]> The Tcpdump Group git mirrors - tcpdump/blob - print-juniper.c
projects / tcpdump / blob


9b0a70fd518084d40ac0900d17047f11b9b24cdf
[tcpdump] / print-juniper.c
1 /*
2 * Redistribution and use in source and binary forms, with or without
3 * modification, are permitted provided that: (1) source code
4 * distributions retain the above copyright notice and this paragraph
5 * in its entirety, and (2) distributions including binary code include
6 * the above copyright notice and this paragraph in its entirety in
7 * the documentation or other materials provided with the distribution.
8 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND
9 * WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, WITHOUT
10 * LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
11 * FOR A PARTICULAR PURPOSE.
12 *
13 * Original code by Hannes Gredler (hannes@juniper.net)
14 */
15
16 #ifndef lint
17 static const char rcsid[] _U_ =
18 "@(#) $Header: /tcpdump/master/tcpdump/print-juniper.c,v 1.29 2006-02-01 14:42:17 hannes Exp $ (LBL)";
19 #endif
20
21 #ifdef HAVE_CONFIG_H
22 #include "config.h"
23 #endif
24
25 #include <tcpdump-stdinc.h>
26
27 #include <pcap.h>
28 #include <stdio.h>
29
30 #include "interface.h"
31 #include "addrtoname.h"
32 #include "extract.h"
33 #include "ppp.h"
34 #include "llc.h"
35 #include "nlpid.h"
36 #include "ethertype.h"
37 #include "atm.h"
38
39 #define JUNIPER_BPF_OUT 0 /* Outgoing packet */
40 #define JUNIPER_BPF_IN 1 /* Incoming packet */
41 #define JUNIPER_BPF_PKT_IN 0x1 /* Incoming packet */
42 #define JUNIPER_BPF_NO_L2 0x2 /* L2 header stripped */
43 #define JUNIPER_BPF_IIF 0x4 /* IIF is valid */
44 #define JUNIPER_BPF_FILTER 0x40 /* BPF filtering is supported */
45 #define JUNIPER_BPF_EXT 0x80 /* extensions present */
46 #define JUNIPER_MGC_NUMBER 0x4d4743 /* = "MGC" */
47
48 #define JUNIPER_LSQ_COOKIE_RE (1 << 3)
49 #define JUNIPER_LSQ_COOKIE_DIR (1 << 2)
50 #define JUNIPER_LSQ_L3_PROTO_SHIFT 4
51 #define JUNIPER_LSQ_L3_PROTO_MASK (0x17 << JUNIPER_LSQ_L3_PROTO_SHIFT)
52 #define JUNIPER_LSQ_L3_PROTO_IPV4 (0 << JUNIPER_LSQ_L3_PROTO_SHIFT)
53 #define JUNIPER_LSQ_L3_PROTO_IPV6 (1 << JUNIPER_LSQ_L3_PROTO_SHIFT)
54 #define JUNIPER_LSQ_L3_PROTO_MPLS (2 << JUNIPER_LSQ_L3_PROTO_SHIFT)
55 #define JUNIPER_LSQ_L3_PROTO_ISO (3 << JUNIPER_LSQ_L3_PROTO_SHIFT)
56 #define AS_PIC_COOKIE_LEN 8
57
58 #define JUNIPER_IPSEC_O_ESP_ENCRYPT_ESP_AUTHEN_TYPE 1
59 #define JUNIPER_IPSEC_O_ESP_ENCRYPT_AH_AUTHEN_TYPE 2
60 #define JUNIPER_IPSEC_O_ESP_AUTHENTICATION_TYPE 3
61 #define JUNIPER_IPSEC_O_AH_AUTHENTICATION_TYPE 4
62 #define JUNIPER_IPSEC_O_ESP_ENCRYPTION_TYPE 5
63
64 static struct tok juniper_ipsec_type_values[] = {
65 { JUNIPER_IPSEC_O_ESP_ENCRYPT_ESP_AUTHEN_TYPE, "ESP ENCR-AUTH" },
66 { JUNIPER_IPSEC_O_ESP_ENCRYPT_AH_AUTHEN_TYPE, "ESP ENCR-AH AUTH" },
67 { JUNIPER_IPSEC_O_ESP_AUTHENTICATION_TYPE, "ESP AUTH" },
68 { JUNIPER_IPSEC_O_AH_AUTHENTICATION_TYPE, "AH AUTH" },
69 { JUNIPER_IPSEC_O_ESP_ENCRYPTION_TYPE, "ESP ENCR" },
70 { 0, NULL}
71 };
72
73 static struct tok juniper_direction_values[] = {
74 { JUNIPER_BPF_IN, "In"},
75 { JUNIPER_BPF_OUT, "Out"},
76 { 0, NULL}
77 };
78
79 /* codepoints for encoding extensions to a .pcap file */
80 enum {
81 JUNIPER_EXT_TLV_IFD_IDX = 1,
82 JUNIPER_EXT_TLV_IFD_NAME = 2,
83 JUNIPER_EXT_TLV_IFD_MEDIATYPE = 3,
84 JUNIPER_EXT_TLV_IFL_IDX = 4,
85 JUNIPER_EXT_TLV_IFL_UNIT = 5,
86 JUNIPER_EXT_TLV_IFL_ENCAPS = 6,
87 JUNIPER_EXT_TLV_TTP_IFD_MEDIATYPE = 7,
88 JUNIPER_EXT_TLV_TTP_IFL_ENCAPS = 8
89 };
90
91 /* 1 byte type and 1-byte length */
92 #define JUNIPER_EXT_TLV_OVERHEAD 2
93
94 struct tok jnx_ext_tlv_values[] = {
95 { JUNIPER_EXT_TLV_IFD_IDX, "Device Interface Index" },
96 { JUNIPER_EXT_TLV_IFD_NAME,"Device Interface Name" },
97 { JUNIPER_EXT_TLV_IFD_MEDIATYPE, "Device Media Type" },
98 { JUNIPER_EXT_TLV_IFL_IDX, "Logical Interface Index" },
99 { JUNIPER_EXT_TLV_IFL_UNIT,"Logical Unit Number" },
100 { JUNIPER_EXT_TLV_IFL_ENCAPS, "Logical Interface Encapsulation" },
101 { JUNIPER_EXT_TLV_TTP_IFD_MEDIATYPE, "TTP derived Device Media Type" },
