Try marking structures as UNALIGNED.

[tcpdump] / print-juniper.c

diff --git a/print-juniper.c b/print-juniper.c
index 6ae5b6d8d19619a6bdbe5497d60a8f315e5caf5c..ff1de9c03d15bf9edf72b93ba2c356e4754b3262 100644 (file)
--- a/print-juniper.c
+++ b/print-juniper.c
@@ -12,9 +12,11 @@
  * LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
  * FOR A PARTICULAR PURPOSE.
  *
  * LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
  * FOR A PARTICULAR PURPOSE.
  *

- * Original code by Hannes Gredler (hannes@juniper.net)
+ * Original code by Hannes Gredler (hannes@gredler.at)

  */
 
  */
 

+/* \summary: DLT_JUNIPER_* printers */
+

 #ifndef lint
 #else
 __RCSID("NetBSD: print-juniper.c,v 1.3 2007/07/25 06:31:32 dogcow Exp ");
 #ifndef lint
 #else
 __RCSID("NetBSD: print-juniper.c,v 1.3 2007/07/25 06:31:32 dogcow Exp ");


@@ -24,9 +26,11 @@ __RCSID("NetBSD: print-juniper.c,v 1.3 2007/07/25 06:31:32 dogcow Exp ");
 #include "config.h"
 #endif
 
 #include "config.h"
 #endif
 

-#include <tcpdump-stdinc.h>
+#include <netdissect-stdinc.h>
+
+#include <string.h>

 
 

-#include "interface.h"
+#include "netdissect.h"

 #include "addrtoname.h"
 #include "extract.h"
 #include "ppp.h"
 #include "addrtoname.h"
 #include "extract.h"
 #include "ppp.h"


@@ -88,7 +92,7 @@ enum {
 };
 
 /* 1 byte type and 1-byte length */
 };
 
 /* 1 byte type and 1-byte length */

-#define JUNIPER_EXT_TLV_OVERHEAD 2
+#define JUNIPER_EXT_TLV_OVERHEAD 2U

 
 static const struct tok jnx_ext_tlv_values[] = {
     { JUNIPER_EXT_TLV_IFD_IDX, "Device Interface Index" },
 
 static const struct tok jnx_ext_tlv_values[] = {
     { JUNIPER_EXT_TLV_IFD_IDX, "Device Interface Index" },


@@ -468,6 +472,7 @@ juniper_ggsn_print(netdissect_options *ndo,
         p+=l2info.header_len;
         gh = (struct juniper_ggsn_header *)&l2info.cookie;
 
         p+=l2info.header_len;
         gh = (struct juniper_ggsn_header *)&l2info.cookie;
 

+        ND_TCHECK(*gh);

         if (ndo->ndo_eflag) {
             ND_PRINT((ndo, "proto %s (%u), vlan %u: ",
                    tok2str(juniper_protocol_values,"Unknown",gh->proto),
         if (ndo->ndo_eflag) {
             ND_PRINT((ndo, "proto %s (%u), vlan %u: ",
                    tok2str(juniper_protocol_values,"Unknown",gh->proto),


@@ -488,6 +493,10 @@ juniper_ggsn_print(netdissect_options *ndo,
         }
 
         return l2info.header_len;
         }
 
         return l2info.header_len;

+
+trunc:
+       ND_PRINT((ndo, "[|juniper_services]"));
+       return l2info.header_len;

 }
 #endif
 
 }
 #endif
 


@@ -513,8 +522,9 @@ juniper_es_print(netdissect_options *ndo,
             return l2info.header_len;
 
         p+=l2info.header_len;
             return l2info.header_len;
 
         p+=l2info.header_len;

-        ih = (struct juniper_ipsec_header *)p;
+        ih = (const struct juniper_ipsec_header *)p;

 
 

+        ND_TCHECK(*ih);

         switch (ih->type) {
         case JUNIPER_IPSEC_O_ESP_ENCRYPT_ESP_AUTHEN_TYPE:
         case JUNIPER_IPSEC_O_ESP_ENCRYPT_AH_AUTHEN_TYPE:
         switch (ih->type) {
         case JUNIPER_IPSEC_O_ESP_ENCRYPT_ESP_AUTHEN_TYPE:
         case JUNIPER_IPSEC_O_ESP_ENCRYPT_AH_AUTHEN_TYPE:


@@ -560,6 +570,10 @@ juniper_es_print(netdissect_options *ndo,
 
         ip_print(ndo, p, l2info.length);
         return l2info.header_len;
 
         ip_print(ndo, p, l2info.length);
         return l2info.header_len;

+
+trunc:
+       ND_PRINT((ndo, "[|juniper_services]"));
+       return l2info.header_len;

 }
 #endif
 
 }
 #endif
 


@@ -582,8 +596,9 @@ juniper_monitor_print(netdissect_options *ndo,
             return l2info.header_len;
 
         p+=l2info.header_len;
             return l2info.header_len;
 
         p+=l2info.header_len;

-        mh = (struct juniper_monitor_header *)p;
+        mh = (const struct juniper_monitor_header *)p;

 
 

+        ND_TCHECK(*mh);

         if (ndo->ndo_eflag)
             ND_PRINT((ndo, "service-id %u, iif %u, pkt-type %u: ",
                    EXTRACT_32BITS(&mh->service_id),
         if (ndo->ndo_eflag)
             ND_PRINT((ndo, "service-id %u, iif %u, pkt-type %u: ",
                    EXTRACT_32BITS(&mh->service_id),


@@ -594,6 +609,10 @@ juniper_monitor_print(netdissect_options *ndo,
         ip_heuristic_guess (ndo, p, l2info.length);
 
         return l2info.header_len;
         ip_heuristic_guess (ndo, p, l2info.length);
 
         return l2info.header_len;

+
+trunc:
+       ND_PRINT((ndo, "[|juniper_services]"));
+       return l2info.header_len;

 }
 #endif
 
 }
 #endif
 


@@ -616,8 +635,9 @@ juniper_services_print(netdissect_options *ndo,
             return l2info.header_len;
 
         p+=l2info.header_len;
             return l2info.header_len;
 
         p+=l2info.header_len;

-        sh = (struct juniper_services_header *)p;
+        sh = (const struct juniper_services_header *)p;

 
 

+        ND_TCHECK(*sh);

         if (ndo->ndo_eflag)
             ND_PRINT((ndo, "service-id %u flags 0x%02x service-set-id 0x%04x iif %u: ",
                    sh->svc_id,
         if (ndo->ndo_eflag)
             ND_PRINT((ndo, "service-id %u flags 0x%02x service-set-id 0x%04x iif %u: ",
                    sh->svc_id,


@@ -629,6 +649,10 @@ juniper_services_print(netdissect_options *ndo,
         ip_heuristic_guess (ndo, p, l2info.length);
 
         return l2info.header_len;
         ip_heuristic_guess (ndo, p, l2info.length);
 
         return l2info.header_len;

+
+trunc:
+       ND_PRINT((ndo, "[|juniper_services]"));
+       return l2info.header_len;

 }
 #endif
 
 }
 #endif
 


@@ -736,17 +760,23 @@ juniper_pppoe_atm_print(netdissect_options *ndo,
 
         p+=l2info.header_len;
 
 
         p+=l2info.header_len;
 

+        ND_TCHECK2(p[0], 2);

         extracted_ethertype = EXTRACT_16BITS(p);
         /* this DLT contains nothing but raw PPPoE frames,
          * prepended with a type field*/
         if (ethertype_print(ndo, extracted_ethertype,
                               p+ETHERTYPE_LEN,
                               l2info.length-ETHERTYPE_LEN,
         extracted_ethertype = EXTRACT_16BITS(p);
         /* this DLT contains nothing but raw PPPoE frames,
          * prepended with a type field*/
         if (ethertype_print(ndo, extracted_ethertype,
                               p+ETHERTYPE_LEN,
                               l2info.length-ETHERTYPE_LEN,

-                              l2info.caplen-ETHERTYPE_LEN) == 0)
+                              l2info.caplen-ETHERTYPE_LEN,
+                              NULL, NULL) == 0)

