print-atalk.c revision 190207
1/* 2 * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997 3 * The Regents of the University of California. All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that: (1) source code distributions 7 * retain the above copyright notice and this paragraph in its entirety, (2) 8 * distributions including binary code include the above copyright notice and 9 * this paragraph in its entirety in the documentation or other materials 10 * provided with the distribution, and (3) all advertising materials mentioning 11 * features or use of this software display the following acknowledgement: 12 * ``This product includes software developed by the University of California, 13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of 14 * the University nor the names of its contributors may be used to endorse 15 * or promote products derived from this software without specific prior 16 * written permission. 17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED 18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF 19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 20 * 21 * Format and print AppleTalk packets. 22 * 23 * $FreeBSD: head/contrib/tcpdump/print-atalk.c 190207 2009-03-21 18:30:25Z rpaulo $ 24 */ 25 26#ifndef lint 27static const char rcsid[] _U_ = 28 "@(#) $Header: /tcpdump/master/tcpdump/print-atalk.c,v 1.81 2004-05-01 09:41:50 hannes Exp $ (LBL)"; 29#endif 30 31#ifdef HAVE_CONFIG_H 32#include "config.h" 33#endif 34 35#include <tcpdump-stdinc.h> 36 37#include <stdio.h> 38#include <stdlib.h> 39#include <string.h> 40#include <pcap.h> 41 42#include "interface.h" 43#include "addrtoname.h" 44#include "ethertype.h" 45#include "extract.h" /* must come after interface.h */ 46#include "appletalk.h" 47 48static struct tok type2str[] = { 49 { ddpRTMP, "rtmp" }, 50 { ddpRTMPrequest, "rtmpReq" }, 51 { ddpECHO, "echo" }, 52 { ddpIP, "IP" }, 53 { ddpARP, "ARP" }, 54 { ddpKLAP, "KLAP" }, 55 { 0, NULL } 56}; 57 58struct aarp { 59 u_int16_t htype, ptype; 60 u_int8_t halen, palen; 61 u_int16_t op; 62 u_int8_t hsaddr[6]; 63 u_int8_t psaddr[4]; 64 u_int8_t hdaddr[6]; 65 u_int8_t pdaddr[4]; 66}; 67 68static char tstr[] = "[|atalk]"; 69 70static void atp_print(const struct atATP *, u_int); 71static void atp_bitmap_print(u_char); 72static void nbp_print(const struct atNBP *, u_int, u_short, u_char, u_char); 73static const char *print_cstring(const char *, const u_char *); 74static const struct atNBPtuple *nbp_tuple_print(const struct atNBPtuple *, 75 const u_char *, 76 u_short, u_char, u_char); 77static const struct atNBPtuple *nbp_name_print(const struct atNBPtuple *, 78 const u_char *); 79static const char *ataddr_string(u_short, u_char); 80static void ddp_print(const u_char *, u_int, int, u_short, u_char, u_char); 81static const char *ddpskt_string(int); 82 83/* 84 * Print LLAP packets received on a physical LocalTalk interface. 85 */ 86u_int 87ltalk_if_print(const struct pcap_pkthdr *h, const u_char *p) 88{ 89 return (llap_print(p, h->caplen)); 90} 91 92/* 93 * Print AppleTalk LLAP packets. 