int
llc_print(const u_char *p, u_int length, u_int caplen,
const u_char *esrc, const u_char *edst, u_short *extracted_ethertype)
{
u_int8_t dsap_field, dsap, ssap_field, ssap;
u_int16_t control;
int is_u;
register int ret;
*extracted_ethertype = 0;
if (caplen < 3) {
(void)printf("[|llc]");
default_print((u_char *)p, caplen);
return(0);
}
dsap_field = *p;
ssap_field = *(p + 1);
/*
* OK, what type of LLC frame is this? The length
* of the control field depends on that - I frames
* have a two-byte control field, and U frames have
* a one-byte control field.
*/
control = *(p + 2);
if ((control & LLC_U_FMT) == LLC_U_FMT) {
/*
* U frame.
*/
is_u = 1;
} else {
/*
* The control field in I and S frames is
* 2 bytes...
*/
if (caplen < 4) {
(void)printf("[|llc]");
default_print((u_char *)p, caplen);
return(0);
}
/*
* ...and is little-endian.
*/
control = EXTRACT_LE_16BITS(p + 2);
is_u = 0;
}
if (ssap_field == LLCSAP_GLOBAL && dsap_field == LLCSAP_GLOBAL) {
/*
* This is an Ethernet_802.3 IPX frame; it has an
* 802.3 header (i.e., an Ethernet header where the
* type/length field is <= ETHERMTU, i.e. it's a length
* field, not a type field), but has no 802.2 header -
* the IPX packet starts right after the Ethernet header,
* with a signature of two bytes of 0xFF (which is
* LLCSAP_GLOBAL).
*
* (It might also have been an Ethernet_802.3 IPX at
* one time, but got bridged onto another network,
* such as an 802.11 network; this has appeared in at
* least one capture file.)
*/
if (eflag)
printf("IPX 802.3: ");
ipx_print(p, length);
return (1);
}
dsap = dsap_field & ~LLC_IG;
ssap = ssap_field & ~LLC_GSAP;
if (eflag) {
printf("LLC, dsap %s (0x%02x) %s, ssap %s (0x%02x) %s",
tok2str(llc_values, "Unknown", dsap),
dsap,
tok2str(llc_ig_flag_values, "Unknown", dsap_field & LLC_IG),
tok2str(llc_values, "Unknown", ssap),
ssap,
tok2str(llc_flag_values, "Unknown", ssap_field & LLC_GSAP));
if (is_u) {
printf(", ctrl 0x%02x: ", control);
} else {
printf(", ctrl 0x%04x: ", control);
}
}
if (ssap == LLCSAP_8021D && dsap == LLCSAP_8021D &&
control == LLC_UI) {
stp_print(p+3, length-3);
return (1);
}
if (ssap == LLCSAP_IP && dsap == LLCSAP_IP &&
control == LLC_UI) {
ip_print(gndo, p+4, length-4);
return (1);
}
if (ssap == LLCSAP_IPX && dsap == LLCSAP_IPX &&
control == LLC_UI) {
/*
* This is an Ethernet_802.2 IPX frame, with an 802.3
* header and an 802.2 LLC header with the source and
* destination SAPs being the IPX SAP.
*
* Skip DSAP, LSAP, and control field.
*/
if (eflag)
printf("IPX 802.2: ");
ipx_print(p+3, length-3);
return (1);
}
#ifdef TCPDUMP_DO_SMB
if (ssap == LLCSAP_NETBEUI && dsap == LLCSAP_NETBEUI
&& (!(control & LLC_S_FMT) || control == LLC_U_FMT)) {
/*
* we don't actually have a full netbeui parser yet, but the
* smb parser can handle many smb-in-netbeui packets, which
* is very useful, so we call that
*
* We don't call it for S frames, however, just I frames
* (which are frames that don't have the low-order bit,
* LLC_S_FMT, set in the first byte of the control field)
* and UI frames (whose control field is just 3, LLC_U_FMT).
*/
/*
* Skip the LLC header.
*/
if (is_u) {
p += 3;
length -= 3;
caplen -= 3;
} else {
p += 4;
length -= 4;
caplen -= 4;
}
netbeui_print(control, p, length);
return (1);
}
#endif
if (ssap == LLCSAP_ISONS && dsap == LLCSAP_ISONS
&& control == LLC_UI) {
isoclns_print(p + 3, length - 3, caplen - 3);
return (1);
}
if (ssap == LLCSAP_SNAP && dsap == LLCSAP_SNAP
&& control == LLC_UI) {
/*
* XXX - what *is* the right bridge pad value here?
