From: Denis Ovsienko Date: Sat, 15 Mar 2014 11:29:46 +0000 (+0400) Subject: NDOize LLC decoder X-Git-Tag: tcpdump-4.6.0~172 X-Git-Url: https://git.tcpdump.org/tcpdump/commitdiff_plain/d1cffd99e6487cc1c2f2dbbc6ea4cc60c36226c7 NDOize LLC decoder --- diff --git a/interface.h b/interface.h index 686997a0..8f0bb84a 100644 --- a/interface.h +++ b/interface.h @@ -164,9 +164,6 @@ extern u_int16_t create_osi_cksum(const u_int8_t *, int, int); extern void ascii_print(const u_char *, u_int); extern void telnet_print(const u_char *, u_int); -extern int llc_print(const u_char *, u_int, u_int, const u_char *, - const u_char *, u_short *); -extern int snap_print(const u_char *, u_int, u_int, u_int); extern void aarp_print(const u_char *, u_int); extern void aodv_print(const u_char *, u_int, int); extern void atalk_print(const u_char *, u_int); diff --git a/netdissect.h b/netdissect.h index f64961dc..1c071fb0 100644 --- a/netdissect.h +++ b/netdissect.h @@ -420,6 +420,8 @@ extern void mpcp_print(netdissect_options *, const u_char *, u_int); extern void rpki_rtr_print(netdissect_options *, const u_char *, u_int); extern u_int sll_if_print(netdissect_options *, const struct pcap_pkthdr *, const u_char *); extern void dccp_print(netdissect_options *, const u_char *, const u_char *, u_int); +extern int llc_print(netdissect_options *, const u_char *, u_int, u_int, const u_char *, const u_char *, u_short *); +extern int snap_print(netdissect_options *, const u_char *, u_int, u_int, u_int); /* stuff that has not yet been rototiled */ extern const u_char * ns_nprint (register const u_char *, register const u_char *); @@ -427,9 +429,6 @@ extern const u_char * ns_nprint (register const u_char *, register const u_char #if 0 extern void ascii_print(netdissect_options *,u_int); extern void telnet_print(netdissect_options *,const u_char *, u_int); -extern int llc_print(netdissect_options *, - const u_char *, u_int, u_int, const u_char *, - const u_char *, u_short *); extern void aarp_print(netdissect_options *,const u_char *, u_int); extern void atalk_print(netdissect_options *,const u_char *, u_int); extern void atm_if_print(u_char *,const struct pcap_pkthdr *, const u_char *); diff --git a/print-802_11.c b/print-802_11.c index 11720546..d8404c7f 100644 --- a/print-802_11.c +++ b/print-802_11.c @@ -2392,7 +2392,7 @@ ieee802_11_print(const u_char *p, u_int length, u_int orig_caplen, int pad, printf("%s", tstr); return hdrlen; } - } else if (llc_print(p, length, caplen, dst, src, + } else if (llc_print(gndo, p, length, caplen, dst, src, &extracted_ethertype) == 0) { /* * Some kinds of LLC packet we cannot diff --git a/print-atm.c b/print-atm.c index dbd251ff..4fd1ca71 100644 --- a/print-atm.c +++ b/print-atm.c @@ -136,7 +136,7 @@ atm_llc_print(const u_char *p, int length, int caplen) { u_short extracted_ethertype; - if (!llc_print(p, length, caplen, NULL, NULL, + if (!llc_print(gndo, p, length, caplen, NULL, NULL, &extracted_ethertype)) { /* ether_type not known, print raw packet */ if (extracted_ethertype) { diff --git a/print-cip.c b/print-cip.c index 3f972b48..f8b48ec2 100644 --- a/print-cip.c +++ b/print-cip.c @@ -76,7 +76,7 @@ cip_if_print(netdissect_options *ndo, const struct pcap_pkthdr *h, const u_char /* * LLC header