             /* ether_type not known, probably it wasn't one */
             ND_PRINT((ndo, "unknown ethertype 0x%04x", extracted_ethertype));
 
         return l2info.header_len;
             /* ether_type not known, probably it wasn't one */
             ND_PRINT((ndo, "unknown ethertype 0x%04x", extracted_ethertype));
 
         return l2info.header_len;

+
+trunc:
+       ND_PRINT((ndo, "[|juniper_pppoe_atm]"));
+       return l2info.header_len;

 }
 #endif
 
 }
 #endif
 


@@ -788,7 +818,7 @@ juniper_mlppp_print(netdissect_options *ndo,
             mpls_print(ndo, p, l2info.length);
             return l2info.header_len;
         case JUNIPER_LSQ_L3_PROTO_ISO:
             mpls_print(ndo, p, l2info.length);
             return l2info.header_len;
         case JUNIPER_LSQ_L3_PROTO_ISO:

-            isoclns_print(ndo, p, l2info.length, l2info.caplen);
+            isoclns_print(ndo, p, l2info.length);

             return l2info.header_len;
         default:
             break;
             return l2info.header_len;
         default:
             break;


@@ -817,6 +847,7 @@ juniper_mfr_print(netdissect_options *ndo,
 {
         struct juniper_l2info_t l2info;
 
 {
         struct juniper_l2info_t l2info;
 

+        memset(&l2info, 0, sizeof(l2info));

         l2info.pictype = DLT_JUNIPER_MFR;
         if (juniper_parse_header(ndo, p, h, &l2info) == 0)
             return l2info.header_len;
         l2info.pictype = DLT_JUNIPER_MFR;
         if (juniper_parse_header(ndo, p, h, &l2info) == 0)
             return l2info.header_len;


@@ -842,7 +873,7 @@ juniper_mfr_print(netdissect_options *ndo,
                 mpls_print(ndo, p, l2info.length);
                 return l2info.header_len;
             case JUNIPER_LSQ_L3_PROTO_ISO:
                 mpls_print(ndo, p, l2info.length);
                 return l2info.header_len;
             case JUNIPER_LSQ_L3_PROTO_ISO:

-                isoclns_print(ndo, p, l2info.length, l2info.caplen);
+                isoclns_print(ndo, p, l2info.length);

                 return l2info.header_len;
             default:
                 break;
                 return l2info.header_len;
             default:
                 break;


@@ -855,13 +886,13 @@ juniper_mfr_print(netdissect_options *ndo,
             ND_PRINT((ndo, "Bundle-ID %u, ", l2info.bundle));
         switch (l2info.proto) {
         case (LLCSAP_ISONS<<8 | LLCSAP_ISONS):
             ND_PRINT((ndo, "Bundle-ID %u, ", l2info.bundle));
         switch (l2info.proto) {
         case (LLCSAP_ISONS<<8 | LLCSAP_ISONS):

-            isoclns_print(ndo, p + 1, l2info.length - 1, l2info.caplen - 1);
+            isoclns_print(ndo, p + 1, l2info.length - 1);

             break;
         case (LLC_UI<<8 | NLPID_Q933):
         case (LLC_UI<<8 | NLPID_IP):
         case (LLC_UI<<8 | NLPID_IP6):
             /* pass IP{4,6} to the OSI layer for proper link-layer printing */
             break;
         case (LLC_UI<<8 | NLPID_Q933):
         case (LLC_UI<<8 | NLPID_IP):
         case (LLC_UI<<8 | NLPID_IP6):
             /* pass IP{4,6} to the OSI layer for proper link-layer printing */

-            isoclns_print(ndo, p - 1, l2info.length + 1, l2info.caplen + 1);
+            isoclns_print(ndo, p - 1, l2info.length + 1);

             break;
         default:
             ND_PRINT((ndo, "unknown protocol 0x%04x, length %u", l2info.proto, l2info.length));
             break;
         default:
             ND_PRINT((ndo, "unknown protocol 0x%04x, length %u", l2info.proto, l2info.length));


@@ -890,13 +921,13 @@ juniper_mlfr_print(netdissect_options *ndo,
         switch (l2info.proto) {
         case (LLC_UI):
         case (LLC_UI<<8):
         switch (l2info.proto) {
         case (LLC_UI):
         case (LLC_UI<<8):

