1/* 2 * Copyright (c) 1992, 1993, 1994, 1995, 1996, 1997 3 * The Regents of the University of California. All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that: (1) source code distributions 7 * retain the above copyright notice and this paragraph in its entirety, (2) 8 * distributions including binary code include the above copyright notice and 9 * this paragraph in its entirety in the documentation or other materials 10 * provided with the distribution, and (3) all advertising materials mentioning 11 * features or use of this software display the following acknowledgement: 12 * ``This product includes software developed by the University of California, 13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of 14 * the University nor the names of its contributors may be used to endorse 15 * or promote products derived from this software without specific prior 16 * written permission. 17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED 18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF 19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 20 * 21 * Code by Gert Doering, SpaceNet GmbH, gert@space.net 22 * 23 * Reference documentation: 24 * https://web.archive.org/web/20000914194913/http://www.cisco.com/univercd/cc/td/doc/product/lan/trsrb/frames.pdf 25 */ 26 27/* \summary: Cisco Discovery Protocol (CDP) printer */ 28 29#ifdef HAVE_CONFIG_H 30#include <config.h> 31#endif 32 33#include "netdissect-stdinc.h" 34 35#include <string.h> 36 37#define ND_LONGJMP_FROM_TCHECK 38#include "netdissect.h" 39#include "addrtoname.h" 40#include "extract.h" 41#include "nlpid.h" 42 43 44#define CDP_HEADER_LEN 4 45#define CDP_HEADER_VERSION_OFFSET 0 46#define CDP_HEADER_TTL_OFFSET 1 47#define CDP_HEADER_CHECKSUM_OFFSET 2 48 49#define CDP_TLV_HEADER_LEN 4 50#define CDP_TLV_TYPE_OFFSET 0 51#define CDP_TLV_LEN_OFFSET 2 52 53static const struct tok cdp_capability_values[] = { 54 { 0x01, "Router" }, 55 { 0x02, "Transparent Bridge" }, 56 { 0x04, "Source Route Bridge" }, 57 { 0x08, "L2 Switch" }, 58 { 0x10, "L3 capable" }, 59 { 0x20, "IGMP snooping" }, 60 { 0x40, "L1 capable" }, 61 { 0, NULL } 62}; 63 64static void cdp_print_addr(netdissect_options *, const u_char *, u_int); 65static void cdp_print_prefixes(netdissect_options *, const u_char *, u_int); 66 67static void 68cdp_print_string(netdissect_options *ndo, 69 const u_char *cp, const u_int len) 70{ 71 ND_PRINT("'"); 72 (void)nd_printn(ndo, cp, len, NULL); 73 ND_PRINT("'"); 74} 75 76static void 77cdp_print_power(netdissect_options *ndo, 78 const u_char *cp, const u_int len) 79{ 80 u_int val = 0; 81 82 switch (len) { 83 case 1: 84 val = GET_U_1(cp); 85 break; 86 case 2: 87 val = GET_BE_U_2(cp); 88 break; 89 case 3: 90 val = GET_BE_U_3(cp); 91 break; 92 } 93 ND_PRINT("%1.2fW", val / 1000.0); 94} 95 96static void 97cdp_print_capability(netdissect_options *ndo, 98 const u_char *cp, const u_int len _U_) 99{ 100 uint32_t val = GET_BE_U_4(cp); 101 102 ND_PRINT("(0x%08x): %s", val, 103 bittok2str(cdp_capability_values, "none", val)); 104} 105 106/* Rework the version string to get a nice indentation. */ 107static void 108cdp_print_version(netdissect_options *ndo, 109 const u_char *cp, const u_int len) 110{ 111 unsigned i; 112 113 ND_PRINT("\n\t "); 114 for (i = 0; i < len; i++) { 115 u_char c = GET_U_1(cp + i); 116 117 if (c == '\n') 118 ND_PRINT("\n\t "); 119 else 120 fn_print_char(ndo, c); 121 } 122} 123 124static void 125cdp_print_uint16(netdissect_options *ndo, 126 const u_char *cp, const u_int len _U_) 127{ 128 ND_PRINT("%u", GET_BE_U_2(cp)); 129} 130 131static void 132cdp_print_duplex(netdissect_options *ndo, 133 const u_char *cp, const u_int len _U_) 134{ 135 ND_PRINT("%s", GET_U_1(cp) ? "full": "half"); 136} 137 138/* https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cata/186/2_12_m/english/release/notes/186rn21m.html 139* plus more details from other sources 140* 141* There are apparently versions of the request with both 142* 2 bytes and 3 bytes of value. The 3 bytes of value 143* appear to be a 1-byte application type followed by a 144* 2-byte VLAN ID; the 2 bytes of value are unknown 145* (they're 0x20 0x00 in some captures I've seen; that 146* is not a valid VLAN ID, as VLAN IDs are 12 bits). 147* 148* The replies all appear to be 3 bytes long. 149*/ 150static void 151cdp_print_ata186(netdissect_options *ndo, 152 const u_char *cp, const u_int len) 153{ 154 if (len == 2) 155 ND_PRINT("unknown 0x%04x", GET_BE_U_2(cp)); 156 else 157 ND_PRINT("app %u, vlan %u", GET_U_1(cp), GET_BE_U_2(cp + 1)); 158} 159 160static void 161cdp_print_mtu(netdissect_options *ndo, 162 const u_char *cp, const u_int len _U_) 163{ 164 ND_PRINT("%u bytes", GET_BE_U_4(cp)); 165} 166 167static void 168cdp_print_uint8x(netdissect_options *ndo, 169 const u_char *cp, const u_int len _U_) 170{ 171 ND_PRINT("0x%02x", GET_U_1(cp)); 172} 173 174static void 175cdp_print_phys_loc(netdissect_options *ndo, 176 const u_char *cp, const u_int len) 177{ 178 ND_PRINT("0x%02x", GET_U_1(cp)); 179 if (len > 1) { 180 ND_PRINT("/"); 181 (void)nd_printn(ndo, cp + 1, len - 1, NULL); 182 } 183} 184 185struct cdp_tlvinfo { 186 const char *name; 187 void (*printer)(netdissect_options *ndo, const u_char *, u_int); 188 int min_len, max_len; 189}; 190 191#define T_DEV_ID 0x01 192#define T_MAX 0x17 193static const struct cdp_tlvinfo cdptlvs[T_MAX + 1] = { 194 /* 0x00 */ 195 [ T_DEV_ID ] = { "Device-ID", cdp_print_string, -1, -1 }, 196 [ 0x02 ] = { "Address", cdp_print_addr, -1, -1 }, 197 [ 0x03 ] = { "Port-ID", cdp_print_string, -1, -1 }, 198 [ 0x04 ] = { "Capability", cdp_print_capability, 4, 4 }, 199 [ 0x05 ] = { "Version String", cdp_print_version, -1, -1 }, 200 [ 0x06 ] = { "Platform", cdp_print_string, -1, -1 }, 201 [ 0x07 ] = { "Prefixes", cdp_print_prefixes, -1, -1 }, 202 /* not documented */ 203 [ 0x08 ] = { "Protocol-Hello option", NULL, -1, -1 }, 204 /* CDPv2 */ 205 [ 0x09 ] = { "VTP Management Domain", cdp_print_string, -1, -1 }, 206 /* CDPv2 */ 207 [ 0x0a ] = { "Native VLAN ID", cdp_print_uint16, 2, 2 }, 208 /* CDPv2 */ 209 [ 0x0b ] = { "Duplex", cdp_print_duplex, 1, 1 }, 210 /* 0x0c */ 211 /* 0x0d */ 212 /* incomplete doc. */ 213 [ 0x0e ] = { "ATA-186 VoIP VLAN assignment", cdp_print_ata186, 3, 3 }, 214 /* incomplete doc. */ 215 [ 0x0f ] = { "ATA-186 VoIP VLAN request", cdp_print_ata186, 2, 3 }, 216 /* not documented */ 217 [ 0x10 ] = { "power consumption", cdp_print_power, 1, 3 }, 218 /* not documented */ 219 [ 0x11 ] = { "MTU", cdp_print_mtu, 4, 4 }, 220 /* not documented */ 221 [ 0x12 ] = { "AVVID trust bitmap", cdp_print_uint8x, 1, 1 }, 222 /* not documented */ 223 [ 0x13 ] = { "AVVID untrusted ports CoS", cdp_print_uint8x, 1, 1 }, 224 /* not documented */ 225 [ 0x14 ] = { "System Name", cdp_print_string, -1, -1 }, 226 /* not documented */ 227 [ 0x15 ] = { "System Object ID (not decoded)", NULL, -1, -1 }, 228 [ 0x16 ] = { "Management Addresses", cdp_print_addr, 4, -1 }, 229 /* not documented */ 230 [ 0x17 ] = { "Physical Location", cdp_print_phys_loc, 1, -1 }, 231}; 232 233void 234cdp_print(netdissect_options *ndo, 235 const u_char *tptr, u_int length) 236{ 237 u_int orig_length = length; 238 uint16_t checksum; 239 240 ndo->ndo_protocol = "cdp"; 241 242 if (length < CDP_HEADER_LEN) { 243 ND_PRINT(" (packet length %u < %u)", length, CDP_HEADER_LEN); 244 goto invalid; 245 } 246 ND_PRINT("CDPv%u, ttl: %us", 247 GET_U_1(tptr + CDP_HEADER_VERSION_OFFSET), 248 GET_U_1(tptr + CDP_HEADER_TTL_OFFSET)); 249 checksum = GET_BE_U_2(tptr + CDP_HEADER_CHECKSUM_OFFSET); 250 if (ndo->ndo_vflag) 251 ND_PRINT(", checksum: 0x%04x (unverified), length %u", 252 checksum, orig_length); 253 tptr += CDP_HEADER_LEN; 254 length -= CDP_HEADER_LEN; 255 256 while (length) { 257 u_int type, len; 258 const struct cdp_tlvinfo *info; 259 const char *name; 260 u_char covered = 0; 261 262 if (length < CDP_TLV_HEADER_LEN) { 263 ND_PRINT(" (remaining packet length %u < %u)", 264 length, CDP_TLV_HEADER_LEN); 265 goto invalid; 266 } 267 type = GET_BE_U_2(tptr + CDP_TLV_TYPE_OFFSET); 268 len = GET_BE_U_2(tptr + CDP_TLV_LEN_OFFSET); /* object length includes the 4 bytes header length */ 269 info = type <= T_MAX ? &cdptlvs[type] : NULL; 270 name = (info && info->name) ? info->name : "unknown field type"; 271 if (len < CDP_TLV_HEADER_LEN) { 272 if (ndo->ndo_vflag) 273 ND_PRINT("\n\t%s (0x%02x), TLV length: %u byte%s (too short)", 274 name, type, len, PLURAL_SUFFIX(len)); 275 else 276 ND_PRINT(", %s TLV length %u too short", 277 name, len); 278 goto invalid; 279 } 280 if (len > length) { 281 ND_PRINT(" (TLV length %u > %u)", len, length); 282 goto invalid; 283 } 284 tptr += CDP_TLV_HEADER_LEN; 285 length -= CDP_TLV_HEADER_LEN; 286 len -= CDP_TLV_HEADER_LEN; 287 288 /* In non-verbose mode just print Device-ID. */ 289 if (!ndo->ndo_vflag && type == T_DEV_ID) 290 ND_PRINT(", Device-ID "); 291 else if (ndo->ndo_vflag) 292 ND_PRINT("\n\t%s (0x%02x), value length: %u byte%s: ", 293 name, type, len, PLURAL_SUFFIX(len)); 294 295 if (info) { 296 if ((info->min_len > 0 && len < (unsigned)info->min_len) || 297 (info->max_len > 0 && len > (unsigned)info->max_len)) 298 ND_PRINT(" (malformed TLV)"); 299 else if (ndo->ndo_vflag || type == T_DEV_ID) { 300 if (info->printer) 301 info->printer(ndo, tptr, len); 302 else 303 ND_TCHECK_LEN(tptr, len); 304 /* 305 * When the type is defined without a printer, 306 * do not print the hex dump. 307 */ 308 covered = 1; 309 } 310 } 311 312 if (!covered) { 313 ND_TCHECK_LEN(tptr, len); 314 print_unknown_data(ndo, tptr, "\n\t ", len); 315 } 316 tptr += len; 317 length -= len; 318 } 319 if (ndo->ndo_vflag < 1) 320 ND_PRINT(", length %u", orig_length); 321 322 return; 323invalid: 324 nd_print_invalid(ndo); 325 ND_TCHECK_LEN(tptr, length); 326} 327 328/* 329 * Protocol type values. 