add a decoder for Loopback/CTP

tcpdump used to print an empty line for a Loopback (CTP) packet, which
many Cisco switches send by default every 10 seconds. This commit adds
a decoder for the protocol and a test case, which uses the sample
capture from Wireshark wiki (configuration_test_protocol_aka_loop.pcap).

diff --git a/Makefile.in b/Makefile.in
index 8e54a98f5528da8015f07fedc259606b1c74a915..7f7658472e603b1a074559f2a40adf0011857bdb 100644 (file)
--- a/Makefile.in
+++ b/Makefile.in
@@ -85,7 +85,7 @@ LIBNETDISSECT_SRC=addrtoname.c af.c checksum.c cpack.c gmpls.c oui.c gmt2local.c
        print-igrp.c print-ip.c print-ipcomp.c print-ipfc.c print-ipnet.c \
        print-ipx.c print-isakmp.c print-isoclns.c print-juniper.c print-krb.c \
        print-l2tp.c print-lane.c print-ldp.c print-lldp.c print-llc.c \
-        print-lmp.c print-lspping.c print-lwapp.c \
+        print-lmp.c print-loopback.c print-lspping.c print-lwapp.c \
        print-lwres.c print-mobile.c print-mpcp.c print-mpls.c print-mptcp.c print-msdp.c \
        print-msnlb.c print-nflog.c print-nfs.c print-ntp.c print-null.c \
        print-olsr.c print-openflow.c print-openflow-1.0.c print-ospf.c \

diff --git a/netdissect.h b/netdissect.h
index d8a6f121800ef8588a28f9919e32f2087bd0c18a..1772f6ec65457030ca5c92299efa8ef0db9c0e2f 100644 (file)
--- a/netdissect.h
+++ b/netdissect.h
@@ -309,6 +309,7 @@ extern void ip_print_inner(netdissect_options *ndo,
                           const u_char *bp, u_int length, u_int nh,
                           const u_char *bp2);
 extern void rrcp_print(netdissect_options *,const u_char *, u_int);
+extern void loopback_print(netdissect_options *, const u_char *, u_int);
 
 extern void ether_print(netdissect_options *,
                         const u_char *, u_int, u_int,

diff --git a/print-ether.c b/print-ether.c
index d90a2f166e315bc0a13195d256544ac4166a1e24..22808d14e059bb5ae12a1a1b3ba98774d8e1077d 100644 (file)
--- a/print-ether.c
+++ b/print-ether.c
@@ -401,6 +401,7 @@ ethertype_print(netdissect_options *ndo,
                return (1);
 
         case ETHERTYPE_LOOPBACK:
+               loopback_print(ndo, p, length);
                 return (1);
 
        case ETHERTYPE_MPLS:

