* with an awful lot of hacking by Jeffrey Mogul, DECWRL
*/
+/* \summary: IEEE 802.2 LLC printer */
+
#ifdef HAVE_CONFIG_H
-#include "config.h"
+#include <config.h>
#endif
-#include <tcpdump-stdinc.h>
+#include "netdissect-stdinc.h"
-#include "interface.h"
+#include "netdissect.h"
#include "addrtoname.h"
-#include "extract.h" /* must come after interface.h */
+#include "extract.h"
#include "llc.h"
#include "ethertype.h"
*/
int
llc_print(netdissect_options *ndo, const u_char *p, u_int length, u_int caplen,
- const u_char *esrc, const u_char *edst)
+ const struct lladdr_info *src, const struct lladdr_info *dst)
{
uint8_t dsap_field, dsap, ssap_field, ssap;
uint16_t control;
- u_int hdrlen;
+ int hdrlen;
int is_u;
+ ndo->ndo_protocol = "llc";
if (caplen < 3) {
- ND_PRINT((ndo, "[|llc]"));
- ND_DEFAULTPRINT((u_char *)p, caplen);
+ nd_print_trunc(ndo);
+ ND_DEFAULTPRINT((const u_char *)p, caplen);
return (caplen);
}
if (length < 3) {
- ND_PRINT((ndo, "[|llc]"));
- ND_DEFAULTPRINT((u_char *)p, caplen);
+ nd_print_trunc(ndo);
+ ND_DEFAULTPRINT((const u_char *)p, caplen);
return (length);
}
- dsap_field = *p;
- ssap_field = *(p + 1);
+ dsap_field = GET_U_1(p);
+ ssap_field = GET_U_1(p + 1);
/*
* OK, what type of LLC frame is this? The length
* have a two-byte control field, and U frames have
* a one-byte control field.
*/
- control = *(p + 2);
+ control = GET_U_1(p + 2);
if ((control & LLC_U_FMT) == LLC_U_FMT) {
/*
* U frame.
* 2 bytes...
*/
if (caplen < 4) {
- ND_PRINT((ndo, "[|llc]"));
- ND_DEFAULTPRINT((u_char *)p, caplen);
+ nd_print_trunc(ndo);
+ ND_DEFAULTPRINT((const u_char *)p, caplen);
return (caplen);
}
if (length < 4) {
- ND_PRINT((ndo, "[|llc]"));
- ND_DEFAULTPRINT((u_char *)p, caplen);
+ nd_print_trunc(ndo);
+ ND_DEFAULTPRINT((const u_char *)p, caplen);
return (length);
}
/*
* ...and is little-endian.
*/
- control = EXTRACT_LE_16BITS(p + 2);
+ control = GET_LE_U_2(p + 2);
is_u = 0;
hdrlen = 4; /* DSAP, SSAP, 2-byte control field */
}
/*
* This is an Ethernet_802.3 IPX frame; it has an
* 802.3 header (i.e., an Ethernet header where the
- * type/length field is <= ETHERMTU, i.e. it's a length
- * field, not a type field), but has no 802.2 header -
- * the IPX packet starts right after the Ethernet header,
- * with a signature of two bytes of 0xFF (which is
- * LLCSAP_GLOBAL).
+ * type/length field is <= MAX_ETHERNET_LENGTH_VAL,
+ * i.e. it's a length field, not a type field), but
+ * has no 802.2 header - the IPX packet starts right
+ * after the Ethernet header, with a signature of two
+ * bytes of 0xFF (which is LLCSAP_GLOBAL).
*
* (It might also have been an Ethernet_802.3 IPX at
* one time, but got bridged onto another network,
*/
if (ndo->ndo_eflag)
- ND_PRINT((ndo, "IPX 802.3: "));
+ ND_PRINT("IPX 802.3: ");
ipx_print(ndo, p, length);
return (0); /* no LLC header */
dsap = dsap_field & ~LLC_IG;
ssap = ssap_field & ~LLC_GSAP;
+ if (ndo->ndo_eflag) {
+ ND_PRINT("LLC, dsap %s (0x%02x) %s, ssap %s (0x%02x) %s",
+ tok2str(llc_values, "Unknown", dsap),
+ dsap,
+ tok2str(llc_ig_flag_values, "Unknown", dsap_field & LLC_IG),
+ tok2str(llc_values, "Unknown", ssap),
+ ssap,
+ tok2str(llc_flag_values, "Unknown", ssap_field & LLC_GSAP));
+
+ if (is_u) {
+ ND_PRINT(", ctrl 0x%02x: ", control);
+ } else {
+ ND_PRINT(", ctrl 0x%04x: ", control);
+ }
+ }
+
/*
* Skip LLC header.