94 */ 95u_int 96llap_print(register const u_char *bp, u_int length) 97{ 98 register const struct LAP *lp; 99 register const struct atDDP *dp; 100 register const struct atShortDDP *sdp; 101 u_short snet; 102 u_int hdrlen; 103 104#if 0 105 /* 106 * Our packet is on a 4-byte boundary, as we're either called 107 * directly from a top-level link-layer printer (ltalk_if_print) 108 * or from the UDP printer. The LLAP+DDP header is a multiple 109 * of 4 bytes in length, so the DDP payload is also on a 4-byte 110 * boundary, and we don't need to align it before calling 111 * "ddp_print()". 112 */ 113 lp = (const struct LAP *)bp; 114 bp += sizeof(*lp); 115 length -= sizeof(*lp); 116#else 117 { 118 static struct LAP lp_ = {0, 0, lapDDP}; 119 lp = &lp_; 120 } 121#endif 122 hdrlen = sizeof(*lp); 123 switch (lp->type) { 124 125 case lapShortDDP: 126 if (length < ddpSSize) { 127 (void)printf(" [|sddp %d]", length); 128 return (length); 129 } 130 sdp = (const struct atShortDDP *)bp; 131 printf("%s.%s", 132 ataddr_string(0, lp->src), ddpskt_string(sdp->srcSkt)); 133 printf(" > %s.%s:", 134 ataddr_string(0, lp->dst), ddpskt_string(sdp->dstSkt)); 135 bp += ddpSSize; 136 length -= ddpSSize; 137 hdrlen += ddpSSize; 138 ddp_print(bp, length, sdp->type, 0, lp->src, sdp->srcSkt); 139 break; 140 141 case lapDDP: 142 if (length < ddpSize) { 143 (void)printf(" [|ddp %d]", length); 144 return (length); 145 } 146 dp = (const struct atDDP *)bp; 147 snet = EXTRACT_16BITS(&dp->srcNet); 148 printf("%s.%s", ataddr_string(snet, dp->srcNode), 149 ddpskt_string(dp->srcSkt)); 150 printf(" > %s.%s:", 151 ataddr_string(EXTRACT_16BITS(&dp->dstNet), dp->dstNode), 152 ddpskt_string(dp->dstSkt)); 153 bp += ddpSize; 154 length -= ddpSize; 155 hdrlen += ddpSize; 156 ddp_print(bp, length, dp->type, snet, dp->srcNode, dp->srcSkt); 157 break; 158 159#ifdef notdef 160 case lapKLAP: 161 klap_print(bp, length); 162 break; 163#endif 164 165 default: 166 printf("%d > %d at-lap#%d %d", 167 lp->src, lp->dst, lp->type, length); 168 break; 169 } 170 return (hdrlen); 171} 172 173/* 174 * Print EtherTalk/TokenTalk packets (or FDDITalk, or whatever it's called 175 * when it runs over FDDI; yes, I've seen FDDI captures with AppleTalk 176 * packets in them). 177 */ 178void 179atalk_print(register const u_char *bp, u_int length) 180{ 181 register const struct atDDP *dp; 182 u_short snet; 183 184 if(!eflag) 185 printf("AT "); 186 187 if (length < ddpSize) { 188 (void)printf(" [|ddp %d]", length); 189 return; 190 } 191 dp = (const struct atDDP *)bp; 192 snet = EXTRACT_16BITS(&dp->srcNet); 193 printf("%s.%s", ataddr_string(snet, dp->srcNode), 194 ddpskt_string(dp->srcSkt)); 195 printf(" > %s.%s: ", 196 ataddr_string(EXTRACT_16BITS(&dp->dstNet), dp->dstNode), 197 ddpskt_string(dp->dstSkt)); 198 bp += ddpSize; 199 length -= ddpSize; 200 ddp_print(bp, length, dp->type, snet, dp->srcNode, dp->srcSkt); 201} 202 203/* XXX should probably pass in the snap header and do checks like arp_print() */ 204void 205aarp_print(register const u_char *bp, u_int length) 206{ 207 register const struct aarp *ap; 208 209#define AT(member) ataddr_string((ap->member[1]<<8)|ap->member[2],ap->member[3]) 210 211 printf("aarp "); 212 ap = (const struct aarp *)bp; 213 if (EXTRACT_16BITS(&ap->htype) == 1 && 214 EXTRACT_16BITS(&ap->ptype) == ETHERTYPE_ATALK && 215 ap->halen == 6 && ap->palen == 4 ) 216 switch (EXTRACT_16BITS(&ap->op)) { 217 218 case 1: /* request */ 219 (void)printf("who-has %s tell %s", 220 AT(pdaddr), AT(psaddr)); 221 return; 222 223 case 2: /* response */ 224 (void)printf("reply %s is-at %s", 225 AT(psaddr), etheraddr_string(ap->hsaddr)); 226 return; 227 228 case 3: /* probe (oy!) */ 229 (void)printf("probe %s tell %s", 230 AT(pdaddr), AT(psaddr)); 231 return; 232 } 233 (void)printf("len %u op %u htype %u ptype %#x halen %u palen %u", 234 length, EXTRACT_16BITS(&ap->op), EXTRACT_16BITS(&ap->htype), 235 EXTRACT_16BITS(&ap->ptype), ap->halen, ap->palen); 236} 237 238/* 239 * Print AppleTalk Datagram Delivery Protocol packets. 