330 * 331 * PT_NLPID means that the protocol type field contains an OSI NLPID. 332 * 333 * PT_IEEE_802_2 means that the protocol type field contains an IEEE 802.2 334 * LLC header that specifies that the payload is for that protocol. 335 */ 336#define PT_NLPID 1 /* OSI NLPID */ 337#define PT_IEEE_802_2 2 /* IEEE 802.2 LLC header */ 338 339static void 340cdp_print_addr(netdissect_options *ndo, 341 const u_char * p, u_int l) 342{ 343 u_int num; 344 static const u_char prot_ipv6[] = { 345 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00, 0x86, 0xdd 346 }; 347 348 if (l < 4) { 349 ND_PRINT(" (not enough space for num)"); 350 goto invalid; 351 } 352 num = GET_BE_U_4(p); 353 p += 4; 354 l -= 4; 355 356 while (num) { 357 u_int pt, pl, al; 358 359 if (l < 2) { 360 ND_PRINT(" (not enough space for PT+PL)"); 361 goto invalid; 362 } 363 pt = GET_U_1(p); /* type of "protocol" field */ 364 pl = GET_U_1(p + 1); /* length of "protocol" field */ 365 p += 2; 366 l -= 2; 367 368 if (l < pl + 2) { 369 ND_PRINT(" (not enough space for P+AL)"); 370 goto invalid; 371 } 372 /* Skip the protocol for now. */ 373 al = GET_BE_U_2(p + pl); /* address length */ 374 375 if (pt == PT_NLPID && pl == 1 && GET_U_1(p) == NLPID_IP && 376 al == 4) { 377 /* 378 * IPv4: protocol type = NLPID, protocol length = 1 379 * (1-byte NLPID), protocol = 0xcc (NLPID for IPv4), 380 * address length = 4 381 */ 382 p += pl + 2; 383 l -= pl + 2; 384 /* p is just beyond al now. */ 385 if (l < al) { 386 ND_PRINT(" (not enough space for A)"); 387 goto invalid; 388 } 389 ND_PRINT("IPv4 (%u) %s", num, GET_IPADDR_STRING(p)); 390 p += al; 391 l -= al; 392 } 393 else if (pt == PT_IEEE_802_2 && pl == 8 && 394 memcmp(p, prot_ipv6, 8) == 0 && al == 16) { 395 /* 396 * IPv6: protocol type = IEEE 802.2 header, 397 * protocol length = 8 (size of LLC+SNAP header), 398 * protocol = LLC+SNAP header with the IPv6 399 * Ethertype, address length = 16 400 */ 401 p += pl + 2; 402 l -= pl + 2; 403 /* p is just beyond al now. */ 404 if (l < al) { 405 ND_PRINT(" (not enough space for A)"); 406 goto invalid; 407 } 408 ND_PRINT("IPv6 (%u) %s", num, GET_IP6ADDR_STRING(p)); 409 p += al; 410 l -= al; 411 } 412 else { 413 /* 414 * Generic case: just print raw data 415 */ 416 ND_PRINT("pt=0x%02x, pl=%u, pb=", pt, pl); 417 while (pl != 0) { 418 ND_PRINT(" %02x", GET_U_1(p)); 419 p++; 420 l--; 421 pl--; 422 } 423 ND_PRINT(", al=%u, a=", al); 424 p += 2; 425 l -= 2; 426 /* p is just beyond al now. */ 427 if (l < al) { 428 ND_PRINT(" (not enough space for A)"); 429 goto invalid; 430 } 431 while (al != 0) { 432 ND_PRINT(" %02x", GET_U_1(p)); 433 p++; 434 l--; 435 al--; 436 } 437 } 438 num--; 439 if (num) 440 ND_PRINT(" "); 441 } 442 if (l) 443 ND_PRINT(" (%u bytes of stray data)", l); 444 return; 445 446invalid: 447 ND_TCHECK_LEN(p, l); 448} 449 450static void 451cdp_print_prefixes(netdissect_options *ndo, 452 const u_char * p, u_int l) 453{ 454 if (l % 5) { 455 ND_PRINT(" [length %u is not a multiple of 5]", l); 456 goto invalid; 457 } 458 459 ND_PRINT(" IPv4 Prefixes (%u):", l / 5); 460 461 while (l > 0) { 462 ND_PRINT(" %u.%u.%u.%u/%u", 463 GET_U_1(p), GET_U_1(p + 1), GET_U_1(p + 2), 464 GET_U_1(p + 3), GET_U_1(p + 4)); 465 l -= 5; 466 p += 5; 467 } 468 return; 469 470invalid: 471 ND_TCHECK_LEN(p, l); 472} 473