* Does anybody ever bridge one form of LAN traffic
* over a networking type that uses 802.2 LLC?
*/
ret = snap_print(p+3, length-3, caplen-3, extracted_ethertype,
2);
if (ret)
return (ret);
}
if (!eflag) {
if (ssap == dsap) {
if (esrc == NULL || edst == NULL)
(void)printf("%s ", tok2str(llc_values, "Unknown DSAP 0x%02x", dsap));
else
(void)printf("%s > %s %s ",
etheraddr_string(esrc),
etheraddr_string(edst),
tok2str(llc_values, "Unknown DSAP 0x%02x", dsap));
} else {
if (esrc == NULL || edst == NULL)
(void)printf("%s > %s ",
tok2str(llc_values, "Unknown SSAP 0x%02x", ssap),
tok2str(llc_values, "Unknown DSAP 0x%02x", dsap));
else
(void)printf("%s %s > %s %s ",
etheraddr_string(esrc),
tok2str(llc_values, "Unknown SSAP 0x%02x", ssap),
etheraddr_string(edst),
tok2str(llc_values, "Unknown DSAP 0x%02x", dsap));
}
}
if (is_u) {
printf("Unnumbered, %s, Flags [%s], length %u",
tok2str(llc_cmd_values, "%02x", LLC_U_CMD(control)),
tok2str(llc_flag_values,"?",(ssap_field & LLC_GSAP) | (control & LLC_U_POLL)),
length);
p += 3;
length -= 3;
caplen -= 3;
if ((control & ~LLC_U_POLL) == LLC_XID) {
if (*p == LLC_XID_FI) {
printf(": %02x %02x", p[1], p[2]);
p += 3;
length -= 3;
caplen -= 3;
}
}
} else {
if ((control & LLC_S_FMT) == LLC_S_FMT) {
(void)printf("Supervisory, %s, rcv seq %u, Flags [%s], length %u",
tok2str(llc_supervisory_values,"?",LLC_S_CMD(control)),
LLC_IS_NR(control),
tok2str(llc_flag_values,"?",(ssap_field & LLC_GSAP) | (control & LLC_IS_POLL)),
length);
} else {
(void)printf("Information, send seq %u, rcv seq %u, Flags [%s], length %u",
LLC_I_NS(control),
LLC_IS_NR(control),
tok2str(llc_flag_values,"?",(ssap_field & LLC_GSAP) | (control & LLC_IS_POLL)),
length);
}
p += 4;
length -= 4;
caplen -= 4;
}
return(1);
}
int
snap_print(const u_char *p, u_int length, u_int caplen,
u_short *extracted_ethertype, u_int bridge_pad)
{
u_int32_t orgcode;
register u_short et;
register int ret;
TCHECK2(*p, 5);
orgcode = EXTRACT_24BITS(p);
et = EXTRACT_16BITS(p + 3);
if (eflag) {
const struct tok *tok = null_values;
const struct oui_tok *otp;
for (otp = &oui_to_tok[0]; otp->tok != NULL; otp++) {
if (otp->oui == orgcode) {
tok = otp->tok;
break;
}
}
(void)printf("oui %s (0x%06x), %s %s (0x%04x): ",
tok2str(oui_values, "Unknown", orgcode),
orgcode,
(orgcode == 0x000000 ? "ethertype" : "pid"),
tok2str(tok, "Unknown", et),
et);
}
p += 5;
length -= 5;
caplen -= 5;
switch (orgcode) {
case OUI_ENCAP_ETHER:
case OUI_CISCO_90:
/*
* This is an encapsulated Ethernet packet,
* or a packet bridged by some piece of
* Cisco hardware; the protocol ID is
* an Ethernet protocol type.
*/
ret = ether_encap_print(et, p, length, caplen,
extracted_ethertype);
if (ret)
return (ret);
break;
case OUI_APPLETALK:
if (et == ETHERTYPE_ATALK) {
/*
* No, I have no idea why Apple used one
* of their own OUIs, rather than
* 0x000000, and an Ethernet packet
* type, for Appletalk data packets,
* but used 0x000000 and an Ethernet
* packet type for AARP packets.
