* with an awful lot of hacking by Jeffrey Mogul, DECWRL
*/
+/* \summary: IEEE 802.2 LLC printer */
+
#ifdef HAVE_CONFIG_H
#include "config.h"
#endif
-#include <tcpdump-stdinc.h>
-
-#include <stdio.h>
-#include <string.h>
+#include <netdissect-stdinc.h>
-#include "interface.h"
+#include "netdissect.h"
#include "addrtoname.h"
-#include "extract.h" /* must come after interface.h */
+#include "extract.h"
#include "llc.h"
#include "ethertype.h"
};
struct oui_tok {
- u_int32_t oui;
+ uint32_t oui;
const struct tok *tok;
};
};
/*
- * Returns non-zero IFF it succeeds in printing the header
+ * If we printed information about the payload, returns the length of the LLC
+ * header, plus the length of any SNAP header following it.
+ *
+ * Otherwise (for example, if the packet has unknown SAPs or has a SNAP
+ * header with an unknown OUI/PID combination), returns the *negative*
+ * of that value.
*/
int
-llc_print(const u_char *p, u_int length, u_int caplen,
- const u_char *esrc, const u_char *edst, u_short *extracted_ethertype)
+llc_print(netdissect_options *ndo, const u_char *p, u_int length, u_int caplen,
+ const struct lladdr_info *src, const struct lladdr_info *dst)
{
- u_int8_t dsap_field, dsap, ssap_field, ssap;
- u_int16_t control;
+ uint8_t dsap_field, dsap, ssap_field, ssap;
+ uint16_t control;
+ int hdrlen;
int is_u;
- register int ret;
-
- *extracted_ethertype = 0;
if (caplen < 3) {
- (void)printf("[|llc]");
- default_print((u_char *)p, caplen);
- return(0);
+ ND_PRINT((ndo, "[|llc]"));
+ ND_DEFAULTPRINT((const u_char *)p, caplen);
+ return (caplen);
+ }
+ if (length < 3) {
+ ND_PRINT((ndo, "[|llc]"));
+ ND_DEFAULTPRINT((const u_char *)p, caplen);
+ return (length);
}
dsap_field = *p;
* U frame.
*/
is_u = 1;
+ hdrlen = 3; /* DSAP, SSAP, 1-byte control field */
} else {
/*
* The control field in I and S frames is
* 2 bytes...
*/
if (caplen < 4) {
- (void)printf("[|llc]");
- default_print((u_char *)p, caplen);
- return(0);
+ ND_PRINT((ndo, "[|llc]"));
+ ND_DEFAULTPRINT((const u_char *)p, caplen);
+ return (caplen);
+ }
+ if (length < 4) {
+ ND_PRINT((ndo, "[|llc]"));
+ ND_DEFAULTPRINT((const u_char *)p, caplen);
+ return (length);
}
/*
*/
control = EXTRACT_LE_16BITS(p + 2);
is_u = 0;
+ hdrlen = 4; /* DSAP, SSAP, 2-byte control field */
}
if (ssap_field == LLCSAP_GLOBAL && dsap_field == LLCSAP_GLOBAL) {
* least one capture file.)
*/
- if (eflag)
- printf("IPX 802.3: ");
+ if (ndo->ndo_eflag)
+ ND_PRINT((ndo, "IPX 802.3: "));
- ipx_print(p, length);
- return (1);
+ ipx_print(ndo, p, length);
+ return (0); /* no LLC header */
}
dsap = dsap_field & ~LLC_IG;
ssap = ssap_field & ~LLC_GSAP;
- if (eflag) {
- printf("LLC, dsap %s (0x%02x) %s, ssap %s (0x%02x) %s",
+ if (ndo->ndo_eflag) {
+ ND_PRINT((ndo, "LLC, dsap %s (0x%02x) %s, ssap %s (0x%02x) %s",
tok2str(llc_values, "Unknown", dsap),
dsap,
tok2str(llc_ig_flag_values, "Unknown", dsap_field & LLC_IG),
tok2str(llc_values, "Unknown", ssap),
ssap,
- tok2str(llc_flag_values, "Unknown", ssap_field & LLC_GSAP));
+ tok2str(llc_flag_values, "Unknown", ssap_field & LLC_GSAP)));
if (is_u) {
- printf(", ctrl 0x%02x: ", control);
+ ND_PRINT((ndo, ", ctrl 0x%02x: ", control));
} else {
- printf(", ctrl 0x%04x: ", control);
+ ND_PRINT((ndo, ", ctrl 0x%04x: ", control));
}
}
+ /*
+ * Skip LLC header.
