The Tcpdump Group git mirrors - tcpdump/blob - print-fr.c

   1 /*
   2  * Copyright (c) 1990, 1991, 1993, 1994, 1995, 1996
   3  *      The Regents of the University of California.  All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that: (1) source code distributions
   7  * retain the above copyright notice and this paragraph in its entirety, (2)
   8  * distributions including binary code include the above copyright notice and
   9  * this paragraph in its entirety in the documentation or other materials
  10  * provided with the distribution, and (3) all advertising materials mentioning
  11  * features or use of this software display the following acknowledgement:
  12  * ``This product includes software developed by the University of California,
  13  * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
  14  * the University nor the names of its contributors may be used to endorse
  15  * or promote products derived from this software without specific prior
  16  * written permission.
  17  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
  18  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
  19  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  20  */
  21
  22 #ifndef lint
  23 static const char rcsid[] _U_ =
  24         "@(#)$Header: /tcpdump/master/tcpdump/print-fr.c,v 1.28 2005-01-25 15:02:59 hannes Exp $ (LBL)";
  25 #endif
  26
  27 #ifdef HAVE_CONFIG_H
  28 #include "config.h"
  29 #endif
  30
  31 #include <tcpdump-stdinc.h>
  32
  33 #include <stdio.h>
  34 #include <string.h>
  35 #include <pcap.h>
  36
  37 #include "addrtoname.h"
  38 #include "interface.h"
  39 #include "ethertype.h"
  40 #include "nlpid.h"
  41 #include "extract.h"
  42
  43 static void q933_print(const u_char *, u_int);
  44 static void frf15_print(const u_char *, u_int);
  45
  46 /*
  47  * the frame relay header has a variable length
  48  *
  49  * the EA bit determines if there is another byte
  50  * in the header
  51  *
  52  * minimum header length is 2 bytes
  53  * maximum header length is 4 bytes
  54  *
  55  *      7    6    5    4    3    2    1    0
  56  *    +----+----+----+----+----+----+----+----+
  57  *    |        DLCI (6 bits)        | CR | EA |
  58  *    +----+----+----+----+----+----+----+----+
  59  *    |   DLCI (4 bits)   |FECN|BECN| DE | EA |
  60  *    +----+----+----+----+----+----+----+----+
  61  *    |           DLCI (7 bits)          | EA |
  62  *    +----+----+----+----+----+----+----+----+
  63  *    |        DLCI (6 bits)        |SDLC| EA |
  64  *    +----+----+----+----+----+----+----+----+
  65  */
  66
  67 #define FR_EA_BIT       0x01
  68
  69 #define FR_CR_BIT       0x02000000
  70 #define FR_DE_BIT       0x00020000
  71 #define FR_BECN_BIT     0x00040000
  72 #define FR_FECN_BIT     0x00080000
  73 #define FR_SDLC_BIT     0x00000002
  74
  75
  76 struct tok fr_header_flag_values[] = {
  77     { FR_CR_BIT, "C!" },
  78     { FR_DE_BIT, "DE" },
  79     { FR_BECN_BIT, "BECN" },
  80     { FR_FECN_BIT, "FECN" },
  81     { FR_SDLC_BIT, "sdlcore" },
  82     { 0, NULL }
  83 };
  84
  85
  86 /* Finds out Q.922 address length, DLCI and flags. Returns 0 on success
  87  * save the flags dep. on address length
  88  */
  89 static int parse_q922_addr(const u_char *p, u_int *dlci, u_int *sdlcore,
  90                            u_int *addr_len, u_int8_t *flags)
  91 {
  92         if ((p[0] & FR_EA_BIT))
  93                 return -1;
  94
  95         *addr_len = 2;
  96         *dlci = ((p[0] & 0xFC) << 2) | ((p[1] & 0xF0) >> 4);
  97
  98         flags[0] = p[0] & 0x02; /* populate the first flag fields */
  99         flags[1] = p[1] & 0x0c;
 100
 101         if (p[1] & FR_EA_BIT)
 102                 return 0;       /* 2-byte Q.922 address */
 103
 104         p += 2;