*/
ret = ether_encap_print(et, p, length, caplen,
extracted_ethertype);
if (ret)
return (ret);
}
break;
case OUI_CISCO:
if (et == PID_CISCO_CDP) {
cdp_print(p, length, caplen);
return (1);
}
break;
case OUI_RFC2684:
switch (et) {
case PID_RFC2684_ETH_FCS:
case PID_RFC2684_ETH_NOFCS:
/*
* XXX - remove the last two bytes for
* PID_RFC2684_ETH_FCS?
*/
/*
* Skip the padding.
*/
TCHECK2(*p, bridge_pad);
caplen -= bridge_pad;
length -= bridge_pad;
p += bridge_pad;
/*
* What remains is an Ethernet packet.
*/
ether_print(p, length, caplen);
return (1);
case PID_RFC2684_802_5_FCS:
case PID_RFC2684_802_5_NOFCS:
/*
* XXX - remove the last two bytes for
* PID_RFC2684_ETH_FCS?
*/
/*
* Skip the padding, but not the Access
* Control field.
*/
TCHECK2(*p, bridge_pad);
caplen -= bridge_pad;
length -= bridge_pad;
p += bridge_pad;
/*
* What remains is an 802.5 Token Ring
* packet.
*/
token_print(p, length, caplen);
return (1);
case PID_RFC2684_FDDI_FCS:
case PID_RFC2684_FDDI_NOFCS:
/*
* XXX - remove the last two bytes for
* PID_RFC2684_ETH_FCS?
*/
/*
* Skip the padding.
*/
TCHECK2(*p, bridge_pad + 1);
caplen -= bridge_pad + 1;
length -= bridge_pad + 1;
p += bridge_pad + 1;
/*
* What remains is an FDDI packet.
*/
fddi_print(p, length, caplen);
return (1);
case PID_RFC2684_BPDU:
stp_print(p, length);
return (1);
}
}
return (0);
trunc:
(void)printf("[|snap]");
return (1);
}
int
snap_print(netdissect_options *ndo, const u_char *p, u_int length, u_int caplen,
const struct lladdr_info *src, const struct lladdr_info *dst,
u_int bridge_pad)
{
uint32_t orgcode;
u_short et;
int ret;
ND_TCHECK_5(p);
if (caplen < 5 || length < 5)
goto trunc;
orgcode = EXTRACT_BE_U_3(p);
et = EXTRACT_BE_U_2(p + 3);
if (ndo->ndo_eflag) {
/*
* Somebody's already printed the MAC addresses, if there
* are any, so just print the SNAP header, not the MAC
* addresses.
*/
ND_PRINT("oui %s (0x%06x), %s %s (0x%04x), length %u: ",
tok2str(oui_values, "Unknown", orgcode),
orgcode,
(orgcode == 0x000000 ? "ethertype" : "pid"),
tok2str(oui_to_struct_tok(orgcode), "Unknown", et),
et, length - 5);
}
p += 5;
length -= 5;
caplen -= 5;
switch (orgcode) {
case OUI_ENCAP_ETHER:
case OUI_CISCO_90:
/*
* This is an encapsulated Ethernet packet,
* or a packet bridged by some piece of
* Cisco hardware; the protocol ID is
* an Ethernet protocol type.
*/
ret = ethertype_print(ndo, et, p, length, caplen, src, dst);
if (ret)
return (ret);
break;
case OUI_APPLETALK:
if (et == ETHERTYPE_ATALK) {
/*
* No, I have no idea why Apple used one
* of their own OUIs, rather than
* 0x000000, and an Ethernet packet
* type, for Appletalk data packets,
* but used 0x000000 and an Ethernet
* packet type for AARP packets.
*/
ret = ethertype_print(ndo, et, p, length, caplen, src, dst);
if (ret)
return (ret);
}
break;
case OUI_CISCO:
switch (et) {
case PID_CISCO_CDP:
cdp_print(ndo, p, length, caplen);
return (1);
case PID_CISCO_DTP:
dtp_print(ndo, p, length);
return (1);
case PID_CISCO_UDLD:
udld_print(ndo, p, length);
return (1);
case PID_CISCO_VTP:
vtp_print(ndo, p, length);
return (1);
case PID_CISCO_PVST:
case PID_CISCO_VLANBRIDGE:
stp_print(ndo, p, length);
return (1);
default:
break;
}
break;
case OUI_RFC2684:
switch (et) {
case PID_RFC2684_ETH_FCS:
case PID_RFC2684_ETH_NOFCS:
/*
* XXX - remove the last two bytes for
* PID_RFC2684_ETH_FCS?