*/
length -= hdrlen;
caplen -= hdrlen;
- /*
- * Check for SNAP UI packets; if we have one, there's no point
- * in printing the LLC header information, as we already know it -
- * the relevant protocol-selection information is the SNAP OUI
- * and PID, so it's sufficient to print that for frames we
- * don't know how to print and for the "-e" flag.
- */
if (ssap == LLCSAP_SNAP && dsap == LLCSAP_SNAP
&& control == LLC_UI) {
/*
* Does anybody ever bridge one form of LAN traffic
* over a networking type that uses 802.2 LLC?
*/
- if (!snap_print(ndo, p, length, caplen, esrc, edst, 2)) {
+ if (!snap_print(ndo, p, length, caplen, src, dst, 2)) {
/*
* Unknown packet type; tell our caller, by
* returning a negative value, so they
return (hdrlen + 5); /* include LLC and SNAP header */
}
- if (ndo->ndo_eflag) {
- ND_PRINT((ndo, "LLC, dsap %s (0x%02x) %s, ssap %s (0x%02x) %s",
- tok2str(llc_values, "Unknown", dsap),
- dsap,
- tok2str(llc_ig_flag_values, "Unknown", dsap_field & LLC_IG),
- tok2str(llc_values, "Unknown", ssap),
- ssap,
- tok2str(llc_flag_values, "Unknown", ssap_field & LLC_GSAP)));
-
- if (is_u) {
- ND_PRINT((ndo, ", ctrl 0x%02x: ", control));
- } else {
- ND_PRINT((ndo, ", ctrl 0x%04x: ", control));
- }
- }
-
if (ssap == LLCSAP_8021D && dsap == LLCSAP_8021D &&
control == LLC_UI) {
stp_print(ndo, p, length);
* destination SAPs being the IPX SAP.
*/
if (ndo->ndo_eflag)
- ND_PRINT((ndo, "IPX 802.2: "));
+ ND_PRINT("IPX 802.2: ");
ipx_print(ndo, p, length);
return (hdrlen);
}
-#ifdef TCPDUMP_DO_SMB
+#ifdef ENABLE_SMB
if (ssap == LLCSAP_NETBEUI && dsap == LLCSAP_NETBEUI
&& (!(control & LLC_S_FMT) || control == LLC_U_FMT)) {
/*
#endif
if (ssap == LLCSAP_ISONS && dsap == LLCSAP_ISONS
&& control == LLC_UI) {
- isoclns_print(ndo, p, length, caplen);
+ isoclns_print(ndo, p, length);
return (hdrlen);
}
if (!ndo->ndo_eflag) {
if (ssap == dsap) {
- if (esrc == NULL || edst == NULL)
- ND_PRINT((ndo, "%s ", tok2str(llc_values, "Unknown DSAP 0x%02x", dsap)));
+ if (src == NULL || dst == NULL)
+ ND_PRINT("%s ", tok2str(llc_values, "Unknown DSAP 0x%02x", dsap));
else
- ND_PRINT((ndo, "%s > %s %s ",
- etheraddr_string(ndo, esrc),
- etheraddr_string(ndo, edst),
- tok2str(llc_values, "Unknown DSAP 0x%02x", dsap)));
+ ND_PRINT("%s > %s %s ",
+ (src->addr_string)(ndo, src->addr),
+ (dst->addr_string)(ndo, dst->addr),
+ tok2str(llc_values, "Unknown DSAP 0x%02x", dsap));
} else {
- if (esrc == NULL || edst == NULL)
- ND_PRINT((ndo, "%s > %s ",
+ if (src == NULL || dst == NULL)
+ ND_PRINT("%s > %s ",
tok2str(llc_values, "Unknown SSAP 0x%02x", ssap),
- tok2str(llc_values, "Unknown DSAP 0x%02x", dsap)));
+ tok2str(llc_values, "Unknown DSAP 0x%02x", dsap));
else
- ND_PRINT((ndo, "%s %s > %s %s ",
- etheraddr_string(ndo, esrc),
+ ND_PRINT("%s %s > %s %s ",
+ (src->addr_string)(ndo, src->addr),
tok2str(llc_values, "Unknown SSAP 0x%02x", ssap),
- etheraddr_string(ndo, edst),
- tok2str(llc_values, "Unknown DSAP 0x%02x", dsap)));
+ (dst->addr_string)(ndo, dst->addr),
+ tok2str(llc_values, "Unknown DSAP 0x%02x", dsap));
}
}
if (is_u) {
