1/* 2 * Copyright (c) 1992, 1993, 1994, 1995, 1996, 1997 3 * The Regents of the University of California. All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that: (1) source code distributions 7 * retain the above copyright notice and this paragraph in its entirety, (2) 8 * distributions including binary code include the above copyright notice and 9 * this paragraph in its entirety in the documentation or other materials 10 * provided with the distribution, and (3) all advertising materials mentioning 11 * features or use of this software display the following acknowledgement: 12 * ``This product includes software developed by the University of California, 13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of 14 * the University nor the names of its contributors may be used to endorse 15 * or promote products derived from this software without specific prior 16 * written permission. 17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED 18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF 19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 20 * 21 * Code by Matt Thomas, Digital Equipment Corporation 22 * with an awful lot of hacking by Jeffrey Mogul, DECWRL 23 */ 24 25/* \summary: IEEE 802.2 LLC printer */ 26 27#ifdef HAVE_CONFIG_H 28#include <config.h> 29#endif 30 31#include "netdissect-stdinc.h" 32 33#include "netdissect.h" 34#include "addrtoname.h" 35#include "extract.h" 36 37#include "llc.h" 38#include "ethertype.h" 39#include "oui.h" 40 41static const struct tok llc_values[] = { 42 { LLCSAP_NULL, "Null" }, 43 { LLCSAP_GLOBAL, "Global" }, 44 { LLCSAP_8021B_I, "802.1B I" }, 45 { LLCSAP_8021B_G, "802.1B G" }, 46 { LLCSAP_IP, "IP" }, 47 { LLCSAP_SNA, "SNA" }, 48 { LLCSAP_PROWAYNM, "ProWay NM" }, 49 { LLCSAP_8021D, "STP" }, 50 { LLCSAP_RS511, "RS511" }, 51 { LLCSAP_ISO8208, "ISO8208" }, 52 { LLCSAP_PROWAY, "ProWay" }, 53 { LLCSAP_SNAP, "SNAP" }, 54 { LLCSAP_IPX, "IPX" }, 55 { LLCSAP_NETBEUI, "NetBeui" }, 56 { LLCSAP_ISONS, "OSI" }, 57 { 0, NULL }, 58}; 59 60static const struct tok llc_cmd_values[] = { 61 { LLC_UI, "ui" }, 62 { LLC_TEST, "test" }, 63 { LLC_XID, "xid" }, 64 { LLC_UA, "ua" }, 65 { LLC_DISC, "disc" }, 66 { LLC_DM, "dm" }, 67 { LLC_SABME, "sabme" }, 68 { LLC_FRMR, "frmr" }, 69 { 0, NULL } 70}; 71 72static const struct tok llc_flag_values[] = { 73 { 0, "Command" }, 74 { LLC_GSAP, "Response" }, 75 { LLC_U_POLL, "Poll" }, 76 { LLC_GSAP|LLC_U_POLL, "Final" }, 77 { LLC_IS_POLL, "Poll" }, 78 { LLC_GSAP|LLC_IS_POLL, "Final" }, 79 { 0, NULL } 80}; 81 82 83static const struct tok llc_ig_flag_values[] = { 84 { 0, "Individual" }, 85 { LLC_IG, "Group" }, 86 { 0, NULL } 87}; 88 89 90static const struct tok llc_supervisory_values[] = { 91 { 0, "Receiver Ready" }, 92 { 1, "Receiver not Ready" }, 93 { 2, "Reject" }, 94 { 0, NULL } 95}; 96 97 98static const struct tok cisco_values[] = { 99 { PID_CISCO_CDP, "CDP" }, 100 { PID_CISCO_VTP, "VTP" }, 101 { PID_CISCO_DTP, "DTP" }, 102 { PID_CISCO_UDLD, "UDLD" }, 103 { PID_CISCO_PVST, "PVST" }, 104 { PID_CISCO_VLANBRIDGE, "VLAN Bridge" }, 105 { 0, NULL } 106}; 107 108static const struct tok bridged_values[] = { 109 { PID_RFC2684_ETH_FCS, "Ethernet + FCS" }, 110 { PID_RFC2684_ETH_NOFCS, "Ethernet w/o FCS" }, 111 { PID_RFC2684_802_4_FCS, "802.4 + FCS" }, 112 { PID_RFC2684_802_4_NOFCS, "802.4 w/o FCS" }, 113 { PID_RFC2684_802_5_FCS, "Token Ring + FCS" }, 114 { PID_RFC2684_802_5_NOFCS, "Token Ring w/o FCS" }, 115 { PID_RFC2684_FDDI_FCS, "FDDI + FCS" }, 116 { PID_RFC2684_FDDI_NOFCS, "FDDI w/o FCS" }, 117 { PID_RFC2684_802_6_FCS, "802.6 + FCS" }, 118 { PID_RFC2684_802_6_NOFCS, "802.6 w/o FCS" }, 119 { PID_RFC2684_BPDU, "BPDU" }, 120 { 0, NULL }, 121}; 122 123static const struct tok null_values[] = { 124 { 0, NULL } 125}; 126 127struct oui_tok { 128 uint32_t oui; 129 const struct tok *tok; 130}; 131 132static const struct oui_tok oui_to_tok[] = { 133 { OUI_ENCAP_ETHER, ethertype_values }, 134 { OUI_CISCO_90, ethertype_values }, /* uses some Ethertype values */ 135 { OUI_APPLETALK, ethertype_values }, /* uses some Ethertype values */ 136 { OUI_CISCO, cisco_values }, 137 { OUI_RFC2684, bridged_values }, /* bridged, RFC 2427 FR or RFC 2864 ATM */ 138 { 0, NULL } 139}; 140 141/* 142 * If we printed information about the payload, returns the length of the LLC 143 * header, plus the length of any SNAP header following it. 144 * 145 * Otherwise (for example, if the packet has unknown SAPs or has a SNAP 146 * header with an unknown OUI/PID combination), returns the *negative* 147 * of that value. 148 */ 149int 150llc_print(netdissect_options *ndo, const u_char *p, u_int length, u_int caplen, 151 const struct lladdr_info *src, const struct lladdr_info *dst) 152{ 153 uint8_t dsap_field, dsap, ssap_field, ssap; 154 uint16_t control; 155 int hdrlen; 156 int is_u; 157 158 ndo->ndo_protocol = "llc"; 159 if (caplen < 3) { 160 nd_print_trunc(ndo); 161 ND_DEFAULTPRINT((const u_char *)p, caplen); 162 return (caplen); 163 } 164 if (length < 3) { 165 nd_print_trunc(ndo); 166 ND_DEFAULTPRINT((const u_char *)p, caplen); 167 return (length); 168 } 169 170 dsap_field = GET_U_1(p); 171 ssap_field = GET_U_1(p + 1); 172 173 /* 174 * OK, what type of LLC frame is this? The length 175 * of the control field depends on that - I frames 176 * have a two-byte control field, and U frames have 177 * a one-byte control field. 178 */ 179 control = GET_U_1(p + 2); 180 if ((control & LLC_U_FMT) == LLC_U_FMT) { 181 /* 182 * U frame. 183 */ 184 is_u = 1; 185 hdrlen = 3; /* DSAP, SSAP, 1-byte control field */ 186 } else { 187 /* 188 * The control field in I and S frames is 189 * 2 bytes... 190 */ 191 if (caplen < 4) { 192 nd_print_trunc(ndo); 193 ND_DEFAULTPRINT((const u_char *)p, caplen); 194 return (caplen); 195 } 196 if (length < 4) { 197 nd_print_trunc(ndo); 198 ND_DEFAULTPRINT((const u_char *)p, caplen); 199 return (length); 200 } 201 202 /* 203 * ...and is little-endian. 204 */ 205 control = GET_LE_U_2(p + 2); 206 is_u = 0; 207 hdrlen = 4; /* DSAP, SSAP, 2-byte control field */ 208 } 209 210 if (ssap_field == LLCSAP_GLOBAL && dsap_field == LLCSAP_GLOBAL) { 211 /* 212 * This is an Ethernet_802.3 IPX frame; it has an 213 * 802.3 header (i.e., an Ethernet header where the 214 * type/length field is <= MAX_ETHERNET_LENGTH_VAL, 215 * i.e. it's a length field, not a type field), but 216 * has no 802.2 header - the IPX packet starts right 217 * after the Ethernet header, with a signature of two 218 * bytes of 0xFF (which is LLCSAP_GLOBAL). 