*/
/*
* Skip the padding.
*/
ND_TCHECK_LEN(p, bridge_pad);
caplen -= bridge_pad;
length -= bridge_pad;
p += bridge_pad;
/*
* What remains is an Ethernet packet.
*/
ether_print(ndo, p, length, caplen, NULL, NULL);
return (1);
case PID_RFC2684_802_5_FCS:
case PID_RFC2684_802_5_NOFCS:
/*
* XXX - remove the last two bytes for
* PID_RFC2684_ETH_FCS?
*/
/*
* Skip the padding, but not the Access
* Control field.
*/
ND_TCHECK_LEN(p, bridge_pad);
caplen -= bridge_pad;
length -= bridge_pad;
p += bridge_pad;
/*
* What remains is an 802.5 Token Ring
* packet.
*/
token_print(ndo, p, length, caplen);
return (1);
case PID_RFC2684_FDDI_FCS:
case PID_RFC2684_FDDI_NOFCS:
/*
* XXX - remove the last two bytes for
* PID_RFC2684_ETH_FCS?
*/
/*
* Skip the padding.
*/
ND_TCHECK_LEN(p, bridge_pad + 1);
caplen -= bridge_pad + 1;
length -= bridge_pad + 1;
p += bridge_pad + 1;
/*
* What remains is an FDDI packet.
*/
fddi_print(ndo, p, length, caplen);
return (1);
case PID_RFC2684_BPDU:
stp_print(ndo, p, length);
return (1);
}
}
if (!ndo->ndo_eflag) {
/*
* Nobody printed the link-layer addresses, so print them, if
* we have any.
*/
if (src != NULL && dst != NULL) {
ND_PRINT("%s > %s ",
(src->addr_string)(ndo, src->addr),
(dst->addr_string)(ndo, dst->addr));
}
/*
* Print the SNAP header, but if the OUI is 000000, don't
* bother printing it, and report the PID as being an
* ethertype.
*/
if (orgcode == 0x000000) {
ND_PRINT("SNAP, ethertype %s (0x%04x), length %u: ",
tok2str(ethertype_values, "Unknown", et),
et, length);
} else {
ND_PRINT("SNAP, oui %s (0x%06x), pid %s (0x%04x), length %u: ",
tok2str(oui_values, "Unknown", orgcode),
orgcode,
tok2str(oui_to_struct_tok(orgcode), "Unknown", et),
et, length);
}
}
return (0);
trunc:
ND_PRINT("[|snap]");
return (1);
}
/*
* If we printed information about the payload, returns the length of the LLC
* header, plus the length of any SNAP header following it.
*
* Otherwise (for example, if the packet has unknown SAPs or has a SNAP
* header with an unknown OUI/PID combination), returns the *negative*
* of that value.
*/
int
llc_print(netdissect_options *ndo, const u_char *p, u_int length, u_int caplen,
const struct lladdr_info *src, const struct lladdr_info *dst)
{
uint8_t dsap_field, dsap, ssap_field, ssap;
uint16_t control;
int hdrlen;
int is_u;
if (caplen < 3) {
ND_PRINT("[|llc]");
ND_DEFAULTPRINT((const u_char *)p, caplen);
return (caplen);
}
if (length < 3) {
ND_PRINT("[|llc]");
ND_DEFAULTPRINT((const u_char *)p, caplen);
return (length);
}
dsap_field = EXTRACT_U_1(p);
ssap_field = EXTRACT_U_1(p + 1);
/*
* OK, what type of LLC frame is this? The length
* of the control field depends on that - I frames
* have a two-byte control field, and U frames have
* a one-byte control field.
*/
control = EXTRACT_U_1(p + 2);
if ((control & LLC_U_FMT) == LLC_U_FMT) {
/*
* U frame.
*/
is_u = 1;
hdrlen = 3; /* DSAP, SSAP, 1-byte control field */
} else {
/*
* The control field in I and S frames is
* 2 bytes...
*/
if (caplen < 4) {
ND_PRINT("[|llc]");
ND_DEFAULTPRINT((const u_char *)p, caplen);
return (caplen);
}
if (length < 4) {
ND_PRINT("[|llc]");
ND_DEFAULTPRINT((const u_char *)p, caplen);
return (length);
}
/*
* ...and is little-endian.