diff --git a/print-loopback.c b/print-loopback.c
new file mode 100644 (file)
index 0000000..1708033
--- /dev/null
+++ b/print-loopback.c
@@ -0,0 +1,135 @@
+/*
+ * This module implements decoding of the the Loopback Protocol, originally
+ * defined as the Configuration Testing Protocol. It is based on the following
+ * specification:
+ * http://www.mit.edu/people/jhawk/ctp.pdf
+ *
+ * Copyright (c) 2014 The TCPDUMP project
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
+ * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <tcpdump-stdinc.h>
+
+#include "netdissect.h"
+#include "extract.h"
+#include "ether.h"
+#include "addrtoname.h"
+
+static const char tstr[] = " [|loopback]";
+static const char cstr[] = " (corrupt)";
+
+#define LOOPBACK_REPLY   1
+#define LOOPBACK_FWDDATA 2
+
+static const struct tok fcode_str[] = {
+       { LOOPBACK_REPLY,   "Reply"        },
+       { LOOPBACK_FWDDATA, "Forward Data" },
+       { 0, NULL }
+};
+
+static void
+loopback_message_print(netdissect_options *ndo, const u_char *cp, const u_int len)
+{
+       const u_char *ep = cp + len;
+       uint16_t function;
+
+       if (len < 2)
+               goto corrupt;
+       /* function */
+       ND_TCHECK2(*cp, 2);
+       function = EXTRACT_LE_16BITS(cp);
+       cp += 2;
+       ND_PRINT((ndo, ", %s", tok2str(fcode_str, " invalid (%u)", function)));
+
+       switch (function) {
+               case LOOPBACK_REPLY:
+                       if (len < 4)
+                               goto corrupt;
+                       /* receipt number */
+                       ND_TCHECK2(*cp, 2);
+                       ND_PRINT((ndo, ", receipt number %u", EXTRACT_LE_16BITS(cp)));
+                       cp += 2;
+                       /* data */
+                       ND_PRINT((ndo, ", data (%u octets)", len - 4));
+                       ND_TCHECK2(*cp, len - 4);
+                       break;
+               case LOOPBACK_FWDDATA:
+                       if (len < 8)
+                               goto corrupt;
+                       /* forwarding address */
+                       ND_TCHECK2(*cp, ETHER_ADDR_LEN);
+                       ND_PRINT((ndo, ", forwarding address %s", etheraddr_string(cp)));
+                       cp += ETHER_ADDR_LEN;
+                       /* data */
+                       ND_PRINT((ndo, ", data (%u octets)", len - 8));
+                       ND_TCHECK2(*cp, len - 8);
+                       break;
+               default:
+                       ND_TCHECK2(*cp, len - 2);
+                       break;
+       }
+       return;
+
+corrupt:
+       ND_PRINT((ndo, "%s", cstr));
+       ND_TCHECK2(*cp, ep - cp);
+       return;
+trunc:
+       ND_PRINT((ndo, "%s", tstr));
+}
+
+void
+loopback_print(netdissect_options *ndo, const u_char *cp, const u_int len)
+{
+       const u_char *ep = cp + len;
+       uint16_t skipCount;
+
+       ND_PRINT((ndo, "Loopback"));
+       if (len < 2)
+               goto corrupt;
+       /* skipCount */
+       ND_TCHECK2(*cp, 2);
+       skipCount = EXTRACT_LE_16BITS(cp);
+       cp += 2;
+       ND_PRINT((ndo, ", skipCount %u", skipCount));
+       if (skipCount % 8)
+               ND_PRINT((ndo, " (bogus)"));
+       if (skipCount > len - 2)
+               goto corrupt;
+       loopback_message_print(ndo, cp + skipCount, len - 2 - skipCount);
+       return;
+
+corrupt:
+       ND_PRINT((ndo, "%s", cstr));
+       ND_TCHECK2(*cp, ep - cp);
+       return;
+trunc:
+       ND_PRINT((ndo, "%s", tstr));
+}
+

diff --git a/tests/TESTLIST b/tests/TESTLIST
index 61f7981baef86fdd2fb48c1bbb478a43cb2f123c..8a1c5f784166152a0185811e8164f5f4474280ed 100644 (file)
--- a/tests/TESTLIST
+++ b/tests/TESTLIST
@@ -170,3 +170,6 @@ syslog-v    syslog_udp.pcap         syslog-v.out            -t -v
 
 #IPv6 tests
 ipv6-bad-version.pcap  ipv6-bad-version.pcap   ipv6-bad-version.out    -t
+
+# Loopback/CTP test case
+loopback       loopback.pcap           loopback.out            -t

diff --git a/tests/loopback.out b/tests/loopback.out
new file mode 100644 (file)
index 0000000..7b8dece
--- /dev/null
+++ b/tests/loopback.out
@@ -0,0 +1,6 @@
+Loopback, skipCount 0, Forward Data, forwarding address aa:00:04:00:1d:04, data (44 octets)
+Loopback, skipCount 8, Reply, receipt number 1, data (40 octets)
+Loopback, skipCount 0, Forward Data, forwarding address aa:00:04:00:6a:04, data (60 octets)
+Loopback, skipCount 8, Forward Data, forwarding address aa:00:04:00:69:04, data (52 octets)
+Loopback, skipCount 16, Forward Data, forwarding address aa:00:04:00:1d:04, data (44 octets)
+Loopback, skipCount 24, Reply, receipt number 2, data (40 octets)

diff --git a/tests/loopback.pcap b/tests/loopback.pcap
new file mode 100644 (file)
index 0000000..384c0d3
Binary files /dev/null and b/tests/loopback.pcap differ