 105         (*addr_len)++;          /* 3- or 4-byte Q.922 address */
 106         if ((p[0] & FR_EA_BIT) == 0) {
 107                 *dlci = (*dlci << 7) | (p[0] >> 1);
 108                 (*addr_len)++;  /* 4-byte Q.922 address */
 109                 p++;
 110         }
 111
 112         if ((p[0] & FR_EA_BIT) == 0)
 113                 return -1; /* more than 4 bytes of Q.922 address? */
 114
 115         flags[3] = p[0] & 0x02;
 116
 117         if (p[0] & 0x02)
 118                 *sdlcore =  p[0] >> 2;
 119         else
 120                 *dlci = (*dlci << 6) | (p[0] >> 2);
 121
 122         return 0;
 123 }
 124
 125 /* Frame Relay packet structure, with flags and CRC removed
 126
 127                   +---------------------------+
 128                   |       Q.922 Address*      |
 129                   +--                       --+
 130                   |                           |
 131                   +---------------------------+
 132                   | Control (UI = 0x03)       |
 133                   +---------------------------+
 134                   | Optional Pad      (0x00)  |
 135                   +---------------------------+
 136                   | NLPID                     |
 137                   +---------------------------+
 138                   |             .             |
 139                   |             .             |
 140                   |             .             |
 141                   |           Data            |
 142                   |             .             |
 143                   |             .             |
 144                   +---------------------------+
 145
 146            * Q.922 addresses, as presently defined, are two octets and
 147              contain a 10-bit DLCI.  In some networks Q.922 addresses
 148              may optionally be increased to three or four octets.
 149 */
 150
 151 static u_int
 152 fr_hdrlen(const u_char *p, u_int addr_len, u_int caplen)
 153 {
 154         if ((caplen > addr_len + 1 /* UI */ + 1 /* pad */) &&
 155             !p[addr_len + 1] /* pad exist */)
 156                 return addr_len + 1 /* UI */ + 1 /* pad */ + 1 /* NLPID */;
 157         else
 158                 return addr_len + 1 /* UI */ + 1 /* NLPID */;
 159 }
 160
 161 static void
 162 fr_hdr_print(int length, u_int addr_len, u_int dlci, u_int8_t *flags, u_int16_t nlpid)
 163 {
 164     if (qflag) {
 165         (void)printf("Q.922, DLCI %u, length %u: ",
 166                      dlci,
 167                      length);
 168     } else {
 169         if (nlpid <= 0xff) /* if its smaller than 256 then its a NLPID */
 170             (void)printf("Q.922, hdr-len %u, DLCI %u, Flags [%s], NLPID %s (0x%02x), length %u: ",
 171                          addr_len,
 172                          dlci,
 173                          bittok2str(fr_header_flag_values, "none", EXTRACT_32BITS(flags)),
 174                          tok2str(nlpid_values,"unknown", nlpid),
 175                          nlpid,
 176                          length);
 177         else /* must be an ethertype */
 178             (void)printf("Q.922, hdr-len %u, DLCI %u, Flags [%s], cisco-ethertype %s (0x%04x), length %u: ",
 179                          addr_len,
 180                          dlci,
 181                          bittok2str(fr_header_flag_values, "none", EXTRACT_32BITS(flags)),
 182                          tok2str(ethertype_values, "unknown", nlpid),
 183                          nlpid,
 184                          length);
 185     }
 186 }
 187
 188 u_int
 189 fr_if_print(const struct pcap_pkthdr *h, register const u_char *p)
 190 {
 191         register u_int length = h->len;
 192         register u_int caplen = h->caplen;
 193         u_int16_t extracted_ethertype;
 194         u_int32_t orgcode;
 195         register u_short et;