*/
control = EXTRACT_LE_U_2(p + 2);
is_u = 0;
hdrlen = 4; /* DSAP, SSAP, 2-byte control field */
}
if (ssap_field == LLCSAP_GLOBAL && dsap_field == LLCSAP_GLOBAL) {
/*
* This is an Ethernet_802.3 IPX frame; it has an
* 802.3 header (i.e., an Ethernet header where the
* type/length field is <= MAX_ETHERNET_LENGTH_VAL,
* i.e. it's a length field, not a type field), but
* has no 802.2 header - the IPX packet starts right
* after the Ethernet header, with a signature of two
* bytes of 0xFF (which is LLCSAP_GLOBAL).
*
* (It might also have been an Ethernet_802.3 IPX at
* one time, but got bridged onto another network,
* such as an 802.11 network; this has appeared in at
* least one capture file.)
*/
if (ndo->ndo_eflag)
ND_PRINT("IPX 802.3: ");
ipx_print(ndo, p, length);
return (0); /* no LLC header */
}
dsap = dsap_field & ~LLC_IG;
ssap = ssap_field & ~LLC_GSAP;
if (ndo->ndo_eflag) {
ND_PRINT("LLC, dsap %s (0x%02x) %s, ssap %s (0x%02x) %s",
tok2str(llc_values, "Unknown", dsap),
dsap,
tok2str(llc_ig_flag_values, "Unknown", dsap_field & LLC_IG),
tok2str(llc_values, "Unknown", ssap),
ssap,
tok2str(llc_flag_values, "Unknown", ssap_field & LLC_GSAP));
if (is_u) {
ND_PRINT(", ctrl 0x%02x: ", control);
} else {
ND_PRINT(", ctrl 0x%04x: ", control);
}
}
/*
* Skip LLC header.
*/
p += hdrlen;
length -= hdrlen;
caplen -= hdrlen;
if (ssap == LLCSAP_SNAP && dsap == LLCSAP_SNAP
&& control == LLC_UI) {
/*
* XXX - what *is* the right bridge pad value here?
* Does anybody ever bridge one form of LAN traffic
* over a networking type that uses 802.2 LLC?
*/
if (!snap_print(ndo, p, length, caplen, src, dst, 2)) {
/*
* Unknown packet type; tell our caller, by
* returning a negative value, so they
* can print the raw packet.
*/
return (-(hdrlen + 5)); /* include LLC and SNAP header */
} else
return (hdrlen + 5); /* include LLC and SNAP header */
}
if (ssap == LLCSAP_8021D && dsap == LLCSAP_8021D &&
control == LLC_UI) {
stp_print(ndo, p, length);
return (hdrlen);
}
if (ssap == LLCSAP_IP && dsap == LLCSAP_IP &&
control == LLC_UI) {
/*
* This is an RFC 948-style IP packet, with
* an 802.3 header and an 802.2 LLC header
* with the source and destination SAPs being
* the IP SAP.
*/
ip_print(ndo, p, length);
return (hdrlen);
}
if (ssap == LLCSAP_IPX && dsap == LLCSAP_IPX &&
control == LLC_UI) {
/*
* This is an Ethernet_802.2 IPX frame, with an 802.3
* header and an 802.2 LLC header with the source and
* destination SAPs being the IPX SAP.
*/
if (ndo->ndo_eflag)
ND_PRINT("IPX 802.2: ");
ipx_print(ndo, p, length);
return (hdrlen);
}
#ifdef ENABLE_SMB
if (ssap == LLCSAP_NETBEUI && dsap == LLCSAP_NETBEUI
&& (!(control & LLC_S_FMT) || control == LLC_U_FMT)) {
/*
* we don't actually have a full netbeui parser yet, but the
* smb parser can handle many smb-in-netbeui packets, which
* is very useful, so we call that
*
* We don't call it for S frames, however, just I frames
* (which are frames that don't have the low-order bit,
* LLC_S_FMT, set in the first byte of the control field)
* and UI frames (whose control field is just 3, LLC_U_FMT).
