The Tcpdump Group git mirrors - tcpdump/blob - print-vjc.c

   1 /*
   2  * Copyright (c) 1990, 1991, 1993, 1994, 1995, 1996, 1997
   3  *      The Regents of the University of California.  All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that: (1) source code distributions
   7  * retain the above copyright notice and this paragraph in its entirety, (2)
   8  * distributions including binary code include the above copyright notice and
   9  * this paragraph in its entirety in the documentation or other materials
  10  * provided with the distribution, and (3) all advertising materials mentioning
  11  * features or use of this software display the following acknowledgement:
  12  * ``This product includes software developed by the University of California,
  13  * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
  14  * the University nor the names of its contributors may be used to endorse
  15  * or promote products derived from this software without specific prior
  16  * written permission.
  17  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
  18  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
  19  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  20  */
  21
  22 /* \summary: PPP Van Jacobson compression printer */
  23
  24 /* specification: RFC 1144 */
  25
  26 #ifdef HAVE_CONFIG_H
  27 #include <config.h>
  28 #endif
  29
  30 #include "netdissect-stdinc.h"
  31
  32 #include "netdissect.h"
  33 #include "extract.h"
  34 #include "slcompress.h"
  35 #include "ppp.h"
  36
  37 /*
  38  * XXX - for BSD/OS PPP, what packets get supplied with a PPP header type
  39  * of PPP_VJC and what packets get supplied with a PPP header type of
  40  * PPP_VJNC?  PPP_VJNC is for "UNCOMPRESSED_TCP" packets, and PPP_VJC
  41  * is for COMPRESSED_TCP packets (PPP_IP is used for TYPE_IP packets).
  42  *
  43  * RFC 1144 implies that, on the wire, the packet type is *not* needed
  44  * for PPP, as different PPP protocol types can be used; it only needs
  45  * to be put on the wire for SLIP.
  46  *
  47  * It also indicates that, for compressed SLIP:
  48  *
  49  *      If the COMPRESSED_TCP bit is set in the first byte, it's
  50  *      a COMPRESSED_TCP packet; that byte is the change byte, and
  51  *      the COMPRESSED_TCP bit, 0x80, isn't used in the change byte.
  52  *
  53  *      If the upper 4 bits of the first byte are 7, it's an
  54  *      UNCOMPRESSED_TCP packet; that byte is the first byte of
  55  *      the UNCOMPRESSED_TCP modified IP header, with a connection
  56  *      number in the protocol field, and with the version field
  57  *      being 7, not 4.
  58  *
  59  *      Otherwise, the packet is an IPv4 packet (where the upper 4 bits
  60  *      of the packet are 4).
  61  *
  62  * So this routine looks as if it's sort-of intended to handle
  63  * compressed SLIP, although it doesn't handle UNCOMPRESSED_TCP
  64  * correctly for that (it doesn't fix the version number and doesn't
  65  * do anything to the protocol field), and doesn't check for COMPRESSED_TCP
  66  * packets correctly for that (you only check the first bit - see
  67  * B.1 in RFC 1144).
  68  *
  69  * But it's called for BSD/OS PPP, not SLIP - perhaps BSD/OS does weird
  70  * things with the headers?
  71  *
  72  * Without a BSD/OS VJC-compressed PPP trace, or knowledge of what the
  73  * BSD/OS VJC code does, we can't say what's the case.
  74  *
  75  * We therefore leave "proto" - which is the PPP protocol type - in place,
  76  * *not* marked as unused, for now, so that GCC warnings about the
  77  * unused argument remind us that we should fix this some day.
  78  *
  79  * XXX - also, it fetches the TCP checksum field in COMPRESSED_TCP
  80  * packets with GET_HE_U_2, rather than with GET_BE_U_2(); RFC 1144 says
  81  * it's "the unmodified TCP checksum", which would imply that it's
  82  * big-endian, but perhaps, on the platform where this was developed,
  83  * the packets were munged by the networking stack before being handed
  84  * to the packet capture mechanism.
  85  */
  86 int
  87 vjc_print(netdissect_options *ndo, const u_char *bp, u_short proto _U_)
  88 {
  89         int i;
  90
  91         ndo->ndo_protocol = "vjc";
  92         switch (GET_U_1(bp) & 0xf0) {
  93         case TYPE_IP:
  94                 if (ndo->ndo_eflag)
  95                         ND_PRINT("(vjc type=IP) ");
  96                 return PPP_IP;
  97         case TYPE_UNCOMPRESSED_TCP:
  98                 if (ndo->ndo_eflag)
  99                         ND_PRINT("(vjc type=raw TCP) ");
 100                 return PPP_IP;
 101         case TYPE_COMPRESSED_TCP:
 102                 if (ndo->ndo_eflag)
 103                         ND_PRINT("(vjc type=compressed TCP) ");
 104                 for (i = 0; i < 8; i++) {
 105                         if (GET_U_1(bp + 1) & (0x80 >> i))
 106                                 ND_PRINT("%c", "?CI?SAWU"[i]);
 107                 }
 108                 if (GET_U_1(bp + 1))
 109                         ND_PRINT(" ");
 110                 ND_PRINT("C=0x%02x ", GET_U_1(bp + 2));
 111                 ND_PRINT("sum=0x%04x ", GET_HE_U_2(bp + 3));
 112                 return -1;
 113         case TYPE_ERROR:
 114                 if (ndo->ndo_eflag)
 115                         ND_PRINT("(vjc type=error) ");
 116                 return -1;
 117         default:
 118                 if (ndo->ndo_eflag)
 119                         ND_PRINT("(vjc type=0x%02x) ", GET_U_1(bp) & 0xf0);
 120                 return -1;
 121         }
 122 }