 196         u_int dlci;
 197         u_int sdlcore;
 198         u_int addr_len;
 199         u_int16_t nlpid;
 200         u_int hdr_len;
 201         u_int8_t flags[4];
 202
 203         if (caplen < 4) {       /* minimum frame header length */
 204                 printf("[|fr]");
 205                 return caplen;
 206         }
 207
 208         if (parse_q922_addr(p, &dlci, &sdlcore, &addr_len, flags)) {
 209                 printf("Q.922, invalid address");
 210                 return caplen;
 211         }
 212
 213         hdr_len = fr_hdrlen(p, addr_len, caplen);
 214
 215         if (caplen < hdr_len) {
 216                 printf("[|fr]");
 217                 return caplen;
 218         }
 219
 220         if (p[addr_len] != 0x03 && dlci != 0) {
 221
 222                 /* lets figure out if we have cisco style encapsulation: */
 223                 extracted_ethertype = EXTRACT_16BITS(p+addr_len);
 224
 225                 if (eflag)
 226                     fr_hdr_print(length, addr_len, dlci, flags, extracted_ethertype);
 227
 228                 if (ether_encap_print(extracted_ethertype,
 229                                       p+addr_len+ETHERTYPE_LEN,
 230                                       length-addr_len-ETHERTYPE_LEN,
 231                                       caplen-addr_len-ETHERTYPE_LEN,
 232                                       &extracted_ethertype) == 0)
 233                     /* ether_type not known, probably it wasn't one */
 234                     printf("UI %02x! ", p[addr_len]);
 235                 else
 236                     return hdr_len;
 237         }
 238
 239         if (!p[addr_len + 1]) { /* pad byte should be used with 3-byte Q.922 */
 240                 if (addr_len != 3)
 241                         printf("Pad! ");
 242         } else if (addr_len == 3)
 243                 printf("No pad! ");
 244
 245         nlpid = p[hdr_len - 1];
 246
 247         if (eflag)
 248                 fr_hdr_print(length, addr_len, dlci, flags, nlpid);
 249
 250         p += hdr_len;
 251         length -= hdr_len;
 252         caplen -= hdr_len;
 253
 254         switch (nlpid) {
 255         case NLPID_IP:
 256                 ip_print(p, length);
 257                 break;
 258
 259 #ifdef INET6
 260         case NLPID_IP6:
 261                 ip6_print(p, length);
 262                 break;
 263 #endif
 264         case NLPID_CLNP:
 265         case NLPID_ESIS:
 266         case NLPID_ISIS:
 267                 isoclns_print(p-1, length+1, caplen+1); /* OSI printers need the NLPID field */
 268                 break;
 269
 270         case NLPID_SNAP:
 271                 orgcode = EXTRACT_24BITS(p);
 272                 et = EXTRACT_16BITS(p + 3);
 273                 if (snap_print((const u_char *)(p + 5), length - 5,
 274                            caplen - 5, &extracted_ethertype, orgcode, et,
 275                            0) == 0) {
 276                         /* ether_type not known, print raw packet */
 277                         if (!eflag)
 278                             fr_hdr_print(length + hdr_len, hdr_len,
 279                                              dlci, flags, nlpid);
 280                         if (extracted_ethertype) {
 281                                 printf("(SNAP %s) ",
 282                                etherproto_string(htons(extracted_ethertype)));
 283                         }
 284                         if (!xflag && !qflag)
 285                                 default_print(p - hdr_len, caplen + hdr_len);
 286                 }
 287                 break;
 288
 289         case NLPID_Q933:
 290                 q933_print(p, length);
 291                 break;
 292
 293         case NLPID_MFR:
 294                 frf15_print(p, length);
 295                 break;