-            isoclns_print(ndo, p, l2info.length, l2info.caplen);
+            isoclns_print(ndo, p, l2info.length);

             break;
         case (LLC_UI<<8 | NLPID_Q933):
         case (LLC_UI<<8 | NLPID_IP):
         case (LLC_UI<<8 | NLPID_IP6):
             /* pass IP{4,6} to the OSI layer for proper link-layer printing */
             break;
         case (LLC_UI<<8 | NLPID_Q933):
         case (LLC_UI<<8 | NLPID_IP):
         case (LLC_UI<<8 | NLPID_IP6):
             /* pass IP{4,6} to the OSI layer for proper link-layer printing */

-            isoclns_print(ndo, p - 1, l2info.length + 1, l2info.caplen + 1);
+            isoclns_print(ndo, p - 1, l2info.length + 1);

             break;
         default:
             ND_PRINT((ndo, "unknown protocol 0x%04x, length %u", l2info.proto, l2info.length));
             break;
         default:
             ND_PRINT((ndo, "unknown protocol 0x%04x, length %u", l2info.proto, l2info.length));


@@ -934,6 +965,7 @@ juniper_atm1_print(netdissect_options *ndo,
             return l2info.header_len;
         }
 
             return l2info.header_len;
         }
 

+        ND_TCHECK2(p[0], 3);

         if (EXTRACT_24BITS(p) == 0xfefe03 || /* NLPID encaps ? */
             EXTRACT_24BITS(p) == 0xaaaa03) { /* SNAP encaps ? */
 
         if (EXTRACT_24BITS(p) == 0xfefe03 || /* NLPID encaps ? */
             EXTRACT_24BITS(p) == 0xaaaa03) { /* SNAP encaps ? */
 


@@ -943,7 +975,7 @@ juniper_atm1_print(netdissect_options *ndo,
         }
 
         if (p[0] == 0x03) { /* Cisco style NLPID encaps ? */
         }
 
         if (p[0] == 0x03) { /* Cisco style NLPID encaps ? */

-            isoclns_print(ndo, p + 1, l2info.length - 1, l2info.caplen - 1);
+            isoclns_print(ndo, p + 1, l2info.length - 1);

             /* FIXME check if frame was recognized */
             return l2info.header_len;
         }
             /* FIXME check if frame was recognized */
             return l2info.header_len;
         }


@@ -952,6 +984,10 @@ juniper_atm1_print(netdissect_options *ndo,
             return l2info.header_len;
 
        return l2info.header_len;
             return l2info.header_len;
 
        return l2info.header_len;

+
+trunc:
+       ND_PRINT((ndo, "[|juniper_atm1]"));
+       return l2info.header_len;

 }
 #endif
 
 }
 #endif
 


@@ -983,6 +1019,7 @@ juniper_atm2_print(netdissect_options *ndo,
             return l2info.header_len;
         }
 
             return l2info.header_len;
         }
 

+        ND_TCHECK2(p[0], 3);

         if (EXTRACT_24BITS(p) == 0xfefe03 || /* NLPID encaps ? */
             EXTRACT_24BITS(p) == 0xaaaa03) { /* SNAP encaps ? */
 
         if (EXTRACT_24BITS(p) == 0xfefe03 || /* NLPID encaps ? */
             EXTRACT_24BITS(p) == 0xaaaa03) { /* SNAP encaps ? */
 


@@ -998,7 +1035,7 @@ juniper_atm2_print(netdissect_options *ndo,
         }
 
         if (p[0] == 0x03) { /* Cisco style NLPID encaps ? */
         }
 
         if (p[0] == 0x03) { /* Cisco style NLPID encaps ? */

-            isoclns_print(ndo, p + 1, l2info.length - 1, l2info.caplen - 1);
+            isoclns_print(ndo, p + 1, l2info.length - 1);

             /* FIXME check if frame was recognized */
             return l2info.header_len;
         }
             /* FIXME check if frame was recognized */
             return l2info.header_len;
         }


@@ -1010,6 +1047,10 @@ juniper_atm2_print(netdissect_options *ndo,
             return l2info.header_len;
 
        return l2info.header_len;
             return l2info.header_len;
 
        return l2info.header_len;

