" },
1074         { 0x0119, "CSA NMA" },
1075         { 0x011a, "CSA SSA" },
1076         { 0x011b, "CSA STATUS" },
1077         { 0x011e, "CSA APPC" },
1078         { 0x0126, "SNA TEST SSA Profile" },
1079         { 0x012a, "CSA TRACE" },
1080         { 0x012b, "NetwareSAA" },
1081         { 0x012e, "IKARUS VirusScan" },
1082         { 0x0130, "CommunicationsExecutive" },
1083         { 0x0133, "NNS DomainServer/NetwareNamingServicesDomain" },
1084         { 0x0135, "NetwareNamingServicesProfile" },
1085         { 0x0137, "Netware386 PrintQueue/NNS PrintQueue" },
1086         { 0x0141, "LAN SpoolServer" },
1087         { 0x0152, "IRMALAN Gateway" },
1088         { 0x0154, "NamedPipeServer" },
1089         { 0x0166, "NetWareManagement" },
1090         { 0x0168, "Intel PICKIT CommServer/Intel CAS TalkServer" },
1091         { 0x0173, "Compaq" },
1092         { 0x0174, "Compaq SNMP Agent" },
1093         { 0x0175, "Compaq" },
1094         { 0x0180, "XTreeServer/XTreeTools" },
1095         { 0x018A, "NASI ServicesBroadcastServer" },
1096         { 0x01b0, "GARP Gateway" },
1097         { 0x01b1, "Binfview" },
1098         { 0x01bf, "IntelLanDeskManager" },
1099         { 0x01ca, "AXTEC" },
1100         { 0x01cb, "ShivaNetModem/E" },
1101         { 0x01cc, "ShivaLanRover/E" },
1102         { 0x01cd, "ShivaLanRover/T" },
1103         { 0x01ce, "ShivaUniversal" },
1104         { 0x01d8, "CastelleFAXPressServer" },
1105         { 0x01da, "CastelleLANPressPrintServer" },
1106         { 0x01dc, "CastelleFAX/Xerox7033 FaxServer/ExcelLanFax" },
1107         { 0x01f0, "LEGATO" },
1108         { 0x01f5, "LEGATO" },
1109         { 0x0233, "NMS Agent/NetwareManagementAgent" },
1110         { 0x0237, "NMS IPX Discovery/LANternReadWriteChannel" },
1111         { 0x0238, "NMS IP Discovery/LANternTrapAlarmChannel" },
1112         { 0x023a, "LANtern" },
1113         { 0x023c, "MAVERICK" },
1114         { 0x023f, "NovellSMDR" },
1115         { 0x024e, "NetwareConnect" },
1116         { 0x024f, "NASI ServerBroadcast Cisco" },
1117         { 0x026a, "NMS ServiceConsole" },
1118         { 0x026b, "TimeSynchronizationServer Netware 4.x" },
1119         { 0x0278, "DirectoryServer Netware 4.x" },
1120         { 0x027b, "NetwareManagementAgent" },
1121         { 0x0280, "Novell File and Printer Sharing Service for PC" },
1122         { 0x0304, "NovellSAA Gateway" },
1123         { 0x0308, "COM/VERMED" },
1124         { 0x030a, "GalacticommWorldgroupServer" },
1125         { 0x030c, "IntelNetport2/HP JetDirect/HP Quicksilver" },
1126         { 0x0320, "AttachmateGateway" },
1127         { 0x0327, "MicrosoftDiagnostiocs" },
1128         { 0x0328, "WATCOM SQL Server" },
1129         { 0x0335, "MultiTechSystems MultisynchCommServer" },
1130         { 0x0343, "Xylogics RemoteAccessServer/LANModem" },
1131         { 0x0355, "ArcadaBackupExec" },
1132         { 0x0358, "MSLCD1" },
1133         { 0x0361, "NETINELO" },
1134         { 0x037e, "Powerchute UPS Monitoring" },
1135         { 0x037f, "ViruSafeNotify" },
1136         { 0x0386, "HP Bridge" },
1137         { 0x0387, "HP Hub" },
1138         { 0x0394, "NetWare SAA Gateway" },
1139         { 0x039b, "LotusNotes" },
1140         { 0x03b7, "CertusAntiVirus" },
1141         { 0x03c4, "ARCserve4.0" },
1142         { 0x03c7, "LANspool3.5" },
1143         { 0x03d7, "LexmarkPrinterServer" },
1144         { 0x03d8, "LexmarkXLE PrinterServer" },
1145         { 0x03dd, "BanyanENS NetwareClient" },
1146         { 0x03de, "GuptaSequelBaseServer/NetWareSQL" },
1147         { 0x03e1, "UnivelUnixware" },
1148         { 0x03e4, "UnivelUnixware" },
1149         { 0x03fc, "IntelNetport" },
1150         { 0x03fd, "PrintServerQueue" },