 296
 297         default:
 298                 if (!eflag)
 299                     fr_hdr_print(length + hdr_len, addr_len,
 300                                      dlci, flags, nlpid);
 301                 if (!xflag)
 302                         default_print(p, caplen);
 303         }
 304
 305         return hdr_len;
 306 }
 307
 308 /* an NLPID of 0xb1 indicates a 2-byte
 309  * FRF.15 header
 310  *
 311  *      7    6    5    4    3    2    1    0
 312  *    +----+----+----+----+----+----+----+----+
 313  *    ~              Q.922 header             ~
 314  *    +----+----+----+----+----+----+----+----+
 315  *    |             NLPID (8 bits)            | NLPID=0xb1
 316  *    +----+----+----+----+----+----+----+----+
 317  *    | B  | E  | C  |seq. (high 4 bits) | R  |
 318  *    +----+----+----+----+----+----+----+----+
 319  *    |        sequence  (low 8 bits)         |
 320  *    +----+----+----+----+----+----+----+----+
 321  */
 322
 323 struct tok frf15_flag_values[] = {
 324     { 0x80, "Begin" },
 325     { 0x40, "End" },
 326     { 0x20, "Control" },
 327     { 0, NULL }
 328 };
 329
 330 #define FR_FRF15_FRAGTYPE 0x01
 331
 332 static void
 333 frf15_print (const u_char *p, u_int length) {
 334
 335     u_int16_t sequence_num, flags;
 336
 337     flags = p[0]&0xe0;
 338     sequence_num = (p[0]&0x1e)<<7 | p[1];
 339
 340     printf("FRF.15, seq 0x%03x, Flags [%s],%s Fragmentation, length %u",
 341            sequence_num,
 342            bittok2str(frf15_flag_values,"none",flags),
 343            flags&FR_FRF15_FRAGTYPE ? "Interface" : "End-to-End",
 344            length);
 345
 346 /* TODO:
 347  * depending on all permutations of the B, E and C bit
 348  * dig as deep as we can - e.g. on the first (B) fragment
 349  * there is enough payload to print the IP header
 350  * on non (B) fragments it depends if the fragmentation
 351  * model is end-to-end or interface based wether we want to print
 352  * another Q.922 header
 353  */
 354
 355 }
 356
 357 /*
 358  * Q.933 decoding portion for framerelay specific.
 359  */
 360
 361 /* Q.933 packet format
 362                       Format of Other Protocols
 363                           using Q.933 NLPID
 364                   +-------------------------------+
 365                   |        Q.922 Address          |
 366                   +---------------+---------------+
 367                   |Control  0x03  | NLPID   0x08  |
 368                   +---------------+---------------+
 369                   |          L2 Protocol ID       |
 370                   | octet 1       |  octet 2      |
 371                   +-------------------------------+
 372                   |          L3 Protocol ID       |
 373                   | octet 2       |  octet 2      |
 374                   +-------------------------------+
 375                   |         Protocol Data         |
 376                   +-------------------------------+
 377                   | FCS                           |
 378                   +-------------------------------+
 379  */
 380
 381 /* L2 (Octet 1)- Call Reference Usually is 0x0 */
 382
 383 /*
 384  * L2 (Octet 2)- Message Types definition 1 byte long.
 385  */
 386 /* Call Establish */
 387 #define MSG_TYPE_ESC_TO_NATIONAL  0x00
 388 #define MSG_TYPE_ALERT            0x01
 389 #define MSG_TYPE_CALL_PROCEEDING  0x02
 390 #define MSG_TYPE_CONNECT          0x07
 391 #define MSG_TYPE_CONNECT_ACK      0x0F
 392 #define MSG_TYPE_PROGRESS         0x03
 393 #define MSG_TYPE_SETUP            0x05
 394 /* Call Clear */
 395 #define MSG_TYPE_DISCONNECT       0x45
 396 #define MSG_TYPE_RELEASE          0x4D
 397 #define MSG_TYPE_RELEASE_COMPLETE 0x5A
 398 #define MSG_TYPE_RESTART          0x46
 399 #define MSG_TYPE_RESTART_ACK      0x4E
 400 /* Status */