102 { JUNIPER_EXT_TLV_TTP_IFL_ENCAPS, "TTP derived Logical Interface Encapsulation" },
103 { 0, NULL }
104 };
105
106 struct tok jnx_flag_values[] = {
107 { JUNIPER_BPF_EXT, "Ext" },
108 { JUNIPER_BPF_FILTER, "Filter" },
109 { JUNIPER_BPF_IIF, "IIF" },
110 { JUNIPER_BPF_NO_L2, "no-L2" },
111 { JUNIPER_BPF_PKT_IN, "In" },
112 { 0, NULL }
113 };
114
115 struct juniper_cookie_table_t {
116 u_int32_t pictype; /* pic type */
117 u_int8_t cookie_len; /* cookie len */
118 const char *s; /* pic name */
119 };
120
121 static struct juniper_cookie_table_t juniper_cookie_table[] = {
122 #ifdef DLT_JUNIPER_ATM1
123 { DLT_JUNIPER_ATM1, 4, "ATM1"},
124 #endif
125 #ifdef DLT_JUNIPER_ATM2
126 { DLT_JUNIPER_ATM2, 8, "ATM2"},
127 #endif
128 #ifdef DLT_JUNIPER_MLPPP
129 { DLT_JUNIPER_MLPPP, 2, "MLPPP"},
130 #endif
131 #ifdef DLT_JUNIPER_MLFR
132 { DLT_JUNIPER_MLFR, 2, "MLFR"},
133 #endif
134 #ifdef DLT_JUNIPER_MFR
135 { DLT_JUNIPER_MFR, 4, "MFR"},
136 #endif
137 #ifdef DLT_JUNIPER_PPPOE
138 { DLT_JUNIPER_PPPOE, 0, "PPPoE"},
139 #endif
140 #ifdef DLT_JUNIPER_PPPOE_ATM
141 { DLT_JUNIPER_PPPOE_ATM, 0, "PPPoE ATM"},
142 #endif
143 #ifdef DLT_JUNIPER_GGSN
144 { DLT_JUNIPER_GGSN, 8, "GGSN"},
145 #endif
146 #ifdef DLT_JUNIPER_MONITOR
147 { DLT_JUNIPER_MONITOR, 8, "MONITOR"},
148 #endif
149 #ifdef DLT_JUNIPER_SERVICES
150 { DLT_JUNIPER_SERVICES, 8, "AS"},
151 #endif
152 #ifdef DLT_JUNIPER_ES
153 { DLT_JUNIPER_ES, 0, "ES"},
154 #endif
155 { 0, 0, NULL }
156 };
157
158 struct juniper_l2info_t {
159 u_int32_t length;
160 u_int32_t caplen;
161 u_int32_t pictype;
162 u_int8_t direction;
163 u_int8_t header_len;
164 u_int8_t cookie_len;
165 u_int8_t cookie_type;
166 u_int8_t cookie[8];
167 u_int8_t bundle;
168 u_int16_t proto;
169 u_int8_t flags;
170 };
171
172 #define LS_COOKIE_ID 0x54
173 #define AS_COOKIE_ID 0x47
174 #define LS_MLFR_COOKIE_LEN 4
175 #define ML_MLFR_COOKIE_LEN 2
176 #define LS_MFR_COOKIE_LEN 6
177 #define ATM1_COOKIE_LEN 4
178 #define ATM2_COOKIE_LEN 8
179
180 #define ATM2_PKT_TYPE_MASK 0x70
181 #define ATM2_GAP_COUNT_MASK 0x3F
182
183 #define JUNIPER_PROTO_NULL 1
184 #define JUNIPER_PROTO_IPV4 2
185 #define JUNIPER_PROTO_IPV6 6
186
187 #define MFR_BE_MASK 0xc0
188
189 static struct tok juniper_protocol_values[] = {
190 { JUNIPER_PROTO_NULL, "Null" },
191 { JUNIPER_PROTO_IPV4, "IPv4" },
192 { JUNIPER_PROTO_IPV6, "IPv6" },
193 { 0, NULL}
194 };
195
196 int ip_heuristic_guess(register const u_char *, u_int);
197 int juniper_ppp_heuristic_guess(register const u_char *, u_int);
198 int juniper_read_tlv_value(const u_char *, u_int, u_int);
199 static int juniper_parse_header (const u_char *, const struct pcap_pkthdr *, struct juniper_l2info_t *);
200
201 #ifdef DLT_JUNIPER_GGSN
202 u_int
203 juniper_ggsn_print(const struct pcap_pkthdr *h, register const u_char *p)
204 {
205 struct juniper_l2info_t l2info;
206 struct juniper_ggsn_header {
207 u_int8_t svc_id;
208 u_int8_t flags_len;
209 u_int8_t proto;
210 u_int8_t flags;
211 u_int8_t vlan_id[2];
212 u_int8_t res[2];
213 };
214 const struct juniper_ggsn_header *gh;
215
216 l2info.pictype = DLT_JUNIPER_GGSN;
217 if(juniper_parse_header(p, h, &l2info) == 0)
218 return l2info.header_len;
219
220 p+=l2info.header_len;
221 gh = (struct juniper_ggsn_header *)p;
222
223 if (eflag)
224 printf("proto %s (%u), vlan %u: ",
225 tok2str(juniper_protocol_values,"Unknown",gh->proto),
226 gh->proto,
227 EXTRACT_16BITS(&gh->vlan_id[0]));
228
229 switch (gh->proto) {
230 case JUNIPER_PROTO_IPV4:
231 ip_print(gndo, p, l2info.length);
232 break;
233 #ifdef INET6
234 case JUNIPER_PROTO_IPV6:
235 ip6_print(p, l2info.length);
236 break;
237 #endif /* INET6 */
238 default:
239 if (!eflag)
240 printf("unknown GGSN proto (%u)", gh->proto);
241 }
242
243 return l2info.header_len;
244 }
245 #endif
246
247 #ifdef DLT_JUNIPER_ES
248 u_int
249 juniper_es_print(const struct pcap_pkthdr *h, register const u_char *p)
250 {
251 struct juniper_l2info_t l2info;
252 struct juniper_ipsec_header {
253 u_int8_t sa_index[2];
254 u_int8_t ttl;
255 u_int8_t type;
256 u_int8_t spi[4];
257 u_int8_t src_ip[4];