- ND_PRINT((ndo, "Unnumbered, %s, Flags [%s], length %u",
+ ND_PRINT("Unnumbered, %s, Flags [%s], length %u",
tok2str(llc_cmd_values, "%02x", LLC_U_CMD(control)),
tok2str(llc_flag_values,"?",(ssap_field & LLC_GSAP) | (control & LLC_U_POLL)),
- length + hdrlen));
+ length + hdrlen);
if ((control & ~LLC_U_POLL) == LLC_XID) {
- if (*p == LLC_XID_FI) {
- ND_PRINT((ndo, ": %02x %02x", p[1], p[2]));
+ if (length == 0) {
+ /*
+ * XID with no payload.
+ * This could, for example, be an SNA
+ * "short form" XID.
+ */
+ return (hdrlen);
+ }
+ if (caplen < 1) {
+ nd_print_trunc(ndo);
+ if (caplen > 0)
+ ND_DEFAULTPRINT((const u_char *)p, caplen);
+ return (hdrlen);
+ }
+ if (GET_U_1(p) == LLC_XID_FI) {
+ if (caplen < 3 || length < 3) {
+ nd_print_trunc(ndo);
+ if (caplen > 0)
+ ND_DEFAULTPRINT((const u_char *)p, caplen);
+ } else
+ ND_PRINT(": %02x %02x",
+ GET_U_1(p + 1),
+ GET_U_1(p + 2));
return (hdrlen);
}
}
} else {
if ((control & LLC_S_FMT) == LLC_S_FMT) {
- ND_PRINT((ndo, "Supervisory, %s, rcv seq %u, Flags [%s], length %u",
+ ND_PRINT("Supervisory, %s, rcv seq %u, Flags [%s], length %u",
tok2str(llc_supervisory_values,"?",LLC_S_CMD(control)),
LLC_IS_NR(control),
tok2str(llc_flag_values,"?",(ssap_field & LLC_GSAP) | (control & LLC_IS_POLL)),
- length + hdrlen));
+ length + hdrlen);
return (hdrlen); /* no payload to print */
} else {
- ND_PRINT((ndo, "Information, send seq %u, rcv seq %u, Flags [%s], length %u",
+ ND_PRINT("Information, send seq %u, rcv seq %u, Flags [%s], length %u",
LLC_I_NS(control),
LLC_IS_NR(control),
tok2str(llc_flag_values,"?",(ssap_field & LLC_GSAP) | (control & LLC_IS_POLL)),
- length + hdrlen));
+ length + hdrlen);
}
}
return (-hdrlen);
}
-static void
-snap_hdr_print(netdissect_options *ndo, const uint8_t *esrc, const uint8_t *edst,
- uint32_t orgcode, u_short et, u_int length)
+static const struct tok *
+oui_to_struct_tok(uint32_t orgcode)
{
const struct tok *tok = null_values;
const struct oui_tok *otp;
- if (esrc != NULL && edst != NULL) {
- ND_PRINT((ndo, "%s > %s ",
- etheraddr_string(ndo, esrc),
- etheraddr_string(ndo, edst)));
- }
for (otp = &oui_to_tok[0]; otp->tok != NULL; otp++) {
if (otp->oui == orgcode) {
tok = otp->tok;
break;
}
}
- ND_PRINT((ndo, "SNAP oui %s (0x%06x), %s %s (0x%04x), length %u: ",
- tok2str(oui_values, "Unknown", orgcode),
- orgcode,
- (orgcode == 0x000000 ? "ethertype" : "pid"),
- tok2str(tok, "Unknown", et),
- et, length));
+ return (tok);
}
int
snap_print(netdissect_options *ndo, const u_char *p, u_int length, u_int caplen,
- const u_char *esrc, const u_char *edst, u_int bridge_pad)
+ const struct lladdr_info *src, const struct lladdr_info *dst,
+ u_int bridge_pad)
{
uint32_t orgcode;
- register u_short et;
- register int ret;
+ u_short et;
+ int ret;
- ND_TCHECK2(*p, 5);
+ ndo->ndo_protocol = "snap";
+ ND_TCHECK_5(p);
if (caplen < 5 || length < 5)
goto trunc;
- orgcode = EXTRACT_24BITS(p);
- et = EXTRACT_16BITS(p + 3);
+ orgcode = GET_BE_U_3(p);
+ et = GET_BE_U_2(p + 3);
if (ndo->ndo_eflag) {
/*
* Somebody's already printed the MAC addresses, if there
- * are any, so just print the SNAP header.