*/
netbeui_print(ndo, control, p, length);
return (hdrlen);
}
#endif
if (ssap == LLCSAP_ISONS && dsap == LLCSAP_ISONS
&& control == LLC_UI) {
isoclns_print(ndo, p, length);
return (hdrlen);
}
if (!ndo->ndo_eflag) {
if (ssap == dsap) {
if (src == NULL || dst == NULL)
ND_PRINT("%s ", tok2str(llc_values, "Unknown DSAP 0x%02x", dsap));
else
ND_PRINT("%s > %s %s ",
(src->addr_string)(ndo, src->addr),
(dst->addr_string)(ndo, dst->addr),
tok2str(llc_values, "Unknown DSAP 0x%02x", dsap));
} else {
if (src == NULL || dst == NULL)
ND_PRINT("%s > %s ",
tok2str(llc_values, "Unknown SSAP 0x%02x", ssap),
tok2str(llc_values, "Unknown DSAP 0x%02x", dsap));
else
ND_PRINT("%s %s > %s %s ",
(src->addr_string)(ndo, src->addr),
tok2str(llc_values, "Unknown SSAP 0x%02x", ssap),
(dst->addr_string)(ndo, dst->addr),
tok2str(llc_values, "Unknown DSAP 0x%02x", dsap));
}
}
if (is_u) {
ND_PRINT("Unnumbered, %s, Flags [%s], length %u",
tok2str(llc_cmd_values, "%02x", LLC_U_CMD(control)),
tok2str(llc_flag_values,"?",(ssap_field & LLC_GSAP) | (control & LLC_U_POLL)),
length + hdrlen);
if ((control & ~LLC_U_POLL) == LLC_XID) {
if (length == 0) {
/*
* XID with no payload.
* This could, for example, be an SNA
* "short form" XID.
*/
return (hdrlen);
}
if (caplen < 1) {
ND_PRINT("[|llc]");
if (caplen > 0)
ND_DEFAULTPRINT((const u_char *)p, caplen);
return (hdrlen);
}
if (EXTRACT_U_1(p) == LLC_XID_FI) {
if (caplen < 3 || length < 3) {
ND_PRINT("[|llc]");
if (caplen > 0)
ND_DEFAULTPRINT((const u_char *)p, caplen);
} else
ND_PRINT(": %02x %02x",
EXTRACT_U_1(p + 1),
EXTRACT_U_1(p + 2));
return (hdrlen);
}
}
} else {
if ((control & LLC_S_FMT) == LLC_S_FMT) {
ND_PRINT("Supervisory, %s, rcv seq %u, Flags [%s], length %u",
tok2str(llc_supervisory_values,"?",LLC_S_CMD(control)),
LLC_IS_NR(control),
tok2str(llc_flag_values,"?",(ssap_field & LLC_GSAP) | (control & LLC_IS_POLL)),
length + hdrlen);
return (hdrlen); /* no payload to print */
} else {
ND_PRINT("Information, send seq %u, rcv seq %u, Flags [%s], length %u",
LLC_I_NS(control),
LLC_IS_NR(control),
tok2str(llc_flag_values,"?",(ssap_field & LLC_GSAP) | (control & LLC_IS_POLL)),
length + hdrlen);
}
}
return (-hdrlen);
}
static int
do_print(void)
{
int status = 0;
stp_vars_t *v;
const stp_printer_t *the_printer;
int left, right, top, bottom;
int x, y;
int width, height;
int retval;
stp_parameter_list_t params;
int count;
int i;
char tmp[32];
initialize_global_parameters();
global_vars = stp_vars_create();
stp_set_outfunc(global_vars, writefunc);
stp_set_errfunc(global_vars, writefunc);
stp_set_outdata(global_vars, stdout);
stp_set_errdata(global_vars, stderr);
setlocale(LC_ALL, "C");
retval = yyparse();
setlocale(LC_ALL, "");
if (retval)
return retval + 1;
if (!global_did_something)
return 1;
v = stp_vars_create();
the_printer = stp_get_printer_by_driver(global_printer);
if (!the_printer)
{
int j;
fprintf(stderr, "Unknown printer %s\nValid printers are:\n",
global_printer);
for (j = 0; j < stp_printer_model_count(); j++)
{
the_printer = stp_get_printer_by_index(j);
fprintf(stderr, "%-16s%s\n", stp_printer_get_driver(the_printer),
stp_printer_get_long_name(the_printer));
}
return 2;
}
bytes_written = 0;
if (global_output)
{
if (strcmp(global_output, "-") == 0)
output = stdout;
else if (strcmp(global_output, "") == 0)
output = NULL;
else if (global_output[0] == '|')
{
close_output();
write_to_process = 1;
output = popen(global_output+1, "w");