 401 #define MSG_TYPE_STATUS           0x7D
 402 #define MSG_TYPE_STATUS_ENQ       0x75
 403
 404 struct tok fr_q933_msg_values[] = {
 405     { MSG_TYPE_ESC_TO_NATIONAL, "ESC to National" },
 406     { MSG_TYPE_ALERT, "Alert" },
 407     { MSG_TYPE_CALL_PROCEEDING, "Call proceeding" },
 408     { MSG_TYPE_CONNECT, "Connect" },
 409     { MSG_TYPE_CONNECT_ACK, "Connect ACK" },
 410     { MSG_TYPE_PROGRESS, "Progress" },
 411     { MSG_TYPE_SETUP, "Setup" },
 412     { MSG_TYPE_DISCONNECT, "Disconnect" },
 413     { MSG_TYPE_RELEASE, "Release" },
 414     { MSG_TYPE_RELEASE_COMPLETE, "Release Complete" },
 415     { MSG_TYPE_RESTART, "Restart" },
 416     { MSG_TYPE_RESTART_ACK, "Restart ACK" },
 417     { MSG_TYPE_STATUS, "Status Reply" },
 418     { MSG_TYPE_STATUS_ENQ, "Status Enquiry" },
 419     { 0, NULL }
 420 };
 421
 422 #define MSG_ANSI_LOCKING_SHIFT  0x95
 423
 424 #define FR_LMI_ANSI_REPORT_TYPE_IE      0x01
 425 #define FR_LMI_ANSI_LINK_VERIFY_IE_91   0x19 /* details? */
 426 #define FR_LMI_ANSI_LINK_VERIFY_IE      0x03
 427 #define FR_LMI_ANSI_PVC_STATUS_IE       0x07
 428
 429 #define FR_LMI_CCITT_REPORT_TYPE_IE     0x51
 430 #define FR_LMI_CCITT_LINK_VERIFY_IE     0x53
 431 #define FR_LMI_CCITT_PVC_STATUS_IE      0x57
 432
 433 struct tok fr_q933_ie_values[] = {
 434     { FR_LMI_ANSI_REPORT_TYPE_IE, "ANSI Report Type" },
 435     { FR_LMI_ANSI_LINK_VERIFY_IE_91, "ANSI Link Verify" },
 436     { FR_LMI_ANSI_LINK_VERIFY_IE, "ANSI Link Verify" },
 437     { FR_LMI_ANSI_PVC_STATUS_IE, "ANSI PVC Status" },
 438     { FR_LMI_CCITT_REPORT_TYPE_IE, "CCITT Report Type" },
 439     { FR_LMI_CCITT_LINK_VERIFY_IE, "CCITT Link Verify" },
 440     { FR_LMI_CCITT_PVC_STATUS_IE, "CCITT PVC Status" },
 441     { 0, NULL }
 442 };
 443
 444 #define FR_LMI_REPORT_TYPE_IE_FULL_STATUS 0
 445 #define FR_LMI_REPORT_TYPE_IE_LINK_VERIFY 1
 446 #define FR_LMI_REPORT_TYPE_IE_ASYNC_PVC   2
 447
 448 struct tok fr_lmi_report_type_ie_values[] = {
 449     { FR_LMI_REPORT_TYPE_IE_FULL_STATUS, "Full Status" },
 450     { FR_LMI_REPORT_TYPE_IE_LINK_VERIFY, "Link verify" },
 451     { FR_LMI_REPORT_TYPE_IE_ASYNC_PVC, "Async PVC Status" },
 452     { 0, NULL }
 453 };
 454
 455 struct common_ie_header {
 456     u_int8_t ie_id;
 457     u_int8_t ie_len;
 458 };
 459
 460 static void
 461 q933_print(const u_char *p, u_int length)
 462 {
 463         const u_char *ptemp = p;
 464         struct common_ie_header *ie_p;
 465         int olen;
 466         int is_ansi = 0;
 467         u_int dlci;
 468
 469         if (length < 9) {       /* shortest: Q.933a LINK VERIFY */
 470                 printf("[|q.933]");
 471                 return;
 472         }
 473
 474         if (p[2] == MSG_ANSI_LOCKING_SHIFT)
 475                 is_ansi = 1;
 476
 477         if (!eflag)
 478             printf("Q.933, ");
 479
 480         /* printing out header part */
 481         printf(is_ansi ? "ANSI" : "CCITT ");
 482
 483         if (p[0])
 484                 printf(", Call Ref: 0x%02x", p[0]);
 485
 486         if (vflag)
 487             printf(", %s (0x%02x), length %u",
 488                    tok2str(fr_q933_msg_values,"unknown message",p[1]),
 489                    p[1],
 490                    length);
 491         else
 492             printf(", %s",
 493                    tok2str(fr_q933_msg_values,"unknown message 0x%02x",p[1]));
 494
 495         olen = length; /* preserve the original length for non verbose mode */
 496
 497         if (length < (u_int)(2 - is_ansi)) {
 498                 printf("[|q.933]");
 499                 return;
 500         }
 501         length -= 2 - is_ansi;
 502         ptemp += 2 + is_ansi;
 503
 504         /* Loop through the rest of IE */
 505         while (length > 0) {
 506                 ie_p = (struct common_ie_header *)ptemp;