+ * are any, so just print the SNAP header, not the MAC
+ * addresses.
*/
- snap_hdr_print(ndo, NULL, NULL, orgcode, et, length - 5);
+ ND_PRINT("oui %s (0x%06x), %s %s (0x%04x), length %u: ",
+ tok2str(oui_values, "Unknown", orgcode),
+ orgcode,
+ (orgcode == 0x000000 ? "ethertype" : "pid"),
+ tok2str(oui_to_struct_tok(orgcode), "Unknown", et),
+ et, length - 5);
}
p += 5;
length -= 5;
* Cisco hardware; the protocol ID is
* an Ethernet protocol type.
*/
- ret = ethertype_print(ndo, et, p, length, caplen);
+ ret = ethertype_print(ndo, et, p, length, caplen, src, dst);
if (ret)
return (ret);
break;
* but used 0x000000 and an Ethernet
* packet type for AARP packets.
*/
- ret = ethertype_print(ndo, et, p, length, caplen);
+ ret = ethertype_print(ndo, et, p, length, caplen, src, dst);
if (ret)
return (ret);
}
/*
* Skip the padding.
*/
- ND_TCHECK2(*p, bridge_pad);
+ ND_TCHECK_LEN(p, bridge_pad);
caplen -= bridge_pad;
length -= bridge_pad;
p += bridge_pad;
* Skip the padding, but not the Access
* Control field.
*/
- ND_TCHECK2(*p, bridge_pad);
+ ND_TCHECK_LEN(p, bridge_pad);
caplen -= bridge_pad;
length -= bridge_pad;
p += bridge_pad;
/*
* Skip the padding.
*/
- ND_TCHECK2(*p, bridge_pad + 1);
+ ND_TCHECK_LEN(p, bridge_pad + 1);
caplen -= bridge_pad + 1;
length -= bridge_pad + 1;
p += bridge_pad + 1;
return (1);
}
}
- if (!ndo->ndo_eflag)
- snap_hdr_print(ndo, esrc, edst, orgcode, et, length);
+ if (!ndo->ndo_eflag) {
+ /*
+ * Nobody printed the link-layer addresses, so print them, if
+ * we have any.
+ */
+ if (src != NULL && dst != NULL) {
+ ND_PRINT("%s > %s ",
+ (src->addr_string)(ndo, src->addr),
+ (dst->addr_string)(ndo, dst->addr));
+ }
+ /*
+ * Print the SNAP header, but if the OUI is 000000, don't
+ * bother printing it, and report the PID as being an
+ * ethertype.
+ */
+ if (orgcode == 0x000000) {
+ ND_PRINT("SNAP, ethertype %s (0x%04x), length %u: ",
+ tok2str(ethertype_values, "Unknown", et),
+ et, length);
+ } else {
+ ND_PRINT("SNAP, oui %s (0x%06x), pid %s (0x%04x), length %u: ",
+ tok2str(oui_values, "Unknown", orgcode),
+ orgcode,
+ tok2str(oui_to_struct_tok(orgcode), "Unknown", et),
+ et, length);
+ }
+ }
return (0);
trunc:
- ND_PRINT((ndo, "[|snap]"));
+ nd_print_trunc(ndo);
return (1);
}
-
-
-/*
- * Local Variables:
- * c-style: whitesmith
- * c-basic-offset: 8
- * End:
- */
projects / tcpdump / blobdiff