219 * 220 * (It might also have been an Ethernet_802.3 IPX at 221 * one time, but got bridged onto another network, 222 * such as an 802.11 network; this has appeared in at 223 * least one capture file.) 224 */ 225 226 if (ndo->ndo_eflag) 227 ND_PRINT("IPX 802.3: "); 228 229 ipx_print(ndo, p, length); 230 return (0); /* no LLC header */ 231 } 232 233 dsap = dsap_field & ~LLC_IG; 234 ssap = ssap_field & ~LLC_GSAP; 235 236 if (ndo->ndo_eflag) { 237 ND_PRINT("LLC, dsap %s (0x%02x) %s, ssap %s (0x%02x) %s", 238 tok2str(llc_values, "Unknown", dsap), 239 dsap, 240 tok2str(llc_ig_flag_values, "Unknown", dsap_field & LLC_IG), 241 tok2str(llc_values, "Unknown", ssap), 242 ssap, 243 tok2str(llc_flag_values, "Unknown", ssap_field & LLC_GSAP)); 244 245 if (is_u) { 246 ND_PRINT(", ctrl 0x%02x: ", control); 247 } else { 248 ND_PRINT(", ctrl 0x%04x: ", control); 249 } 250 } 251 252 /* 253 * Skip LLC header. 254 */ 255 p += hdrlen; 256 length -= hdrlen; 257 caplen -= hdrlen; 258 259 if (ssap == LLCSAP_SNAP && dsap == LLCSAP_SNAP 260 && control == LLC_UI) { 261 /* 262 * XXX - what *is* the right bridge pad value here? 263 * Does anybody ever bridge one form of LAN traffic 264 * over a networking type that uses 802.2 LLC? 265 */ 266 if (!snap_print(ndo, p, length, caplen, src, dst, 2)) { 267 /* 268 * Unknown packet type; tell our caller, by 269 * returning a negative value, so they 270 * can print the raw packet. 271 */ 272 return (-(hdrlen + 5)); /* include LLC and SNAP header */ 273 } else 274 return (hdrlen + 5); /* include LLC and SNAP header */ 275 } 276 277 if (ssap == LLCSAP_8021D && dsap == LLCSAP_8021D && 278 control == LLC_UI) { 279 stp_print(ndo, p, length); 280 return (hdrlen); 281 } 282 283 if (ssap == LLCSAP_IP && dsap == LLCSAP_IP && 284 control == LLC_UI) { 285 /* 286 * This is an RFC 948-style IP packet, with 287 * an 802.3 header and an 802.2 LLC header 288 * with the source and destination SAPs being 289 * the IP SAP. 290 */ 291 ip_print(ndo, p, length); 292 return (hdrlen); 293 } 294 295 if (ssap == LLCSAP_IPX && dsap == LLCSAP_IPX && 296 control == LLC_UI) { 297 /* 298 * This is an Ethernet_802.2 IPX frame, with an 802.3 299 * header and an 802.2 LLC header with the source and 300 * destination SAPs being the IPX SAP. 301 */ 302 if (ndo->ndo_eflag) 303 ND_PRINT("IPX 802.2: "); 304 305 ipx_print(ndo, p, length); 306 return (hdrlen); 307 } 308 309#ifdef ENABLE_SMB 310 if (ssap == LLCSAP_NETBEUI && dsap == LLCSAP_NETBEUI 311 && (!(control & LLC_S_FMT) || control == LLC_U_FMT)) { 312 /* 313 * we don't actually have a full netbeui parser yet, but the 314 * smb parser can handle many smb-in-netbeui packets, which 315 * is very useful, so we call that 316 * 317 * We don't call it for S frames, however, just I frames 318 * (which are frames that don't have the low-order bit, 319 * LLC_S_FMT, set in the first byte of the control field) 320 * and UI frames (whose control field is just 3, LLC_U_FMT). 321 */ 322 netbeui_print(ndo, control, p, length); 323 return (hdrlen); 324 } 325#endif 326 if (ssap == LLCSAP_ISONS && dsap == LLCSAP_ISONS 327 && control == LLC_UI) { 328 isoclns_print(ndo, p, length); 329 return (hdrlen); 330 } 331 332 if (!ndo->ndo_eflag) { 333 if (ssap == dsap) { 334 if (src == NULL || dst == NULL) 335 ND_PRINT("%s ", tok2str(llc_values, "Unknown DSAP 0x%02x", dsap)); 336 else 337 ND_PRINT("%s > %s %s ", 338 (src->addr_string)(ndo, src->addr), 339 (dst->addr_string)(ndo, dst->addr), 340 tok2str(llc_values, "Unknown DSAP 0x%02x", dsap)); 341 } else { 342 if (src == NULL || dst == NULL) 343 ND_PRINT("%s > %s ", 344 tok2str(llc_values, "Unknown SSAP 0x%02x", ssap), 345 tok2str(llc_values, "Unknown DSAP 0x%02x", dsap)); 346 else 347 ND_PRINT("%s %s > %s %s ", 348 (src->addr_string)(ndo, src->addr), 349 tok2str(llc_values, "Unknown SSAP 0x%02x", ssap), 350 (dst->addr_string)(ndo, dst->addr), 351 tok2str(llc_values, "Unknown DSAP 0x%02x", dsap)); 352 } 353 } 354 355 if (is_u) { 356 ND_PRINT("Unnumbered, %s, Flags [%s], length %u", 357 tok2str(llc_cmd_values, "%02x", LLC_U_CMD(control)), 358 tok2str(llc_flag_values,"?",(ssap_field & LLC_GSAP) | (control & LLC_U_POLL)), 359 length + hdrlen); 360 361 if ((control & ~LLC_U_POLL) == LLC_XID) { 362 if (length == 0) { 363 /* 364 * XID with no payload. 365 * This could, for example, be an SNA 366 * "short form" XID. 367 */ 368 return (hdrlen); 369 } 370 if (caplen < 1) { 371 nd_print_trunc(ndo); 372 if (caplen > 0) 373 ND_DEFAULTPRINT((const u_char *)p, caplen); 374 return (hdrlen); 375 } 376 if (GET_U_1(p) == LLC_XID_FI) { 377 if (caplen < 3 || length < 3) { 378 nd_print_trunc(ndo); 379 if (caplen > 0) 380 ND_DEFAULTPRINT((const u_char *)p, caplen); 381 } else 382 ND_PRINT(": %02x %02x", 383 GET_U_1(p + 1), 384 GET_U_1(p + 2)); 385 return (hdrlen); 386 } 387 } 388 } else { 389 if ((control & LLC_S_FMT) == LLC_S_FMT) { 390 ND_PRINT("Supervisory, %s, rcv seq %u, Flags [%s], length %u", 391 tok2str(llc_supervisory_values,"?",LLC_S_CMD(control)), 392 LLC_IS_NR(control), 393 tok2str(llc_flag_values,"?",(ssap_field & LLC_GSAP) | (control & LLC_IS_POLL)), 394 length + hdrlen); 395 return (hdrlen); /* no payload to print */ 396 } else { 397 ND_PRINT("Information, send seq %u, rcv seq %u, Flags [%s], length %u", 398 LLC_I_NS(control), 399 LLC_IS_NR(control), 400 tok2str(llc_flag_values,"?",(ssap_field & LLC_GSAP) | (control & LLC_IS_POLL)), 401 length + hdrlen); 402 } 403 } 404 return (-hdrlen); 405} 406 407static const struct tok * 408oui_to_struct_tok(uint32_t orgcode) 409{ 410 const struct tok *tok = null_values; 411 const struct oui_tok *otp; 412 413 for (otp = &oui_to_tok[0]; otp->tok != NULL; otp++) { 414 if (otp->oui == orgcode) { 415 tok = otp->tok; 416 break; 417 } 418 } 419 return (tok); 420} 421 422int 423snap_print(netdissect_options *ndo, const u_char *p, u_int length, u_int caplen, 424 const struct lladdr_info *src, const struct lladdr_info *dst, 425 u_int bridge_pad) 426{ 427 uint32_t orgcode; 428 u_short et; 429 int ret; 430 431 ndo->ndo_protocol = "snap"; 432 ND_TCHECK_5(p); 433 if (caplen < 5 || length < 5) 434 goto trunc; 435 orgcode = GET_BE_U_3(p); 436 et = GET_BE_U_2(p + 3); 437 438 if (ndo->ndo_eflag) { 439 /* 440 * Somebody's already printed the MAC addresses, if there 441 * are any, so just print the SNAP header, not the MAC 442 * addresses. 443 */ 444 ND_PRINT("oui %s (0x%06x), %s %s (0x%04x), length %u: ", 445 tok2str(oui_values, "Unknown", orgcode), 446 orgcode, 447 (orgcode == 0x000000 ? "ethertype" : "pid"), 448 tok2str(oui_to_struct_tok(orgcode), "Unknown", et), 449 et, length - 5); 450 } 451 p += 5; 452 length -= 5; 453 caplen -= 5; 454 455 switch (orgcode) { 456 case OUI_ENCAP_ETHER: 457 case OUI_CISCO_90: 458 /* 459 * This is an encapsulated Ethernet packet, 460 * or a packet bridged by some piece of 461 * Cisco hardware; the protocol ID is 462 * an Ethernet protocol type. 463 */ 464 ret = ethertype_print(ndo, et, p, length, caplen, src, dst); 465 if (ret) 466 return (ret); 467 break; 468 469 case OUI_APPLETALK: 470 if (et == ETHERTYPE_ATALK) { 471 /* 472 * No, I have no idea why Apple used one 473 * of their own OUIs, rather than 474 * 0x000000, and an Ethernet packet 475 * type, for Appletalk data packets, 476 * but used 0x000000 and an Ethernet 477 * packet type for AARP packets. 