+ */
+ p += hdrlen;
+ length -= hdrlen;
+ caplen -= hdrlen;
+
+ if (ssap == LLCSAP_SNAP && dsap == LLCSAP_SNAP
+ && control == LLC_UI) {
+ /*
+ * XXX - what *is* the right bridge pad value here?
+ * Does anybody ever bridge one form of LAN traffic
+ * over a networking type that uses 802.2 LLC?
+ */
+ if (!snap_print(ndo, p, length, caplen, src, dst, 2)) {
+ /*
+ * Unknown packet type; tell our caller, by
+ * returning a negative value, so they
+ * can print the raw packet.
+ */
+ return (-(hdrlen + 5)); /* include LLC and SNAP header */
+ } else
+ return (hdrlen + 5); /* include LLC and SNAP header */
+ }
+
if (ssap == LLCSAP_8021D && dsap == LLCSAP_8021D &&
control == LLC_UI) {
- stp_print(p+3, length-3);
- return (1);
+ stp_print(ndo, p, length);
+ return (hdrlen);
}
if (ssap == LLCSAP_IP && dsap == LLCSAP_IP &&
control == LLC_UI) {
- ip_print(gndo, p+4, length-4);
- return (1);
+ /*
+ * This is an RFC 948-style IP packet, with
+ * an 802.3 header and an 802.2 LLC header
+ * with the source and destination SAPs being
+ * the IP SAP.
+ */
+ ip_print(ndo, p, length);
+ return (hdrlen);
}
if (ssap == LLCSAP_IPX && dsap == LLCSAP_IPX &&
* This is an Ethernet_802.2 IPX frame, with an 802.3
* header and an 802.2 LLC header with the source and
* destination SAPs being the IPX SAP.
- *
- * Skip DSAP, LSAP, and control field.
*/
- if (eflag)
- printf("IPX 802.2: ");
+ if (ndo->ndo_eflag)
+ ND_PRINT((ndo, "IPX 802.2: "));
- ipx_print(p+3, length-3);
- return (1);
+ ipx_print(ndo, p, length);
+ return (hdrlen);
}
-#ifdef TCPDUMP_DO_SMB
+#ifdef ENABLE_SMB
if (ssap == LLCSAP_NETBEUI && dsap == LLCSAP_NETBEUI
&& (!(control & LLC_S_FMT) || control == LLC_U_FMT)) {
/*
* LLC_S_FMT, set in the first byte of the control field)
* and UI frames (whose control field is just 3, LLC_U_FMT).
*/
-
- /*
- * Skip the LLC header.
- */
- if (is_u) {
- p += 3;
- length -= 3;
- caplen -= 3;
- } else {
- p += 4;
- length -= 4;
- caplen -= 4;
- }
- netbeui_print(control, p, length);
- return (1);
+ netbeui_print(ndo, control, p, length);
+ return (hdrlen);
}
#endif
if (ssap == LLCSAP_ISONS && dsap == LLCSAP_ISONS
&& control == LLC_UI) {
- isoclns_print(p + 3, length - 3, caplen - 3);
- return (1);
- }
-
- if (ssap == LLCSAP_SNAP && dsap == LLCSAP_SNAP
- && control == LLC_UI) {
- /*
- * XXX - what *is* the right bridge pad value here?
- * Does anybody ever bridge one form of LAN traffic
- * over a networking type that uses 802.2 LLC?
- */
- ret = snap_print(p+3, length-3, caplen-3, 2);
- if (ret)
- return (ret);
+ isoclns_print(ndo, p, length, caplen);
+ return (hdrlen);
}
- if (!eflag) {
+ if (!ndo->ndo_eflag) {
if (ssap == dsap) {
- if (esrc == NULL || edst == NULL)
- (void)printf("%s ", tok2str(llc_values, "Unknown DSAP 0x%02x", dsap));
+ if (src == NULL || dst == NULL)
+ ND_PRINT((ndo, "%s ", tok2str(llc_values, "Unknown DSAP 0x%02x", dsap)));
else
- (void)printf("%s > %s %s ",
- etheraddr_string(esrc),
- etheraddr_string(edst),
- tok2str(llc_values, "Unknown DSAP 0x%02x", dsap));
+ ND_PRINT((ndo, "%s > %s %s ",
+ (src->addr_string)(ndo, src->addr),
+ (dst->addr_string)(ndo, dst->addr),
+ tok2str(llc_values, "Unknown DSAP 0x%02x", dsap)));
} else {
- if (esrc == NULL || edst == NULL)
- (void)printf("%s > %s ",
+ if (src == NULL || dst == NULL)
+ ND_PRINT((ndo, "%s > %s ",
tok2str(llc_values, "Unknown SSAP 0x%02x", ssap),
- tok2str(llc_values, "Unknown DSAP 0x%02x", dsap));
+ tok2str(llc_values, "Unknown DSAP 0x%02x", dsap)));
else
- (void)printf("%s %s > %s %s ",
- etheraddr_string(esrc),
+ ND_PRINT((ndo, "%s %s > %s %s ",
+ (src->addr_string)(ndo, src->addr),
tok2str(llc_values, "Unknown SSAP 0x%02x", ssap),
- etheraddr_string(edst),
- tok2str(llc_values, "Unknown DSAP 0x%02x", dsap));
+ (dst->addr_string)(ndo, dst->addr),
+ tok2str(llc_values, "Unknown DSAP 0x%02x", dsap)));
}
}
if (is_u) {
- printf("Unnumbered, %s, Flags [%s], length %u",
+ ND_PRINT((ndo, "Unnumbered, %s, Flags [%s], length %u",
tok2str(llc_cmd_values, "%02x", LLC_U_CMD(control)),
tok2str(llc_flag_values,"?",(ssap_field & LLC_GSAP) | (control & LLC_U_POLL)),
- length);
-
- p += 3;
- length -= 3;
- caplen -= 3;
+ length + hdrlen));
if ((control & ~LLC_U_POLL) == LLC_XID) {
+ if (length == 0) {
+ /*
+ * XID with no payload.