1151         { 0x040A, "ipnServer" },
1152         { 0x040D, "LVERRMAN" },
1153         { 0x040E, "LVLIC" },
1154         { 0x0414, "NET Silicon (DPI)/Kyocera" },
1155         { 0x0429, "SiteLockVirus" },
1156         { 0x0432, "UFHELPR???" },
1157         { 0x0433, "Synoptics281xAdvancedSNMPAgent" },
1158         { 0x0444, "MicrosoftNT SNA Server" },
1159         { 0x0448, "Oracle" },
1160         { 0x044c, "ARCserve5.01" },
1161         { 0x0457, "CanonGP55" },
1162         { 0x045a, "QMS Printers" },
1163         { 0x045b, "DellSCSI Array" },
1164         { 0x0491, "NetBlazerModems" },
1165         { 0x04ac, "OnTimeScheduler" },
1166         { 0x04b0, "CD-Net" },
1167         { 0x0513, "EmulexNQA" },
1168         { 0x0520, "SiteLockChecks" },
1169         { 0x0529, "SiteLockChecks" },
1170         { 0x052d, "CitrixOS2 AppServer" },
1171         { 0x0535, "Tektronix" },
1172         { 0x0536, "Milan" },
1173         { 0x055d, "Attachmate SNA gateway" },
1174         { 0x056b, "IBM8235 ModemServer" },
1175         { 0x056c, "ShivaLanRover/E PLUS" },
1176         { 0x056d, "ShivaLanRover/T PLUS" },
1177         { 0x0580, "McAfeeNetShield" },
1178         { 0x05B8, "NLM to workstation communication (Revelation Software)" },
1179         { 0x05BA, "CompatibleSystemsRouters" },
1180         { 0x05BE, "CheyenneHierarchicalStorageManager" },
1181         { 0x0606, "JCWatermarkImaging" },
1182         { 0x060c, "AXISNetworkPrinter" },
1183         { 0x0610, "AdaptecSCSIManagement" },
1184         { 0x0621, "IBM AntiVirus" },
1185         { 0x0640, "Windows95 RemoteRegistryService" },
1186         { 0x064e, "MicrosoftIIS" },
1187         { 0x067b, "Microsoft Win95/98 File and Print Sharing for NetWare" },
1188         { 0x067c, "Microsoft Win95/98 File and Print Sharing for NetWare" },
1189         { 0x076C, "Xerox" },
1190         { 0x079b, "ShivaLanRover/E 115" },
1191         { 0x079c, "ShivaLanRover/T 115" },
1192         { 0x07B4, "CubixWorldDesk" },
1193         { 0x07c2, "Quarterdeck IWare Connect V2.x NLM" },
1194         { 0x07c1, "Quarterdeck IWare Connect V3.x NLM" },
1195         { 0x0810, "ELAN License Server Demo" },
1196         { 0x0824, "ShivaLanRoverAccessSwitch/E" },
1197         { 0x086a, "ISSC Collector" },
1198         { 0x087f, "ISSC DAS AgentAIX" },
1199         { 0x0880, "Intel Netport PRO" },
1200         { 0x0881, "Intel Netport PRO" },
1201         { 0x0b29, "SiteLock" },
1202         { 0x0c29, "SiteLockApplications" },
1203         { 0x0c2c, "LicensingServer" },
1204         { 0x2101, "PerformanceTechnologyInstantInternet" },
1205         { 0x2380, "LAI SiteLock" },
1206         { 0x238c, "MeetingMaker" },
1207         { 0x4808, "SiteLockServer/SiteLockMetering" },
1208         { 0x5555, "SiteLockUser" },
1209         { 0x6312, "Tapeware" },
1210         { 0x6f00, "RabbitGateway" },
1211         { 0x7703, "MODEM" },
1212         { 0x8002, "NetPortPrinters" },
1213         { 0x8008, "WordPerfectNetworkVersion" },
1214         { 0x85BE, "Cisco EIGRP" },
1215         { 0x8888, "WordPerfectNetworkVersion/QuickNetworkManagement" },
1216         { 0x9000, "McAfeeNetShield" },
1217         { 0x9604, "CSA-NT_MON" },
1218         { 0xb6a8, "OceanIsleReachoutRemoteControl" },
1219         { 0xf11f, "SiteLockMetering" },
1220         { 0xf1ff, "SiteLock" },
1221         { 0xf503, "Microsoft SQL Server" },
1222         { 0xF905, "IBM TimeAndPlace" },
1223         { 0xfbfb, "TopCallIII FaxServer" },
1224         { 0xffff, "AnyService/Wildcard" },
1225         { 0, (char *)0 }
1226 };
1227
1228 static void
1229 init_ipxsaparray(netdissect_options *ndo)
1230 {
1231         int i;
1232         struct hnamemem *table;
1233
1234         for (i = 0; ipxsap_db[i].s != NULL; i++) {