258 u_int8_t dst_ip[4];
259 };
260 u_int rewrite_len,es_type_bundle;
261 const struct juniper_ipsec_header *ih;
262
263 l2info.pictype = DLT_JUNIPER_ES;
264 if(juniper_parse_header(p, h, &l2info) == 0)
265 return l2info.header_len;
266
267 p+=l2info.header_len;
268 ih = (struct juniper_ipsec_header *)p;
269
270 switch (ih->type) {
271 case JUNIPER_IPSEC_O_ESP_ENCRYPT_ESP_AUTHEN_TYPE:
272 case JUNIPER_IPSEC_O_ESP_ENCRYPT_AH_AUTHEN_TYPE:
273 rewrite_len = 0;
274 es_type_bundle = 1;
275 break;
276 case JUNIPER_IPSEC_O_ESP_AUTHENTICATION_TYPE:
277 case JUNIPER_IPSEC_O_AH_AUTHENTICATION_TYPE:
278 case JUNIPER_IPSEC_O_ESP_ENCRYPTION_TYPE:
279 rewrite_len = 16;
280 es_type_bundle = 0;
281 default:
282 printf("ES Invalid type %u, length %u",
283 ih->type,
284 l2info.length);
285 return l2info.header_len;
286 }
287
288 l2info.length-=rewrite_len;
289 p+=rewrite_len;
290
291 if (eflag) {
292 if (!es_type_bundle) {
293 printf("ES SA, index %u, ttl %u type %s (%u), spi %u, Tunnel %s > %s, length %u\n",
294 EXTRACT_16BITS(&ih->sa_index),
295 ih->ttl,
296 tok2str(juniper_ipsec_type_values,"Unknown",ih->type),
297 ih->type,
298 EXTRACT_32BITS(&ih->spi),
299 ipaddr_string(EXTRACT_32BITS(&ih->src_ip)),
300 ipaddr_string(EXTRACT_32BITS(&ih->dst_ip)),
301 l2info.length);
302 } else {
303 printf("ES SA, index %u, ttl %u type %s (%u), length %u\n",
304 EXTRACT_16BITS(&ih->sa_index),
305 ih->ttl,
306 tok2str(juniper_ipsec_type_values,"Unknown",ih->type),
307 ih->type,
308 l2info.length);
309 }
310 }
311
312 ip_print(gndo, p, l2info.length);
313 return l2info.header_len;
314 }
315 #endif
316
317 #ifdef DLT_JUNIPER_MONITOR
318 u_int
319 juniper_monitor_print(const struct pcap_pkthdr *h, register const u_char *p)
320 {
321 struct juniper_l2info_t l2info;
322 struct juniper_monitor_header {
323 u_int8_t pkt_type;
324 u_int8_t padding;
325 u_int8_t iif[2];
326 u_int8_t service_id[4];
327 };
328 const struct juniper_monitor_header *mh;
329
330 l2info.pictype = DLT_JUNIPER_MONITOR;
331 if(juniper_parse_header(p, h, &l2info) == 0)
332 return l2info.header_len;
333
334 p+=l2info.header_len;
335 mh = (struct juniper_monitor_header *)p;
336
337 if (eflag)
338 printf("service-id %u, iif %u, pkt-type %u: ",
339 EXTRACT_32BITS(&mh->service_id),
340 EXTRACT_16BITS(&mh->iif),
341 mh->pkt_type);
342
343 /* no proto field - lets guess by first byte of IP header*/
344 ip_heuristic_guess(p, l2info.length);
345
346 return l2info.header_len;
347 }
348 #endif
349
350 #ifdef DLT_JUNIPER_SERVICES
351 u_int
352 juniper_services_print(const struct pcap_pkthdr *h, register const u_char *p)
353 {
354 struct juniper_l2info_t l2info;
355 struct juniper_services_header {
356 u_int8_t svc_id;
357 u_int8_t flags_len;
358 u_int8_t svc_set_id[2];
359 u_int8_t dir_iif[4];
360 };
361 const struct juniper_services_header *sh;
362
363 l2info.pictype = DLT_JUNIPER_SERVICES;
364 if(juniper_parse_header(p, h, &l2info) == 0)
365 return l2info.header_len;
366
367 p+=l2info.header_len;
368 sh = (struct juniper_services_header *)p;
369
370 if (eflag)
371 printf("service-id %u flags 0x%02x service-set-id 0x%04x iif %u: ",
372 sh->svc_id,
373 sh->flags_len,
374 EXTRACT_16BITS(&sh->svc_set_id),
375 EXTRACT_24BITS(&sh->dir_iif[1]));
376
377 /* no proto field - lets guess by first byte of IP header*/
378 ip_heuristic_guess(p, l2info.length);
379
380 return l2info.header_len;
381 }
382 #endif
383
384 #ifdef DLT_JUNIPER_PPPOE
385 u_int
386 juniper_pppoe_print(const struct pcap_pkthdr *h, register const u_char *p)
387 {
388 struct juniper_l2info_t l2info;
389
390 l2info.pictype = DLT_JUNIPER_PPPOE;
391 if(juniper_parse_header(p, h, &l2info) == 0)
392 return l2info.header_len;
393
394 p+=l2info.header_len;
395 /* this DLT contains nothing but raw ethernet frames */
396 ether_print(p, l2info.length, l2info.caplen);
397 return l2info.header_len;
398 }
399 #endif
400
401 #ifdef DLT_JUNIPER_ETHER
402 u_int
403 juniper_ether_print(const struct pcap_pkthdr *h, register const u_char *p)
404 {
405 struct juniper_l2info_t l2info;
406
407 l2info.pictype = DLT_JUNIPER_ETHER;