+ * This could, for example, be an SNA
+ * "short form" XID.
+ */
+ return (hdrlen);
+ }
+ if (caplen < 1) {
+ ND_PRINT((ndo, "[|llc]"));
+ if (caplen > 0)
+ ND_DEFAULTPRINT((const u_char *)p, caplen);
+ return (hdrlen);
+ }
if (*p == LLC_XID_FI) {
- printf(": %02x %02x", p[1], p[2]);
- p += 3;
- length -= 3;
- caplen -= 3;
+ if (caplen < 3 || length < 3) {
+ ND_PRINT((ndo, "[|llc]"));
+ if (caplen > 0)
+ ND_DEFAULTPRINT((const u_char *)p, caplen);
+ } else
+ ND_PRINT((ndo, ": %02x %02x", p[1], p[2]));
+ return (hdrlen);
}
}
} else {
if ((control & LLC_S_FMT) == LLC_S_FMT) {
- (void)printf("Supervisory, %s, rcv seq %u, Flags [%s], length %u",
+ ND_PRINT((ndo, "Supervisory, %s, rcv seq %u, Flags [%s], length %u",
tok2str(llc_supervisory_values,"?",LLC_S_CMD(control)),
LLC_IS_NR(control),
tok2str(llc_flag_values,"?",(ssap_field & LLC_GSAP) | (control & LLC_IS_POLL)),
- length);
+ length + hdrlen));
+ return (hdrlen); /* no payload to print */
} else {
- (void)printf("Information, send seq %u, rcv seq %u, Flags [%s], length %u",
+ ND_PRINT((ndo, "Information, send seq %u, rcv seq %u, Flags [%s], length %u",
LLC_I_NS(control),
LLC_IS_NR(control),
tok2str(llc_flag_values,"?",(ssap_field & LLC_GSAP) | (control & LLC_IS_POLL)),
- length);
+ length + hdrlen));
+ }
+ }
+ return (-hdrlen);
+}
+
+static const struct tok *
+oui_to_struct_tok(uint32_t orgcode)
+{
+ const struct tok *tok = null_values;
+ const struct oui_tok *otp;
+
+ for (otp = &oui_to_tok[0]; otp->tok != NULL; otp++) {
+ if (otp->oui == orgcode) {
+ tok = otp->tok;
+ break;
}
- p += 4;
- length -= 4;
- caplen -= 4;
}
- return(1);
+ return (tok);
}
int
-snap_print(const u_char *p, u_int length, u_int caplen, u_int bridge_pad)
+snap_print(netdissect_options *ndo, const u_char *p, u_int length, u_int caplen,
+ const struct lladdr_info *src, const struct lladdr_info *dst,
+ u_int bridge_pad)
{
- u_int32_t orgcode;
+ uint32_t orgcode;
register u_short et;
register int ret;
- TCHECK2(*p, 5);
+ ND_TCHECK2(*p, 5);
+ if (caplen < 5 || length < 5)
+ goto trunc;
orgcode = EXTRACT_24BITS(p);
et = EXTRACT_16BITS(p + 3);
- if (eflag) {
- const struct tok *tok = null_values;
- const struct oui_tok *otp;
-
- for (otp = &oui_to_tok[0]; otp->tok != NULL; otp++) {
- if (otp->oui == orgcode) {
- tok = otp->tok;
- break;
- }
- }
- (void)printf("oui %s (0x%06x), %s %s (0x%04x): ",
+ if (ndo->ndo_eflag) {
+ /*
+ * Somebody's already printed the MAC addresses, if there
+ * are any, so just print the SNAP header, not the MAC
+ * addresses.