is present. Try to print it & higher layers. */ - if (llc_print(p, length, caplen, NULL, NULL, + if (llc_print(ndo, p, length, caplen, NULL, NULL, &extracted_ethertype) == 0) { /* ether_type not known, print raw packet */ if (!ndo->ndo_eflag) diff --git a/print-ether.c b/print-ether.c index c3f639fa..c1ebcae9 100644 --- a/print-ether.c +++ b/print-ether.c @@ -156,7 +156,7 @@ recurse: */ if (ether_type <= ETHERMTU) { /* Try to print the LLC-layer header & higher layers */ - if (llc_print(p, length, caplen, ESRC(ep), EDST(ep), + if (llc_print(ndo, p, length, caplen, ESRC(ep), EDST(ep), &extracted_ether_type) == 0) { /* ether_type not known, print raw packet */ if (!ndo->ndo_eflag) { @@ -207,7 +207,7 @@ recurse: * there's an LLC header and payload. */ /* Try to print the LLC-layer header & higher layers */ - if (llc_print(p, length, caplen, ESRC(ep), EDST(ep), + if (llc_print(ndo, p, length, caplen, ESRC(ep), EDST(ep), &extracted_ether_type) == 0) { /* ether_type not known, print raw packet */ if (!ndo->ndo_eflag) { diff --git a/print-fddi.c b/print-fddi.c index 2a47ad65..e79ab98f 100644 --- a/print-fddi.c +++ b/print-fddi.c @@ -306,7 +306,7 @@ fddi_print(netdissect_options *ndo, const u_char *p, u_int length, u_int caplen) /* Frame Control field determines interpretation of packet */ if ((fddip->fddi_fc & FDDIFC_CLFF) == FDDIFC_LLC_ASYNC) { /* Try to print the LLC-layer header & higher layers */ - if (llc_print(p, length, caplen, ESRC(&ehdr), EDST(&ehdr), + if (llc_print(ndo, p, length, caplen, ESRC(&ehdr), EDST(&ehdr), &extracted_ethertype) == 0) { /* * Some kinds of LLC packet we cannot diff --git a/print-fr.c b/print-fr.c index 7fdc42e0..0235ff81 100644 --- a/print-fr.c +++ b/print-fr.c @@ -290,7 +290,7 @@ fr_print(register const u_char *p, u_int length) break; case NLPID_SNAP: - if (snap_print(p, length, length, 0) == 0) { + if (snap_print(gndo, p, length, length, 0) == 0) { /* ether_type not known, print raw packet */ if (!eflag) fr_hdr_print(length + hdr_len, hdr_len, diff --git a/print-ipfc.c b/print-ipfc.c index 61dbbee3..7a7b6f93 100644 --- a/print-ipfc.c +++ b/print-ipfc.c @@ -102,7 +102,7 @@ ipfc_print(netdissect_options *ndo, const u_char *p, u_int length, u_int caplen) caplen -= IPFC_HDRLEN; /* Try to print the LLC-layer header & higher layers */ - if (llc_print(p, length, caplen, ESRC(&ehdr), EDST(&ehdr), + if (llc_print(ndo, p, length, caplen, ESRC(&ehdr), EDST(&ehdr), &extracted_ethertype) == 0) { /* * Some kinds of LLC packet we cannot diff --git a/print-juniper.c b/print-juniper.c index ce515d7d..8a697901 100644 --- a/print-juniper.c +++ b/print-juniper.c @@ -929,7 +929,7 @@ juniper_atm1_print(const struct pcap_pkthdr *h, register const u_char *p) if (EXTRACT_24BITS(p) == 0xfefe03 || /* NLPID encaps ? */ EXTRACT_24BITS(p) == 0xaaaa03) { /* SNAP encaps ? */ - if (llc_print(p, l2info.length, l2info.caplen, NULL, NULL, + if (llc_print(gndo, p, l2info.length, l2info.caplen, NULL, NULL, &extracted_ethertype) != 0) return l2info.header_len; } @@ -977,7 +977,7 @@ juniper_atm2_print(const struct pcap_pkthdr *h, register const u_char *p) if (EXTRACT_24BITS(p) == 0xfefe03 || /* NLPID encaps ? */ EXTRACT_24BITS(p) == 0xaaaa03) { /* SNAP encaps ? */ - if (llc_print(p, l2info.length, l2info.caplen, NULL, NULL, + if (llc_print(gndo, p, l2info.length, l2info.caplen, NULL, NULL, &extracted_ethertype) != 0) return l2info.header_len; } diff --git a/print-llc.c b/print-llc.c index 9a1f9dcf..590496a3 100644 --- a/print-llc.c +++ b/print-llc.c @@ -22,15 +22,13 @@ * with an awful lot of hacking by Jeffrey Mogul, DECWRL */ +#define NETDISSECT_REWORKED #ifdef HAVE_CONFIG_H #include "config.h" #endif #include -#include -#include - #include "interface.h" #include "addrtoname.h" #include "extract.h" /* must come after interface.h */ @@ -143,7 +141,7 @@ static const struct oui_tok oui_to_tok[] = { * Returns non-zero IFF it succeeds in printing the header */ int -llc_print(const u_char *p, u_int length, u_int caplen, +llc_print(netdissect_options *ndo, const u_char *p, u_int length, u_int caplen, const u_char *esrc, const u_char *edst, u_short *extracted_ethertype) { u_int8_t dsap_field, dsap, ssap_field, ssap; @@ -154,7 +152,7 @@ llc_print(const u_char *p, u_int length, u_int caplen, *extracted_ethertype = 0; if (caplen < 3) { - (void)printf("[|llc]"); + ND_PRINT((ndo, "[|llc]")); default_print((u_char *)p, caplen); return(0); } @@ -180,7 +178,7 @@ llc_print(const u_char *p, u_int length, u_int caplen, * 2 bytes... */ if (caplen < 4) { - (void)printf("[|llc]"); + ND_PRINT((ndo, "[|llc]")); default_print((u_char *)p, caplen); return(0); } @@ -208,29 +206,29 @@ llc_print(const u_char *p, u_int length, u_int caplen, * least one capture file.) */ - if (eflag) - printf("IPX 802.3: "); + if (ndo->ndo_eflag) + ND_PRINT((ndo, "IPX 802.3: ")); - ipx_print(gndo, p, length); + ipx_print(ndo, p, length); return (1); } dsap = dsap_field & ~LLC_IG; ssap = ssap_field & ~LLC_GSAP; - if (eflag) { - printf("LLC, dsap %s (0x%02x) %s, ssap %s (0x%02x) %s", + if (ndo->ndo_eflag) { + ND_PRINT((ndo, "LLC, dsap %s (0x%02x) %s, ssap %s (0x%02x) %s", tok2str(llc_values, "Unknown", dsap), dsap, tok2str(llc_ig_flag_values, "Unknown", dsap_field & LLC_IG), tok2str(llc_values, "Unknown", ssap), ssap, - tok2str(llc_flag_values, "Unknown", ssap_field & LLC_GSAP)); + tok2str(llc_flag_values, "Unknown", ssap_field & LLC_GSAP))); if (is_u) { - printf(", ctrl 0x%02x: ", control); + ND_PRINT((ndo, ", ctrl 0x%02x: ", control)); } else { - printf(", ctrl 0x%04x: ", control); + ND_PRINT((ndo, ", ctrl 0x%04x: ", control)); } } @@ -242,7 +240,7 @@ llc_print(const u_char *p, u_int length, u_int caplen, if (ssap == LLCSAP_IP && dsap == LLCSAP_IP && control == LLC_UI) { - ip_print(gndo, p+4, length-4); + ip_print(ndo, p+4, length-4); return (1); } @@ -255,10 +253,10 @@ llc_print(const u_char *p, u_int length, u_int caplen, * * Skip DSAP, LSAP, and control field. */ - if (eflag) - printf("IPX 802.2: "); + if (ndo->ndo_eflag) + ND_PRINT((ndo, "IPX 802.2: ")); - ipx_print(gndo, p+3, length-3); + ipx_print(ndo, p+3, length-3); return (1); } @@ -303,77 +301,77 @@ llc_print(const u_char *p, u_int length, u_int caplen, * Does anybody ever bridge one form of LAN traffic * over a networking type that uses 802.2 LLC? */ - ret = snap_print(p+3, length-3, caplen-3, 2); + ret = snap_print(ndo, p+3, length-3, caplen-3, 2); if (ret) return (ret); } - if (!eflag) { + if (!ndo->ndo_eflag) { if (ssap == dsap) { if (esrc == NULL || edst == NULL) - (void)printf("%s ", tok2str(llc_values, "Unknown DSAP 0x%02x", dsap)); + ND_PRINT((ndo, "%s ", tok2str(llc_values, "Unknown DSAP 0x%02x", dsap))); else - (void)printf("%s > %s %s ", + ND_PRINT((ndo, "%s > %s %s ", etheraddr_string(esrc), etheraddr_string(edst), - tok2str(llc_values, "Unknown DSAP 0x%02x", dsap)); + tok2str(llc_values, "Unknown DSAP 0x%02x", dsap))); } else { if (esrc == NULL || edst == NULL) - (void)printf("%s > %s ", + ND_PRINT((ndo, "%s > %s ", tok2str(llc_values, "Unknown SSAP 0x%02x", ssap), - tok2str(llc_values, "Unknown DSAP 0x%02x", dsap)); + tok2str(llc_values, "Unknown DSAP 0x%02x", dsap))); else - (void)printf("%s %s > %s %s ", + ND_PRINT((ndo, "%s %s > %s %s ", etheraddr_string(esrc), tok2str(llc_values, "Unknown SSAP 0x%02x", ssap), etheraddr_string(edst), - tok2str(llc_values, "Unknown DSAP 0x%02x", dsap)); + tok2str(llc_values, "Unknown DSAP 0x%02x", dsap))); } } if (is_u) { - printf("Unnumbered, %s, Flags [%s], length %u", + ND_PRINT((ndo, "Unnumbered, %s, Flags [%s], length %u", tok2str(llc_cmd_values, "%02x", LLC_U_CMD(control)), tok2str(llc_flag_values,"?",(ssap_field & LLC_GSAP) | (control & LLC_U_POLL)), - length); + length)); p += 3; if ((control & ~LLC_U_POLL) == LLC_XID) { if (*p == LLC_XID_FI) { - printf(": %02x %02x", p[1], p[2]); + ND_PRINT((ndo, ": %02x %02x", p[1], p[2])); } } } else { if ((control & LLC_S_FMT) == LLC_S_FMT) { - (void)printf("Supervisory, %s, rcv seq %u, Flags [%s], length %u", + ND_PRINT((ndo, "Supervisory, %s, rcv seq %u, Flags [%s], length %u", tok2str(llc_supervisory_values,"?",LLC_S_CMD(control)), LLC_IS_NR(control), tok2str(llc_flag_values,"?",(ssap_field & LLC_GSAP) | (control & LLC_IS_POLL)), - length); + length)); } else { - (void)printf("Information, send seq %u, rcv seq %u, Flags [%s], length %u", + ND_PRINT((ndo, "Information, send seq %u, rcv seq %u, Flags [%s], length %u", LLC_I_NS(control), LLC_IS_NR(control), tok2str(llc_flag_values,"?",(ssap_field & LLC_GSAP) | (control & LLC_IS_POLL)), - length); + length)); } } return(1); } int -snap_print(const u_char *p, u_int length, u_int caplen, u_int bridge_pad) +snap_print(netdissect_options *ndo, const u_char *p, u_int length, u_int caplen, u_int bridge_pad) { u_int32_t orgcode; register u_short et; register int ret; - TCHECK2(*p, 5); + ND_TCHECK2(*p, 5); orgcode = EXTRACT_24BITS(p); et = EXTRACT_16BITS(p + 3); - if (eflag) { + if (ndo->ndo_eflag) { const struct tok *tok = null_values; const struct oui_tok *otp; @@ -383,12 +381,12 @@ snap_print(const u_char *p, u_int length, u_int caplen, u_int bridge_pad) break; } } - (void)printf("oui %s (0x%06x), %s %s (0x%04x): ", + ND_PRINT((ndo, "oui %s (0x%06x), %s %s (0x%04x): ", tok2str(oui_values, "Unknown", orgcode), orgcode, (orgcode == 0x000000 ? "ethertype" : "pid"), tok2str(tok, "Unknown", et), - et); + et)); } p += 5; length -= 5; @@ -403,7 +401,7 @@ snap_print(const u_char *p, u_int length, u_int caplen, u_int bridge_pad) * Cisco hardware; the protocol ID is * an Ethernet protocol type. */ - ret = ethertype_print(gndo, et, p, length, caplen); + ret = ethertype_print(ndo, et, p, length, caplen); if (ret) return (ret); break; @@ -418,7 +416,7 @@ snap_print(const u_char *p, u_int length, u_int caplen, u_int bridge_pad) * but used 0x000000 