 507                 if (length < sizeof(struct common_ie_header) ||
 508                     length < sizeof(struct common_ie_header) + ie_p->ie_len) {
 509                     if (vflag) /* not bark if there is just a trailer */
 510                         printf("\n[|q.933]");
 511                     else
 512                         printf(", length %u",olen);
 513                     return;
 514                 }
 515
 516                 /* lets do the full IE parsing only in verbose mode
 517                  * however some IEs (DLCI Status, Link Verify)
 518                  * are also intereststing in non-verbose mode */
 519                 if (vflag)
 520                     printf("\n\t%s IE (%u), length %u: ",
 521                            tok2str(fr_q933_ie_values,"unknown",ie_p->ie_id),
 522                            ie_p->ie_id,
 523                            ie_p->ie_len);
 524
 525                 switch (ie_p->ie_id) {
 526
 527                 case FR_LMI_ANSI_REPORT_TYPE_IE: /* fall through */
 528                 case FR_LMI_CCITT_REPORT_TYPE_IE:
 529                     if (vflag)
 530                         printf("%s (%u)",
 531                                tok2str(fr_lmi_report_type_ie_values,"unknown",ptemp[2]),
 532                                ptemp[2]);
 533                     break;
 534
 535                 case FR_LMI_ANSI_LINK_VERIFY_IE: /* fall through */
 536                 case FR_LMI_CCITT_LINK_VERIFY_IE:
 537                 case FR_LMI_ANSI_LINK_VERIFY_IE_91:
 538                     if (!vflag)
 539                         printf(", ");
 540                     printf("TX Seq: %3d, RX Seq: %3d", ptemp[2], ptemp[3]);
 541                     break;
 542                 case FR_LMI_ANSI_PVC_STATUS_IE: /* fall through */
 543                 case FR_LMI_CCITT_PVC_STATUS_IE:
 544                     if (!vflag)
 545                         printf(", ");
 546                     /* now parse the DLCI information element. */
 547                     if ((ie_p->ie_len < 3) ||
 548                         (ptemp[2] & 0x80) ||
 549                         ((ie_p->ie_len == 3) && !(ptemp[3] & 0x80)) ||
 550                         ((ie_p->ie_len == 4) && ((ptemp[3] & 0x80) || !(ptemp[4] & 0x80))) ||
 551                         ((ie_p->ie_len == 5) && ((ptemp[3] & 0x80) || (ptemp[4] & 0x80) ||
 552                                            !(ptemp[5] & 0x80))) ||
 553                         (ie_p->ie_len > 5) ||
 554                         !(ptemp[ie_p->ie_len + 1] & 0x80))
 555                         printf("Invalid DLCI IE");
 556
 557                     dlci = ((ptemp[2] & 0x3F) << 4) | ((ptemp[3] & 0x78) >> 3);
 558                     if (ie_p->ie_len == 4)
 559                         dlci = (dlci << 6) | ((ptemp[4] & 0x7E) >> 1);
 560                     else if (ie_p->ie_len == 5)
 561                         dlci = (dlci << 13) | (ptemp[4] & 0x7F) | ((ptemp[5] & 0x7E) >> 1);
 562
 563                     printf("DLCI %u: status %s%s", dlci,
 564                              ptemp[ie_p->ie_len + 1] & 0x8 ? "New, " : "",
 565                              ptemp[ie_p->ie_len + 1] & 0x2 ? "Active" : "Inactive");
 566                     break;
 567
 568                 default:
 569                     if (vflag <= 1)
 570                         print_unknown_data(ptemp+2,"\n\t",ie_p->ie_len);
 571                     break;
 572                 }
 573
 574                 /* do we want to see a hexdump of the IE ? */
 575                 if (vflag> 1)
 576                     print_unknown_data(ptemp+2,"\n\t  ",ie_p->ie_len);
 577
 578                 length = length - ie_p->ie_len - 2;
 579                 ptemp = ptemp + ie_p->ie_len + 2;
 580         }
 581         if (!vflag)
 582             printf(", length %u",olen);
 583 }