408 if(juniper_parse_header(p, h, &l2info) == 0)
409 return l2info.header_len;
410
411 p+=l2info.header_len;
412 /* this DLT contains nothing but raw Ethernet frames */
413 ether_print(p, l2info.length, l2info.caplen);
414 return l2info.header_len;
415 }
416 #endif
417
418 #ifdef DLT_JUNIPER_PPP
419 u_int
420 juniper_ppp_print(const struct pcap_pkthdr *h, register const u_char *p)
421 {
422 struct juniper_l2info_t l2info;
423
424 l2info.pictype = DLT_JUNIPER_PPP;
425 if(juniper_parse_header(p, h, &l2info) == 0)
426 return l2info.header_len;
427
428 p+=l2info.header_len;
429 /* this DLT contains nothing but raw ppp frames */
430 ppp_print(p, l2info.length);
431 return l2info.header_len;
432 }
433 #endif
434
435 #ifdef DLT_JUNIPER_FRELAY
436 u_int
437 juniper_frelay_print(const struct pcap_pkthdr *h, register const u_char *p)
438 {
439 struct juniper_l2info_t l2info;
440
441 l2info.pictype = DLT_JUNIPER_FRELAY;
442 if(juniper_parse_header(p, h, &l2info) == 0)
443 return l2info.header_len;
444
445 p+=l2info.header_len;
446 /* this DLT contains nothing but raw frame-relay frames */
447 fr_print(p, l2info.length);
448 return l2info.header_len;
449 }
450 #endif
451
452 #ifdef DLT_JUNIPER_CHDLC
453 u_int
454 juniper_chdlc_print(const struct pcap_pkthdr *h, register const u_char *p)
455 {
456 struct juniper_l2info_t l2info;
457
458 l2info.pictype = DLT_JUNIPER_CHDLC;
459 if(juniper_parse_header(p, h, &l2info) == 0)
460 return l2info.header_len;
461
462 p+=l2info.header_len;
463 /* this DLT contains nothing but raw c-hdlc frames */
464 chdlc_print(p, l2info.length);
465 return l2info.header_len;
466 }
467 #endif
468
469 #ifdef DLT_JUNIPER_PPPOE_ATM
470 u_int
471 juniper_pppoe_atm_print(const struct pcap_pkthdr *h, register const u_char *p)
472 {
473 struct juniper_l2info_t l2info;
474 u_int16_t extracted_ethertype;
475
476 l2info.pictype = DLT_JUNIPER_PPPOE_ATM;
477 if(juniper_parse_header(p, h, &l2info) == 0)
478 return l2info.header_len;
479
480 p+=l2info.header_len;
481
482 extracted_ethertype = EXTRACT_16BITS(p);
483 /* this DLT contains nothing but raw PPPoE frames,
484 * prepended with a type field*/
485 if (ether_encap_print(extracted_ethertype,
486 p+ETHERTYPE_LEN,
487 l2info.length-ETHERTYPE_LEN,
488 l2info.caplen-ETHERTYPE_LEN,
489 &extracted_ethertype) == 0)
490 /* ether_type not known, probably it wasn't one */
491 printf("unknown ethertype 0x%04x", extracted_ethertype);
492
493 return l2info.header_len;
494 }
495 #endif
496
497 #ifdef DLT_JUNIPER_MLPPP
498 u_int
499 juniper_mlppp_print(const struct pcap_pkthdr *h, register const u_char *p)
500 {
501 struct juniper_l2info_t l2info;
502
503 l2info.pictype = DLT_JUNIPER_MLPPP;
504 if(juniper_parse_header(p, h, &l2info) == 0)
505 return l2info.header_len;
506
507 /* suppress Bundle-ID if frame was captured on a child-link
508 * best indicator if the cookie looks like a proto */
509 if (eflag &&
510 EXTRACT_16BITS(&l2info.cookie) != PPP_OSI &&
511 EXTRACT_16BITS(&l2info.cookie) != (PPP_ADDRESS << 8 | PPP_CONTROL))
512 printf("Bundle-ID %u: ",l2info.bundle);
513
514 p+=l2info.header_len;
515
516 /* first try the LSQ protos */
517 switch(l2info.proto) {
518 case JUNIPER_LSQ_L3_PROTO_IPV4:
519 /* IP traffic going to the RE would not have a cookie
520 * -> this must be incoming IS-IS over PPP
521 */
522 if (l2info.cookie[4] == (JUNIPER_LSQ_COOKIE_RE|JUNIPER_LSQ_COOKIE_DIR))
523 ppp_print(p, l2info.length);
524 else
525 ip_print(gndo, p, l2info.length);
526 return l2info.header_len;
527 #ifdef INET6
528 case JUNIPER_LSQ_L3_PROTO_IPV6:
529 ip6_print(p,l2info.length);
530 return l2info.header_len;
531 #endif
532 case JUNIPER_LSQ_L3_PROTO_MPLS:
533 mpls_print(p,l2info.length);
534 return l2info.header_len;
535 case JUNIPER_LSQ_L3_PROTO_ISO:
536 isoclns_print(p,l2info.length,l2info.caplen);
537 return l2info.header_len;
538 default:
539 break;
540 }
541
542 /* zero length cookie ? */
543 switch (EXTRACT_16BITS(&l2info.cookie)) {
544 case PPP_OSI:
545 ppp_print(p-2,l2info.length+2);
546 break;
547 case (PPP_ADDRESS << 8 | PPP_CONTROL): /* fall through */