240 */ 241static void 242ddp_print(register const u_char *bp, register u_int length, register int t, 243 register u_short snet, register u_char snode, u_char skt) 244{ 245 246 switch (t) { 247 248 case ddpNBP: 249 nbp_print((const struct atNBP *)bp, length, snet, snode, skt); 250 break; 251 252 case ddpATP: 253 atp_print((const struct atATP *)bp, length); 254 break; 255 256 case ddpEIGRP: 257 eigrp_print(bp, length); 258 break; 259 260 default: 261 (void)printf(" at-%s %d", tok2str(type2str, NULL, t), length); 262 break; 263 } 264} 265 266static void 267atp_print(register const struct atATP *ap, u_int length) 268{ 269 char c; 270 u_int32_t data; 271 272 if ((const u_char *)(ap + 1) > snapend) { 273 /* Just bail if we don't have the whole chunk. */ 274 fputs(tstr, stdout); 275 return; 276 } 277 length -= sizeof(*ap); 278 switch (ap->control & 0xc0) { 279 280 case atpReqCode: 281 (void)printf(" atp-req%s %d", 282 ap->control & atpXO? " " : "*", 283 EXTRACT_16BITS(&ap->transID)); 284 285 atp_bitmap_print(ap->bitmap); 286 287 if (length != 0) 288 (void)printf(" [len=%d]", length); 289 290 switch (ap->control & (atpEOM|atpSTS)) { 291 case atpEOM: 292 (void)printf(" [EOM]"); 293 break; 294 case atpSTS: 295 (void)printf(" [STS]"); 296 break; 297 case atpEOM|atpSTS: 298 (void)printf(" [EOM,STS]"); 299 break; 300 } 301 break; 302 303 case atpRspCode: 304 (void)printf(" atp-resp%s%d:%d (%d)", 305 ap->control & atpEOM? "*" : " ", 306 EXTRACT_16BITS(&ap->transID), ap->bitmap, length); 307 switch (ap->control & (atpXO|atpSTS)) { 308 case atpXO: 309 (void)printf(" [XO]"); 310 break; 311 case atpSTS: 312 (void)printf(" [STS]"); 313 break; 314 case atpXO|atpSTS: 315 (void)printf(" [XO,STS]"); 316 break; 317 } 318 break; 319 320 case atpRelCode: 321 (void)printf(" atp-rel %d", EXTRACT_16BITS(&ap->transID)); 322 323 atp_bitmap_print(ap->bitmap); 324 325 /* length should be zero */ 326 if (length) 327 (void)printf(" [len=%d]", length); 328 329 /* there shouldn't be any control flags */ 330 if (ap->control & (atpXO|atpEOM|atpSTS)) { 331 c = '['; 332 if (ap->control & atpXO) { 333 (void)printf("%cXO", c); 334 c = ','; 335 } 336 if (ap->control & atpEOM) { 337 (void)printf("%cEOM", c); 338 c = ','; 339 } 340 if (ap->control & atpSTS) { 341 (void)printf("%cSTS", c); 342 c = ','; 343 } 344 (void)printf("]"); 345 } 346 break; 347 348 default: 349 (void)printf(" atp-0x%x %d (%d)", ap->control, 350 EXTRACT_16BITS(&ap->transID), length); 351 break; 352 } 353 data = EXTRACT_32BITS(&ap->userData); 354 if (data != 0) 355 (void)printf(" 0x%x", data); 356} 357 358static void 359atp_bitmap_print(register u_char bm) 360{ 361 register char c; 362 register int i; 363 364 /* 365 * The '& 0xff' below is needed for compilers that want to sign 366 * extend a u_char, which is the case with the Ultrix compiler. 367 * (gcc is smart enough to eliminate it, at least on the Sparc). 