1235                 int j = htons(ipxsap_db[i].v) & (HASHNAMESIZE-1);
1236                 table = &ipxsaptable[j];
1237                 while (table->name)
1238                         table = table->nxt;
1239                 table->name = ipxsap_db[i].s;
1240                 table->addr = htons(ipxsap_db[i].v);
1241                 table->nxt = newhnamemem(ndo);
1242         }
1243 }
1244
1245 /*
1246  * Initialize the address to name translation machinery.  We map all
1247  * non-local IP addresses to numeric addresses if ndo->ndo_fflag is true
1248  * (i.e., to prevent blocking on the nameserver).  localnet is the IP address
1249  * of the local network.  mask is its subnet mask.
1250  */
1251 void
1252 init_addrtoname(netdissect_options *ndo, uint32_t localnet, uint32_t mask)
1253 {
1254         if (ndo->ndo_fflag) {
1255                 f_localnet = localnet;
1256                 f_netmask = mask;
1257         }
1258         if (ndo->ndo_nflag)
1259                 /*
1260                  * Simplest way to suppress names.
1261                  */
1262                 return;
1263
1264         init_etherarray(ndo);
1265         init_servarray(ndo);
1266         init_eprotoarray(ndo);
1267         init_protoidarray(ndo);
1268         init_ipxsaparray(ndo);
1269 }
1270
1271 const char *
1272 dnaddr_string(netdissect_options *ndo, u_short dnaddr)
1273 {
1274         struct hnamemem *tp;
1275
1276         for (tp = &dnaddrtable[dnaddr & (HASHNAMESIZE-1)]; tp->nxt != NULL;
1277              tp = tp->nxt)
1278                 if (tp->addr == dnaddr)
1279                         return (tp->name);
1280
1281         tp->addr = dnaddr;
1282         tp->nxt = newhnamemem(ndo);
1283         if (ndo->ndo_nflag)
1284                 tp->name = dnnum_string(ndo, dnaddr);
1285         else
1286                 tp->name = dnname_string(ndo, dnaddr);
1287
1288         return(tp->name);
1289 }
1290
1291 /* Return a zero'ed hnamemem struct and cuts down on calloc() overhead */
1292 struct hnamemem *
1293 newhnamemem(netdissect_options *ndo)
1294 {
1295         struct hnamemem *p;
1296         static struct hnamemem *ptr = NULL;
1297         static u_int num = 0;
1298
1299         if (num  <= 0) {
1300                 num = 64;
1301                 ptr = (struct hnamemem *)calloc(num, sizeof (*ptr));
1302                 if (ptr == NULL)
1303                         (*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
1304                                           "newhnamemem: calloc");
1305         }
1306         --num;
1307         p = ptr++;
1308         return (p);
1309 }
1310
1311 /* Return a zero'ed h6namemem struct and cuts down on calloc() overhead */
1312 struct h6namemem *
1313 newh6namemem(netdissect_options *ndo)
1314 {
1315         struct h6namemem *p;
1316         static struct h6namemem *ptr = NULL;
1317         static u_int num = 0;
1318
1319         if (num  <= 0) {
1320                 num = 64;
1321                 ptr = (struct h6namemem *)calloc(num, sizeof (*ptr));
1322                 if (ptr == NULL)
1323                         (*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
1324                                           "newh6namemem: calloc");
1325         }
1326         --num;
1327         p = ptr++;
1328         return (p);
1329 }
1330
1331 /* Represent TCI part of the 802.1Q 4-octet tag as text. */
1332 const char *
1333 ieee8021q_tci_string(const uint16_t tci)
1334 {
1335         static char buf[128];
1336         nd_snprintf(buf, sizeof(buf), "vlan %u, p %u%s",
1337                  tci & 0xfff,
1338                  tci >> 13,
1339                  (tci & 0x1000) ? ", DEI" : "");
1340         return buf;
1341 }