548 default:
549 ppp_print(p,l2info.length);
550 break;
551 }
552
553 return l2info.header_len;
554 }
555 #endif
556
557
558 #ifdef DLT_JUNIPER_MFR
559 u_int
560 juniper_mfr_print(const struct pcap_pkthdr *h, register const u_char *p)
561 {
562 struct juniper_l2info_t l2info;
563
564 l2info.pictype = DLT_JUNIPER_MFR;
565 if(juniper_parse_header(p, h, &l2info) == 0)
566 return l2info.header_len;
567
568 p+=l2info.header_len;
569
570 /* child-link ? */
571 if (l2info.cookie_len == 0) {
572 mfr_print(p,l2info.length);
573 return l2info.header_len;
574 }
575
576 /* first try the LSQ protos */
577 if (l2info.cookie_len == AS_PIC_COOKIE_LEN) {
578 switch(l2info.proto) {
579 case JUNIPER_LSQ_L3_PROTO_IPV4:
580 ip_print(gndo, p, l2info.length);
581 return l2info.header_len;
582 #ifdef INET6
583 case JUNIPER_LSQ_L3_PROTO_IPV6:
584 ip6_print(p,l2info.length);
585 return l2info.header_len;
586 #endif
587 case JUNIPER_LSQ_L3_PROTO_MPLS:
588 mpls_print(p,l2info.length);
589 return l2info.header_len;
590 case JUNIPER_LSQ_L3_PROTO_ISO:
591 isoclns_print(p,l2info.length,l2info.caplen);
592 return l2info.header_len;
593 default:
594 break;
595 }
596 return l2info.header_len;
597 }
598
599 /* suppress Bundle-ID if frame was captured on a child-link */
600 if (eflag && EXTRACT_32BITS(l2info.cookie) != 1) printf("Bundle-ID %u, ",l2info.bundle);
601 switch (l2info.proto) {
602 case (LLCSAP_ISONS<<8 | LLCSAP_ISONS):
603 isoclns_print(p+1, l2info.length-1, l2info.caplen-1);
604 break;
605 case (LLC_UI<<8 | NLPID_Q933):
606 case (LLC_UI<<8 | NLPID_IP):
607 case (LLC_UI<<8 | NLPID_IP6):
608 /* pass IP{4,6} to the OSI layer for proper link-layer printing */
609 isoclns_print(p-1, l2info.length+1, l2info.caplen+1);
610 break;
611 default:
612 printf("unknown protocol 0x%04x, length %u",l2info.proto, l2info.length);
613 }
614
615 return l2info.header_len;
616 }
617 #endif
618
619 #ifdef DLT_JUNIPER_MLFR
620 u_int
621 juniper_mlfr_print(const struct pcap_pkthdr *h, register const u_char *p)
622 {
623 struct juniper_l2info_t l2info;
624
625 l2info.pictype = DLT_JUNIPER_MLFR;
626 if(juniper_parse_header(p, h, &l2info) == 0)
627 return l2info.header_len;
628
629 p+=l2info.header_len;
630
631 /* suppress Bundle-ID if frame was captured on a child-link */
632 if (eflag && EXTRACT_32BITS(l2info.cookie) != 1) printf("Bundle-ID %u, ",l2info.bundle);
633 switch (l2info.proto) {
634 case (LLC_UI):
635 case (LLC_UI<<8):
636 isoclns_print(p, l2info.length, l2info.caplen);
637 break;
638 case (LLC_UI<<8 | NLPID_Q933):
639 case (LLC_UI<<8 | NLPID_IP):
640 case (LLC_UI<<8 | NLPID_IP6):
641 /* pass IP{4,6} to the OSI layer for proper link-layer printing */
642 isoclns_print(p-1, l2info.length+1, l2info.caplen+1);
643 break;
644 default:
645 printf("unknown protocol 0x%04x, length %u",l2info.proto, l2info.length);
646 }
647
648 return l2info.header_len;
649 }
650 #endif
651
652 /*
653 * ATM1 PIC cookie format
654 *
655 * +-----+-------------------------+-------------------------------+
656 * |fmtid| vc index | channel ID |
657 * +-----+-------------------------+-------------------------------+
658 */
659
660 #ifdef DLT_JUNIPER_ATM1
661 u_int
662 juniper_atm1_print(const struct pcap_pkthdr *h, register const u_char *p)
663 {
664 u_int16_t extracted_ethertype;
665
666 struct juniper_l2info_t l2info;
667
668 l2info.pictype = DLT_JUNIPER_ATM1;
669 if(juniper_parse_header(p, h, &l2info) == 0)
670 return l2info.header_len;
671
672 p+=l2info.header_len;
673
674 if (l2info.cookie[0] == 0x80) { /* OAM cell ? */
675 oam_print(p,l2info.length,ATM_OAM_NOHEC);
676 return l2info.header_len;
677 }
678
679 if (EXTRACT_24BITS(p) == 0xfefe03 || /* NLPID encaps ? */
680 EXTRACT_24BITS(p) == 0xaaaa03) { /* SNAP encaps ? */
681
682 if (llc_print(p, l2info.length, l2info.caplen, NULL, NULL,
683 &extracted_ethertype) != 0)
684 return l2info.header_len;
685 }
686
687 if (p[0] == 0x03) { /* Cisco style NLPID encaps ? */
688 isoclns_print(p + 1, l2info.length - 1, l2info.caplen - 1);
689 /* FIXME check if frame was recognized */
690 return l2info.header_len;