+ */
+ ND_PRINT((ndo, "oui %s (0x%06x), %s %s (0x%04x), length %u: ",
tok2str(oui_values, "Unknown", orgcode),
orgcode,
(orgcode == 0x000000 ? "ethertype" : "pid"),
- tok2str(tok, "Unknown", et),
- et);
+ tok2str(oui_to_struct_tok(orgcode), "Unknown", et),
+ et, length - 5));
}
p += 5;
length -= 5;
* Cisco hardware; the protocol ID is
* an Ethernet protocol type.
*/
- ret = ethertype_print(gndo, et, p, length, caplen);
+ ret = ethertype_print(ndo, et, p, length, caplen, src, dst);
if (ret)
return (ret);
break;
* but used 0x000000 and an Ethernet
* packet type for AARP packets.
*/
- ret = ethertype_print(gndo, et, p, length, caplen);
+ ret = ethertype_print(ndo, et, p, length, caplen, src, dst);
if (ret)
return (ret);
}
case OUI_CISCO:
switch (et) {
case PID_CISCO_CDP:
- cdp_print(p, length, caplen);
+ cdp_print(ndo, p, length, caplen);
return (1);
case PID_CISCO_DTP:
- dtp_print(p, length);
+ dtp_print(ndo, p, length);
return (1);
case PID_CISCO_UDLD:
- udld_print(p, length);
+ udld_print(ndo, p, length);
return (1);
case PID_CISCO_VTP:
- vtp_print(p, length);
+ vtp_print(ndo, p, length);
return (1);
case PID_CISCO_PVST:
case PID_CISCO_VLANBRIDGE:
- stp_print(p, length);
+ stp_print(ndo, p, length);
return (1);
default:
break;
}
+ break;
case OUI_RFC2684:
switch (et) {
/*
* Skip the padding.
*/
- TCHECK2(*p, bridge_pad);
+ ND_TCHECK2(*p, bridge_pad);
caplen -= bridge_pad;
length -= bridge_pad;
p += bridge_pad;
/*
* What remains is an Ethernet packet.
*/
- ether_print(gndo, p, length, caplen, NULL, NULL);
+ ether_print(ndo, p, length, caplen, NULL, NULL);
return (1);
case PID_RFC2684_802_5_FCS:
* Skip the padding, but not the Access
* Control field.
*/
- TCHECK2(*p, bridge_pad);
+ ND_TCHECK2(*p, bridge_pad);
caplen -= bridge_pad;
length -= bridge_pad;
p += bridge_pad;
* What remains is an 802.5 Token Ring
* packet.
*/
- token_print(p, length, caplen);
+ token_print(ndo, p, length, caplen);
return (1);
case PID_RFC2684_FDDI_FCS:
/*
* Skip the padding.
*/
- TCHECK2(*p, bridge_pad + 1);
+ ND_TCHECK2(*p, bridge_pad + 1);
caplen -= bridge_pad + 1;
length -= bridge_pad + 1;
p += bridge_pad + 1;
/*
* What remains is an FDDI packet.
*/
- fddi_print(p, length, caplen);
+ fddi_print(ndo, p, length, caplen);
return (1);
case PID_RFC2684_BPDU:
- stp_print(p, length);
+ stp_print(ndo, p, length);
return (1);
}
}
+ if (!ndo->ndo_eflag) {
+ /*
+ * Nobody printed the link-layer addresses, so print them, if
+ * we have any.
+ */
+ if (src != NULL && dst != NULL) {
+ ND_PRINT((ndo, "%s > %s ",
+ (src->addr_string)(ndo, src->addr),
+ (dst->addr_string)(ndo, dst->addr)));
+ }
+ /*
+ * Print the SNAP header, but if the OUI is 000000, don't
+ * bother printing it, and report the PID as being an
+ * ethertype.
+ */
+ if (orgcode == 0x000000) {
+ ND_PRINT((ndo, "SNAP, ethertype %s (0x%04x), length %u: ",
+ tok2str(ethertype_values, "Unknown", et),
+ et, length));
+ } else {
+ ND_PRINT((ndo, "SNAP, oui %s (0x%06x), pid %s (0x%04x), length %u: ",
+ tok2str(oui_values, "Unknown", orgcode),
+ orgcode,
+ tok2str(oui_to_struct_tok(orgcode), "Unknown", et),
+ et, length));
+ }
+ }
return (0);
trunc:
- (void)printf("[|snap]");
+ ND_PRINT((ndo, "[|snap]"));
return (1);
}
projects / tcpdump / blobdiff