+
+trunc:
+       ND_PRINT((ndo, "[|juniper_atm2]"));
+       return l2info.header_len;

 }
 #endif
 
 }
 #endif
 


@@ -1032,10 +1073,8 @@ juniper_ppp_heuristic_guess(netdissect_options *ndo,
     case PPP_PAP :
     case PPP_CHAP :
     case PPP_ML :
     case PPP_PAP :
     case PPP_CHAP :
     case PPP_ML :

-#ifdef INET6

     case PPP_IPV6 :
     case PPP_IPV6CP :
     case PPP_IPV6 :
     case PPP_IPV6CP :

-#endif

         ppp_print(ndo, p, length);
         break;
 
         ppp_print(ndo, p, length);
         break;
 


@@ -1199,9 +1238,11 @@ juniper_parse_header(netdissect_options *ndo,
             tlv_len = *(tptr++);
             tlv_value = 0;
 
             tlv_len = *(tptr++);
             tlv_value = 0;
 

-            /* sanity check */
+            /* sanity checks */

             if (tlv_type == 0 || tlv_len == 0)
                 break;
             if (tlv_type == 0 || tlv_len == 0)
                 break;

+            if (tlv_len+JUNIPER_EXT_TLV_OVERHEAD > jnx_ext_len)
+                goto trunc;

 
             if (ndo->ndo_vflag > 1)
                 ND_PRINT((ndo, "\n\t  %s Extension TLV #%u, length %u, value ",
 
             if (ndo->ndo_vflag > 1)
                 ND_PRINT((ndo, "\n\t  %s Extension TLV #%u, length %u, value ",


@@ -1274,6 +1315,7 @@ juniper_parse_header(netdissect_options *ndo,
     l2info->caplen -= l2info->header_len;
 
     /* search through the cookie table and copy values matching for our PIC type */
     l2info->caplen -= l2info->header_len;
 
     /* search through the cookie table and copy values matching for our PIC type */

+    ND_TCHECK(p[0]);

     while (lp->s != NULL) {
         if (lp->pictype == l2info->pictype) {
 
     while (lp->s != NULL) {
         if (lp->pictype == l2info->pictype) {
 


@@ -1325,6 +1367,7 @@ juniper_parse_header(netdissect_options *ndo,
             if (ndo->ndo_eflag) ND_PRINT((ndo, ": ")); /* print demarc b/w L2/L3*/
 
 
             if (ndo->ndo_eflag) ND_PRINT((ndo, ": ")); /* print demarc b/w L2/L3*/
 
 

+            ND_TCHECK_16BITS(p+l2info->cookie_len);

             l2info->proto = EXTRACT_16BITS(p+l2info->cookie_len);
             break;
         }
             l2info->proto = EXTRACT_16BITS(p+l2info->cookie_len);
             break;
         }


@@ -1354,6 +1397,7 @@ juniper_parse_header(netdissect_options *ndo,
     case DLT_JUNIPER_MLFR:
         switch (l2info->cookie_type) {
         case LS_COOKIE_ID:
     case DLT_JUNIPER_MLFR:
         switch (l2info->cookie_type) {
         case LS_COOKIE_ID:

+            ND_TCHECK2(p[0], 2);

             l2info->bundle = l2info->cookie[1];
             l2info->proto = EXTRACT_16BITS(p);
             l2info->header_len += 2;
             l2info->bundle = l2info->cookie[1];
             l2info->proto = EXTRACT_16BITS(p);
             l2info->header_len += 2;


@@ -1377,6 +1421,7 @@ juniper_parse_header(netdissect_options *ndo,
     case DLT_JUNIPER_MFR:
         switch (l2info->cookie_type) {
         case LS_COOKIE_ID:
     case DLT_JUNIPER_MFR:
         switch (l2info->cookie_type) {
         case LS_COOKIE_ID:

+            ND_TCHECK2(p[0], 2);

             l2info->bundle = l2info->cookie[1];
             l2info->proto = EXTRACT_16BITS(p);
             l2info->header_len += 2;
             l2info->bundle = l2info->cookie[1];
             l2info->proto = EXTRACT_16BITS(p);
             l2info->header_len += 2;