691 }
692
693 if(ip_heuristic_guess(p, l2info.length) != 0) /* last try - vcmux encaps ? */
694 return l2info.header_len;
695
696 return l2info.header_len;
697 }
698 #endif
699
700 /*
701 * ATM2 PIC cookie format
702 *
703 * +-------------------------------+---------+---+-----+-----------+
704 * | channel ID | reserv |AAL| CCRQ| gap cnt |
705 * +-------------------------------+---------+---+-----+-----------+
706 */
707
708 #ifdef DLT_JUNIPER_ATM2
709 u_int
710 juniper_atm2_print(const struct pcap_pkthdr *h, register const u_char *p)
711 {
712 u_int16_t extracted_ethertype;
713 u_int32_t control_word;
714
715 struct juniper_l2info_t l2info;
716
717 l2info.pictype = DLT_JUNIPER_ATM2;
718 if(juniper_parse_header(p, h, &l2info) == 0)
719 return l2info.header_len;
720
721 p+=l2info.header_len;
722
723 if (l2info.cookie[7] & ATM2_PKT_TYPE_MASK) { /* OAM cell ? */
724 control_word = EXTRACT_32BITS(p);
725 if(control_word == 0 || control_word == 0x08000000) {
726 l2info.header_len += 4;
727 l2info.length -= 4;
728 p += 4;
729 }
730 oam_print(p,l2info.length,ATM_OAM_NOHEC);
731 return l2info.header_len;
732 }
733
734 if (EXTRACT_24BITS(p) == 0xfefe03 || /* NLPID encaps ? */
735 EXTRACT_24BITS(p) == 0xaaaa03) { /* SNAP encaps ? */
736
737 if (llc_print(p, l2info.length, l2info.caplen, NULL, NULL,
738 &extracted_ethertype) != 0)
739 return l2info.header_len;
740 }
741
742 if (l2info.direction != JUNIPER_BPF_PKT_IN && /* ether-over-1483 encaps ? */
743 (EXTRACT_32BITS(l2info.cookie) & ATM2_GAP_COUNT_MASK)) {
744 ether_print(p, l2info.length, l2info.caplen);
745 return l2info.header_len;
746 }
747
748 if (p[0] == 0x03) { /* Cisco style NLPID encaps ? */
749 isoclns_print(p + 1, l2info.length - 1, l2info.caplen - 1);
750 /* FIXME check if frame was recognized */
751 return l2info.header_len;
752 }
753
754 if(juniper_ppp_heuristic_guess(p, l2info.length) != 0) /* PPPoA vcmux encaps ? */
755 return l2info.header_len;
756
757 if(ip_heuristic_guess(p, l2info.length) != 0) /* last try - vcmux encaps ? */
758 return l2info.header_len;
759
760 return l2info.header_len;
761 }
762 #endif
763
764
765 /* try to guess, based on all PPP protos that are supported in
766 * a juniper router if the payload data is encapsulated using PPP */
767 int
768 juniper_ppp_heuristic_guess(register const u_char *p, u_int length) {
769
770 switch(EXTRACT_16BITS(p)) {
771 case PPP_IP :
772 case PPP_OSI :
773 case PPP_MPLS_UCAST :
774 case PPP_MPLS_MCAST :
775 case PPP_IPCP :
776 case PPP_OSICP :
777 case PPP_MPLSCP :
778 case PPP_LCP :
779 case PPP_PAP :
780 case PPP_CHAP :
781 case PPP_ML :
782 #ifdef INET6
783 case PPP_IPV6 :
784 case PPP_IPV6CP :
785 #endif
786 ppp_print(p, length);
787 break;
788
789 default:
790 return 0; /* did not find a ppp header */
791 break;
792 }
793 return 1; /* we printed a ppp packet */
794 }
795
796 int
797 ip_heuristic_guess(register const u_char *p, u_int length) {
798
799 switch(p[0]) {
800 case 0x45:
801 case 0x46:
802 case 0x47:
803 case 0x48:
804 case 0x49:
805 case 0x4a:
806 case 0x4b:
807 case 0x4c:
808 case 0x4d:
809 case 0x4e:
810 case 0x4f:
811 ip_print(gndo, p, length);
812 break;
813 #ifdef INET6
814 case 0x60:
815 case 0x61:
816 case 0x62:
817 case 0x63:
818 case 0x64:
819 case 0x65:
820 case 0x66:
821 case 0x67:
822 case 0x68:
823 case 0x69:
824 case 0x6a:
825 case 0x6b:
826 case 0x6c:
827 case 0x6d:
828 case 0x6e:
829 case 0x6f:
830 ip6_print(p, length);
831 break;
832 #endif
833 default:
834 return 0; /* did not find a ip header */
835 break;
836 }
837 return 1; /* we printed an v4/v6 packet */
838 }
839
840 int
841 juniper_read_tlv_value(const u_char *p, u_int tlv_type, u_int tlv_len) {
842
843 int tlv_value;
844
845 /* TLVs < 128 are little endian encoded */
846 if (tlv_type < 128) {
847 switch (tlv_len) {
848 case 1:
849 tlv_value = *p;
850 break;
851 case 2:
852 tlv_value = EXTRACT_LE_16BITS(p);
853 break;
854 case 3:
855 tlv_value = EXTRACT_LE_24BITS(p);
856 break;
857 case 4:
858 tlv_value = EXTRACT_LE_32BITS(p);
859 break;
860 default:
861 tlv_value = -1;
862 break;
863 }