478 */ 479 ret = ethertype_print(ndo, et, p, length, caplen, src, dst); 480 if (ret) 481 return (ret); 482 } 483 break; 484 485 case OUI_CISCO: 486 switch (et) { 487 case PID_CISCO_CDP: 488 cdp_print(ndo, p, length); 489 return (1); 490 case PID_CISCO_DTP: 491 dtp_print(ndo, p, length); 492 return (1); 493 case PID_CISCO_UDLD: 494 udld_print(ndo, p, length); 495 return (1); 496 case PID_CISCO_VTP: 497 vtp_print(ndo, p, length); 498 return (1); 499 case PID_CISCO_PVST: 500 case PID_CISCO_VLANBRIDGE: 501 stp_print(ndo, p, length); 502 return (1); 503 default: 504 break; 505 } 506 break; 507 508 case OUI_RFC2684: 509 switch (et) { 510 511 case PID_RFC2684_ETH_FCS: 512 case PID_RFC2684_ETH_NOFCS: 513 /* 514 * XXX - remove the last two bytes for 515 * PID_RFC2684_ETH_FCS? 516 */ 517 /* 518 * Skip the padding. 519 */ 520 ND_TCHECK_LEN(p, bridge_pad); 521 caplen -= bridge_pad; 522 length -= bridge_pad; 523 p += bridge_pad; 524 525 /* 526 * What remains is an Ethernet packet. 527 */ 528 ether_print(ndo, p, length, caplen, NULL, NULL); 529 return (1); 530 531 case PID_RFC2684_802_5_FCS: 532 case PID_RFC2684_802_5_NOFCS: 533 /* 534 * XXX - remove the last two bytes for 535 * PID_RFC2684_ETH_FCS? 536 */ 537 /* 538 * Skip the padding, but not the Access 539 * Control field. 540 */ 541 ND_TCHECK_LEN(p, bridge_pad); 542 caplen -= bridge_pad; 543 length -= bridge_pad; 544 p += bridge_pad; 545 546 /* 547 * What remains is an 802.5 Token Ring 548 * packet. 549 */ 550 token_print(ndo, p, length, caplen); 551 return (1); 552 553 case PID_RFC2684_FDDI_FCS: 554 case PID_RFC2684_FDDI_NOFCS: 555 /* 556 * XXX - remove the last two bytes for 557 * PID_RFC2684_ETH_FCS? 558 */ 559 /* 560 * Skip the padding. 561 */ 562 ND_TCHECK_LEN(p, bridge_pad + 1); 563 caplen -= bridge_pad + 1; 564 length -= bridge_pad + 1; 565 p += bridge_pad + 1; 566 567 /* 568 * What remains is an FDDI packet. 569 */ 570 fddi_print(ndo, p, length, caplen); 571 return (1); 572 573 case PID_RFC2684_BPDU: 574 stp_print(ndo, p, length); 575 return (1); 576 } 577 } 578 if (!ndo->ndo_eflag) { 579 /* 580 * Nobody printed the link-layer addresses, so print them, if 581 * we have any. 582 */ 583 if (src != NULL && dst != NULL) { 584 ND_PRINT("%s > %s ", 585 (src->addr_string)(ndo, src->addr), 586 (dst->addr_string)(ndo, dst->addr)); 587 } 588 /* 589 * Print the SNAP header, but if the OUI is 000000, don't 590 * bother printing it, and report the PID as being an 591 * ethertype. 592 */ 593 if (orgcode == 0x000000) { 594 ND_PRINT("SNAP, ethertype %s (0x%04x), length %u: ", 595 tok2str(ethertype_values, "Unknown", et), 596 et, length); 597 } else { 598 ND_PRINT("SNAP, oui %s (0x%06x), pid %s (0x%04x), length %u: ", 599 tok2str(oui_values, "Unknown", orgcode), 600 orgcode, 601 tok2str(oui_to_struct_tok(orgcode), "Unknown", et), 602 et, length); 603 } 604 } 605 return (0); 606 607trunc: 608 nd_print_trunc(ndo); 609 return (1); 610} 611