and an Ethernet * packet type for AARP packets. */ - ret = ethertype_print(gndo, et, p, length, caplen); + ret = ethertype_print(ndo, et, p, length, caplen); if (ret) return (ret); } @@ -430,10 +428,10 @@ snap_print(const u_char *p, u_int length, u_int caplen, u_int bridge_pad) cdp_print(p, length, caplen); return (1); case PID_CISCO_DTP: - dtp_print(gndo, p, length); + dtp_print(ndo, p, length); return (1); case PID_CISCO_UDLD: - udld_print(gndo, p, length); + udld_print(ndo, p, length); return (1); case PID_CISCO_VTP: vtp_print(p, length); @@ -458,7 +456,7 @@ snap_print(const u_char *p, u_int length, u_int caplen, u_int bridge_pad) /* * Skip the padding. */ - TCHECK2(*p, bridge_pad); + ND_TCHECK2(*p, bridge_pad); caplen -= bridge_pad; length -= bridge_pad; p += bridge_pad; @@ -466,7 +464,7 @@ snap_print(const u_char *p, u_int length, u_int caplen, u_int bridge_pad) /* * What remains is an Ethernet packet. */ - ether_print(gndo, p, length, caplen, NULL, NULL); + ether_print(ndo, p, length, caplen, NULL, NULL); return (1); case PID_RFC2684_802_5_FCS: @@ -479,7 +477,7 @@ snap_print(const u_char *p, u_int length, u_int caplen, u_int bridge_pad) * Skip the padding, but not the Access * Control field. */ - TCHECK2(*p, bridge_pad); + ND_TCHECK2(*p, bridge_pad); caplen -= bridge_pad; length -= bridge_pad; p += bridge_pad; @@ -488,7 +486,7 @@ snap_print(const u_char *p, u_int length, u_int caplen, u_int bridge_pad) * What remains is an 802.5 Token Ring * packet. */ - token_print(gndo, p, length, caplen); + token_print(ndo, p, length, caplen); return (1); case PID_RFC2684_FDDI_FCS: @@ -500,7 +498,7 @@ snap_print(const u_char *p, u_int length, u_int caplen, u_int bridge_pad) /* * Skip the padding. */ - TCHECK2(*p, bridge_pad + 1); + ND_TCHECK2(*p, bridge_pad + 1); caplen -= bridge_pad + 1; length -= bridge_pad + 1; p += bridge_pad + 1; @@ -508,7 +506,7 @@ snap_print(const u_char *p, u_int length, u_int caplen, u_int bridge_pad) /* * What remains is an FDDI packet. */ - fddi_print(gndo, p, length, caplen); + fddi_print(ndo, p, length, caplen); return (1); case PID_RFC2684_BPDU: @@ -519,7 +517,7 @@ snap_print(const u_char *p, u_int length, u_int caplen, u_int bridge_pad) return (0); trunc: - (void)printf("[|snap]"); + ND_PRINT((ndo, "[|snap]")); return (1); } diff --git a/print-sll.c b/print-sll.c index 4144a4ba..6eda8195 100644 --- a/print-sll.c +++ b/print-sll.c @@ -247,7 +247,7 @@ recurse: * 802.2. * Try to print the LLC-layer header & higher layers. */ - if (llc_print(p, length, caplen, NULL, NULL, + if (llc_print(ndo, p, length, caplen, NULL, NULL, &extracted_ethertype) == 0) goto unknown; /* unknown LLC type */ break; diff --git a/print-token.c b/print-token.c index 8dd23b33..18a461b7 100644 --- a/print-token.c +++ b/print-token.c @@ -211,7 +211,7 @@ token_print(netdissect_options *ndo, const u_char *p, u_int length, u_int caplen /* Frame Control field determines interpretation of packet */ if (FRAME_TYPE(trp) == TOKEN_FC_LLC) { /* Try to print the LLC-layer header & higher layers */ - if (llc_print(p, length, caplen, ESRC(&ehdr), EDST(&ehdr), + if (llc_print(ndo, p, length, caplen, ESRC(&ehdr), EDST(&ehdr), &extracted_ethertype) == 0) { /* ether_type not known, print raw packet */ if (!ndo->ndo_eflag)