864 } else {
865 /* TLVs >= 128 are big endian encoded */
866 switch (tlv_len) {
867 case 1:
868 tlv_value = *p;
869 break;
870 case 2:
871 tlv_value = EXTRACT_16BITS(p);
872 break;
873 case 3:
874 tlv_value = EXTRACT_24BITS(p);
875 break;
876 case 4:
877 tlv_value = EXTRACT_32BITS(p);
878 break;
879 default:
880 tlv_value = -1;
881 break;
882 }
883 }
884 return tlv_value;
885 }
886
887 static int
888 juniper_parse_header (const u_char *p, const struct pcap_pkthdr *h, struct juniper_l2info_t *l2info) {
889
890 struct juniper_cookie_table_t *lp = juniper_cookie_table;
891 u_int idx, jnx_ext_len, jnx_header_len = 0;
892 u_int8_t tlv_type,tlv_len;
893 int tlv_value;
894 const u_char *tptr;
895
896
897 l2info->header_len = 0;
898 l2info->cookie_len = 0;
899 l2info->proto = 0;
900
901
902 l2info->length = h->len;
903 l2info->caplen = h->caplen;
904 TCHECK2(p[0],4);
905 l2info->flags = p[3];
906 l2info->direction = p[3]&JUNIPER_BPF_PKT_IN;
907
908 if (EXTRACT_24BITS(p) != JUNIPER_MGC_NUMBER) { /* magic number found ? */
909 printf("no magic-number found!");
910 return 0;
911 }
912
913 if (eflag) /* print direction */
914 printf("%3s ",tok2str(juniper_direction_values,"---",l2info->direction));
915
916 /* magic number + flags */
917 jnx_header_len = 4;
918
919 if (vflag>1)
920 printf("\n\tJuniper PCAP Flags [%s]",
921 bittok2str(jnx_flag_values, "none", l2info->flags));
922
923 /* extensions present ? - calculate how much bytes to skip */
924 if ((l2info->flags & JUNIPER_BPF_EXT ) == JUNIPER_BPF_EXT ) {
925
926 tptr = p+jnx_header_len;
927
928 /* ok to read extension length ? */
929 TCHECK2(tptr[0], 2);
930 jnx_ext_len = EXTRACT_16BITS(tptr);
931 jnx_header_len += 2;
932 tptr +=2;
933
934 /* nail up the total length -
935 * just in case something goes wrong
936 * with TLV parsing */
937 jnx_header_len += jnx_ext_len;
938
939 if (vflag>1)
940 printf(", PCAP Extension(s) total length %u",
941 jnx_ext_len);
942
943 TCHECK2(tptr[0], jnx_ext_len);
944 while (jnx_ext_len > JUNIPER_EXT_TLV_OVERHEAD) {
945 tlv_type = *(tptr++);
946 tlv_len = *(tptr++);
947 tlv_value = 0;
948
949 /* sanity check */
950 if (tlv_type == 0 || tlv_len == 0)
951 break;
952
953 if (vflag>1)
954 printf("\n\t %s Extension TLV #%u, length %u, value ",
955 tok2str(jnx_ext_tlv_values,"Unknown",tlv_type),
956 tlv_type,
957 tlv_len);
958
959 tlv_value = juniper_read_tlv_value(tptr, tlv_type, tlv_len);
960 switch (tlv_type) {
961 case JUNIPER_EXT_TLV_IFD_NAME:
962 /* FIXME */
963 break;
964
965 case JUNIPER_EXT_TLV_IFD_MEDIATYPE: /* fall through */
966 case JUNIPER_EXT_TLV_IFL_ENCAPS:
967 case JUNIPER_EXT_TLV_TTP_IFD_MEDIATYPE:
968 case JUNIPER_EXT_TLV_TTP_IFL_ENCAPS:
969 case JUNIPER_EXT_TLV_IFL_IDX:
970 case JUNIPER_EXT_TLV_IFL_UNIT:
971 case JUNIPER_EXT_TLV_IFD_IDX:
972 default:
973 if (tlv_value != -1) {
974 if (vflag>1)
975 printf("%u",tlv_value);
976 }
977 break;
978 }
979
980 tptr+=tlv_len;
981 jnx_ext_len -= tlv_len+JUNIPER_EXT_TLV_OVERHEAD;
982 }
983
984 if (vflag>1)
985 printf("\n\t-----original packet-----\n\t");
986 }
987
988 if ((l2info->flags & JUNIPER_BPF_NO_L2 ) == JUNIPER_BPF_NO_L2 ) {
989 if (eflag)
990 printf("no-L2-hdr, ");
991
992 /* there is no link-layer present -
993 * perform the v4/v6 heuristics
994 * to figure out what it is
995 */
996 TCHECK2(p[jnx_header_len+4],1);
997 if(ip_heuristic_guess(p+jnx_header_len+4,l2info->length-(jnx_header_len+4)) == 0)
998 printf("no IP-hdr found!");
999
1000 l2info->header_len=jnx_header_len+4;
1001 return 0; /* stop parsing the output further */
1002
1003 }
1004 l2info->header_len = jnx_header_len;
1005 p+=l2info->header_len;
1006 l2info->length -= l2info->header_len;
1007 l2info->caplen -= l2info->header_len;
1008
1009 /* search through the cookie table and copy values matching for our PIC type */
1010 while (lp->s != NULL) {
1011 if (lp->pictype == l2info->pictype) {
1012
1013 l2info->cookie_len += lp->cookie_len;
1014
1015 switch (p[0]) {
1016 case LS_COOKIE_ID:
1017 l2info->cookie_type = LS_COOKIE_ID;
1018 l2info->cookie_len += 2;
1019 break;
1020 case AS_COOKIE_ID:
1021 l2info->cookie_type = AS_COOKIE_ID;
1022 l2info->cookie_len = 8;
1023 break;
1024
1025 default:
1026 l2info->bundle = l2info->cookie[0];
1027 break;
1028 }
1029
1030
1031 #ifdef DLT_JUNIPER_MFR
1032 /* MFR child links don't carry cookies */
1033 if (l2info->pictype == DLT_JUNIPER_MFR &&
1034 (p[0] & MFR_BE_MASK) == MFR_BE_MASK) {
1035 l2info->cookie_len = 0;
1036 }
1037 #endif
1038
1039 l2info->header_len += l2info->cookie_len;
1040 l2info->length -= l2info->cookie_len;
1041 l2info->caplen -= l2info->cookie_len;
1042
1043 if (eflag)
1044 printf("%s-PIC, cookie-len %u",
1045 lp->s,
1046 l2info->cookie_len);
1047
1048 if (l2info->cookie_len > 0) {
1049 TCHECK2(p[0],l2info->cookie_len);
1050 if (eflag)
1051 printf(", cookie 0x");
1052 for (idx = 0; idx < l2info->cookie_len; idx++) {
1053 l2info->cookie[idx] = p[idx]; /* copy cookie data */
1054 if (eflag) printf("%02x",p[idx]);
1055 }
1056 }
1057
1058 if (eflag) printf(": "); /* print demarc b/w L2/L3*/
1059
1060
1061 l2info->proto = EXTRACT_16BITS(p+l2info->cookie_len);
1062 break;
1063 }
1064 ++lp;
1065 }
1066 p+=l2info->cookie_len;
1067
1068 /* DLT_ specific parsing */
1069 switch(l2info->pictype) {
1070 #ifdef DLT_JUNIPER_MLPPP
1071 case DLT_JUNIPER_MLPPP:
1072 switch (l2info->cookie_type) {
1073 case LS_COOKIE_ID:
1074 l2info->bundle = l2info->cookie[1];
1075 break;
1076 case AS_COOKIE_ID:
1077 l2info->bundle = (EXTRACT_16BITS(&l2info->cookie[6])>>3)&0xfff;
1078 l2info->proto = (l2info->cookie[5])&JUNIPER_LSQ_L3_PROTO_MASK;
1079 break;
1080 default:
1081 l2info->bundle = l2info->cookie[0];
1082 break;
1083 }
1084 break;
1085 #endif
1086 #ifdef DLT_JUNIPER_MLFR
1087 case DLT_JUNIPER_MLFR:
1088 switch (l2info->cookie_type) {
1089 case LS_COOKIE_ID:
1090 l2info->bundle = l2info->cookie[1];
1091 l2info->proto = EXTRACT_16BITS(p);
1092 l2info->header_len += 2;
1093 l2info->length -= 2;
1094 l2info->caplen -= 2;
1095 break;
1096 case AS_COOKIE_ID:
1097 l2info->bundle = (EXTRACT_16BITS(&l2info->cookie[6])>>3)&0xfff;
1098 l2info->proto = (l2info->cookie[5])&JUNIPER_LSQ_L3_PROTO_MASK;
1099 break;
1100 default:
1101 l2info->bundle = l2info->cookie[0];
1102 l2info->header_len += 2;
1103 l2info->length -= 2;
1104 l2info->caplen -= 2;
1105 break;
1106 }
1107 break;
1108 #endif
1109 #ifdef DLT_JUNIPER_MFR
1110 case DLT_JUNIPER_MFR:
1111 switch (l2info->cookie_type) {
1112 case LS_COOKIE_ID:
1113 l2info->bundle = l2info->cookie[1];
1114 l2info->proto = EXTRACT_16BITS(p);
1115 l2info->header_len += 2;
1116 l2info->length -= 2;
1117 l2info->caplen -= 2;
1118 break;
1119 case AS_COOKIE_ID:
1120 l2info->bundle = (EXTRACT_16BITS(&l2info->cookie[6])>>3)&0xfff;
1121 l2info->proto = (l2info->cookie[5])&JUNIPER_LSQ_L3_PROTO_MASK;
1122 break;
1123 default:
1124 l2info->bundle = l2info->cookie[0];
1125 break;
1126 }
1127 break;
1128 #endif
1129 #ifdef DLT_JUNIPER_ATM2
1130 case DLT_JUNIPER_ATM2:
1131 TCHECK2(p[0],4);
1132 /* ATM cell relay control word present ? */
1133 if (l2info->cookie[7] & ATM2_PKT_TYPE_MASK && *p & 0x08) {
1134 l2info->header_len += 4;
1135 if (eflag)
1136 printf("control-word 0x%08x ",EXTRACT_32BITS(p));
1137 }
1138 break;
1139 #endif
1140 #ifdef DLT_JUNIPER_ATM1
1141 case DLT_JUNIPER_ATM1:
1142 break;
1143 #endif
1144 #ifdef DLT_JUNIPER_PPP
1145 case DLT_JUNIPER_PPP:
1146 break;
1147 #endif
1148 #ifdef DLT_JUNIPER_CHDLC
1149 case DLT_JUNIPER_CHDLC:
1150 break;
1151 #endif
1152 #ifdef DLT_JUNIPER_ETHER
1153 case DLT_JUNIPER_ETHER:
1154 break;
1155 #endif
1156 #ifdef DLT_JUNIPER_FRELAY
1157 case DLT_JUNIPER_FRELAY:
1158 break;
1159 #endif
1160
1161 default:
1162 printf("Unknown Juniper DLT_ type %u: ", l2info->pictype);
1163 break;
1164 }
1165
1166 if (eflag > 1)
1167 printf("hlen %u, proto 0x%04x, ",l2info->header_len,l2info->proto);
1168
1169 return 1; /* everything went ok so far. continue parsing */
1170 trunc:
1171 printf("[|juniper_hdr], length %u",h->len);
1172 return 0;
1173 }
1174
1175
1176 /*
1177 * Local Variables:
1178 * c-style: whitesmith
1179 * c-basic-offset: 4
1180 * End:
1181 */
[mirror] the TCPdump network dissector