368 */ 369 if ((bm + 1) & (bm & 0xff)) { 370 c = '<'; 371 for (i = 0; bm; ++i) { 372 if (bm & 1) { 373 (void)printf("%c%d", c, i); 374 c = ','; 375 } 376 bm >>= 1; 377 } 378 (void)printf(">"); 379 } else { 380 for (i = 0; bm; ++i) 381 bm >>= 1; 382 if (i > 1) 383 (void)printf("<0-%d>", i - 1); 384 else 385 (void)printf("<0>"); 386 } 387} 388 389static void 390nbp_print(register const struct atNBP *np, u_int length, register u_short snet, 391 register u_char snode, register u_char skt) 392{ 393 register const struct atNBPtuple *tp = 394 (const struct atNBPtuple *)((u_char *)np + nbpHeaderSize); 395 int i; 396 const u_char *ep; 397 398 if (length < nbpHeaderSize) { 399 (void)printf(" truncated-nbp %d", length); 400 return; 401 } 402 403 length -= nbpHeaderSize; 404 if (length < 8) { 405 /* must be room for at least one tuple */ 406 (void)printf(" truncated-nbp %d", length + nbpHeaderSize); 407 return; 408 } 409 /* ep points to end of available data */ 410 ep = snapend; 411 if ((const u_char *)tp > ep) { 412 fputs(tstr, stdout); 413 return; 414 } 415 switch (i = np->control & 0xf0) { 416 417 case nbpBrRq: 418 case nbpLkUp: 419 (void)printf(i == nbpLkUp? " nbp-lkup %d:":" nbp-brRq %d:", 420 np->id); 421 if ((const u_char *)(tp + 1) > ep) { 422 fputs(tstr, stdout); 423 return; 424 } 425 (void)nbp_name_print(tp, ep); 426 /* 427 * look for anomalies: the spec says there can only 428 * be one tuple, the address must match the source 429 * address and the enumerator should be zero. 430 */ 431 if ((np->control & 0xf) != 1) 432 (void)printf(" [ntup=%d]", np->control & 0xf); 433 if (tp->enumerator) 434 (void)printf(" [enum=%d]", tp->enumerator); 435 if (EXTRACT_16BITS(&tp->net) != snet || 436 tp->node != snode || tp->skt != skt) 437 (void)printf(" [addr=%s.%d]", 438 ataddr_string(EXTRACT_16BITS(&tp->net), 439 tp->node), tp->skt); 440 break; 441 442 case nbpLkUpReply: 443 (void)printf(" nbp-reply %d:", np->id); 444 445 /* print each of the tuples in the reply */ 446 for (i = np->control & 0xf; --i >= 0 && tp; ) 447 tp = nbp_tuple_print(tp, ep, snet, snode, skt); 448 break; 449 450 default: 451 (void)printf(" nbp-0x%x %d (%d)", np->control, np->id, 452 length); 453 break; 454 } 455} 456 457/* print a counted string */ 458static const char * 459print_cstring(register const char *cp, register const u_char *ep) 460{ 461 register u_int length; 462 463 if (cp >= (const char *)ep) { 464 fputs(tstr, stdout); 465 return (0); 466 } 467 length = *cp++; 468 469 /* Spec says string can be at most 32 bytes long */ 470 if (length > 32) { 471 (void)printf("[len=%u]", length); 472 return (0); 473 } 474 while ((int)--length >= 0) { 475 if (cp >= (const char *)ep) { 476 fputs(tstr, stdout); 477 return (0); 478 } 479 putchar(*cp++); 480 } 481 return (cp); 482} 483 484static const struct atNBPtuple * 485nbp_tuple_print(register const struct atNBPtuple *tp, 486 register const u_char *ep, 487 register u_short snet, register u_char snode, 488 register u_char skt) 489{ 490 register const struct atNBPtuple *tpn; 491 492 if ((const u_char *)(tp + 1) > ep) { 493 fputs(tstr, stdout); 494 return 0; 495 } 496 tpn = nbp_name_print(tp, ep); 497 498 /* if the enumerator isn't 1, print it */ 499 if (tp->enumerator != 1) 500 (void)printf("(%d)", tp->enumerator); 501 502 /* if the socket doesn't match the src socket, print it */ 503 if (tp->skt != skt) 504 (void)printf(" %d", tp->skt); 505 506 /* if the address doesn't match the src address, it's an anomaly */ 507 if (EXTRACT_16BITS(&tp->net) != snet || tp->node != snode) 508 (void)printf(" [addr=%s]", 509 ataddr_string(EXTRACT_16BITS(&tp->net), tp->node)); 510 511 return (tpn); 512} 513 514static const struct atNBPtuple * 515nbp_name_print(const struct atNBPtuple *tp, register const u_char *ep) 516{ 517 register const char *cp = (const char *)tp + nbpTupleSize; 518 519 putchar(' '); 520 521 /* Object */ 522 putchar('"'); 523 if ((cp = print_cstring(cp, ep)) != NULL) { 524 /* Type */ 525 putchar(':'); 526 if ((cp = print_cstring(cp, ep)) != NULL) { 527 /* Zone */ 528 putchar('@'); 529 if ((cp = print_cstring(cp, ep)) != NULL) 530 putchar('"'); 531 } 532 } 533 return ((const struct atNBPtuple *)cp); 534} 535 536 537#define HASHNAMESIZE 4096 538 539struct hnamemem { 540 int addr; 541 char *name; 542 struct hnamemem *nxt; 543}; 544 545static struct hnamemem hnametable[HASHNAMESIZE]; 546 547static const char * 548ataddr_string(u_short atnet, u_char athost) 549{ 550 register struct hnamemem *tp, *tp2; 551 register int i = (atnet << 8) | athost; 552 char nambuf[MAXHOSTNAMELEN + 20]; 553 static int first = 1; 554 FILE *fp; 555 556 /* 557 * if this is the first call, see if there's an AppleTalk 558 * number to name map file. 559 */ 560 if (first && (first = 0, !nflag) 561 && (fp = fopen("/etc/atalk.names", "r"))) { 562 char line[256]; 563 int i1, i2, i3; 564 565 while (fgets(line, sizeof(line), fp)) { 566 if (line[0] == '\n' || line[0] == 0 || line[0] == '#') 567 continue; 568 if (sscanf(line, "%d.%d.%d %256s", &i1, &i2, &i3, 569 nambuf) == 4) 570 /* got a hostname. */ 571 i3 |= ((i1 << 8) | i2) << 8; 572 else if (sscanf(line, "%d.%d %256s", &i1, &i2, 573 nambuf) == 3) 574 /* got a net name */ 575 i3 = (((i1 << 8) | i2) << 8) | 255; 576 else 577 continue; 578 579 for (tp = &hnametable[i2 & (HASHNAMESIZE-1)]; 580 tp->nxt; tp = tp->nxt) 581 ; 582 tp->addr = i2; 583 tp->nxt = newhnamemem(); 584 tp->name = strdup(nambuf); 585 } 586 fclose(fp); 587 } 588 589 for (tp = &hnametable[i & (HASHNAMESIZE-1)]; tp->nxt; tp = tp->nxt) 590 if (tp->addr == i) 591 return (tp->name); 592 593 /* didn't have the node name -- see if we've got the net name */ 594 i |= 255; 595 for (tp2 = &hnametable[i & (HASHNAMESIZE-1)]; tp2->nxt; tp2 = tp2->nxt) 596 if (tp2->addr == i) { 597 tp->addr = (atnet << 8) | athost; 598 tp->nxt = newhnamemem(); 599 (void)snprintf(nambuf, sizeof(nambuf), "%s.%d", 600 tp2->name, athost); 601 tp->name = strdup(nambuf); 602 return (tp->name); 603 } 604 605 tp->addr = (atnet << 8) | athost; 606 tp->nxt = newhnamemem(); 607 if (athost != 255) 608 (void)snprintf(nambuf, sizeof(nambuf), "%d.%d.%d", 609 atnet >> 8, atnet & 0xff, athost); 610 else 611 (void)snprintf(nambuf, sizeof(nambuf), "%d.%d", atnet >> 8, 612 atnet & 0xff); 613 tp->name = strdup(nambuf); 614 615 return (tp->name); 616} 617 618static struct tok skt2str[] = { 619 { rtmpSkt, "rtmp" }, /* routing table maintenance */ 620 { nbpSkt, "nis" }, /* name info socket */ 621 { echoSkt, "echo" }, /* AppleTalk echo protocol */ 622 { zipSkt, "zip" }, /* zone info protocol */ 623 { 0, NULL } 624}; 625 626static const char * 627ddpskt_string(register int skt) 628{ 629 static char buf[8]; 630 631 if (nflag) { 632 (void)snprintf(buf, sizeof(buf), "%d", skt); 633 return (buf); 634 } 635 return (tok2str(skt2str, "%d", skt)); 636} 637