if (! output)
{
fprintf(stderr, "popen '%s' failed: %s\n", global_output, strerror(errno));
output = NULL;
}
free(global_output);
global_output = NULL;
}
else
{
close_output();
output = fopen(global_output, "wb");
if (! output)
{
fprintf(stderr, "Create %s failed: %s\n", global_output, strerror(errno));
output = NULL;
}
free(global_output);
global_output = NULL;
}
}
stp_set_printer_defaults(v, the_printer);
stp_set_outfunc(v, writefunc);
stp_set_errfunc(v, writefunc);
stp_set_outdata(v, output);
stp_set_errdata(v, stderr);
stp_set_string_parameter(v, "InputImageType", global_image_type);
sprintf(tmp, "%d", global_bit_depth);
stp_set_string_parameter(v, "ChannelBitDepth", tmp);
if (strcmp(global_image_type, "Raw") == 0)
{
sprintf(tmp, "%d", global_channel_depth);
stp_set_string_parameter(v, "RawChannels", tmp);
}
stp_set_float_parameter(v, "Density", global_density);
stp_set_string_parameter(v, "Quality", "None");
stp_set_string_parameter(v, "ImageType", "None");
params = stp_get_parameter_list(v);
count = stp_parameter_list_count(params);
for (i = 0; i < count; i++)
{
const stp_parameter_t *p = stp_parameter_list_param(params, i);
if (p->p_type == STP_PARAMETER_TYPE_STRING_LIST)
{
const char *val = stp_get_string_parameter(global_vars, p->name);
if (val && strlen(val) > 0)
{
stp_set_string_parameter(v, p->name, val);
}
}
else if (p->p_type == STP_PARAMETER_TYPE_INT &&
stp_check_int_parameter(global_vars, p->name, STP_PARAMETER_ACTIVE))
{
int val = stp_get_int_parameter(global_vars, p->name);
stp_set_int_parameter(v, p->name, val);
}
else if (p->p_type == STP_PARAMETER_TYPE_BOOLEAN &&
stp_check_boolean_parameter(global_vars, p->name, STP_PARAMETER_ACTIVE))
{
int val = stp_get_boolean_parameter(global_vars, p->name);
stp_set_boolean_parameter(v, p->name, val);
}
else if (p->p_type == STP_PARAMETER_TYPE_CURVE &&
stp_check_curve_parameter(global_vars, p->name, STP_PARAMETER_ACTIVE))
{
const stp_curve_t *val = stp_get_curve_parameter(global_vars, p->name);
stp_set_curve_parameter(v, p->name, val);
}
else if (p->p_type == STP_PARAMETER_TYPE_DOUBLE &&
stp_check_float_parameter(global_vars, p->name, STP_PARAMETER_ACTIVE))
{
double val = stp_get_float_parameter(global_vars, p->name);
stp_set_float_parameter(v, p->name, val);
}
}
stp_set_page_width(v, stp_get_page_width(global_vars));
stp_set_page_height(v, stp_get_page_height(global_vars));
stp_parameter_list_destroy(params);
if (stp_check_string_parameter(v, "PageSize", STP_PARAMETER_ACTIVE) &&
!strcmp(stp_get_string_parameter(v, "PageSize"), "Auto"))
{
stp_parameter_t desc;
stp_describe_parameter(v, "PageSize", &desc);
if (desc.p_type == STP_PARAMETER_TYPE_STRING_LIST)
stp_set_string_parameter(v, "PageSize", desc.deflt.str);
stp_parameter_description_destroy(&desc);
}
stp_set_printer_defaults_soft(v, the_printer);
stp_get_imageable_area(v, &left, &right, &bottom, &top);
stp_describe_resolution(v, &x, &y);
if (x < 0)
x = 300;
if (y < 0)
y = 300;
width = right - left;
height = bottom - top;
switch (global_size_mode)
{
case SIZE_PT:
top += (int) (global_xtop + .5);
left += (int) (global_xleft + .5);
width = (int) (global_hsize + .5);
height = (int) (global_vsize + .5);
break;
case SIZE_IN:
top += (int) ((global_xtop * 72) + .5);
left += (int) ((global_xleft * 72) + .5);
width = (int) ((global_hsize * 72) + .5);
height = (int) ((global_vsize * 72) + .5);
break;
case SIZE_MM:
top += (int) ((global_xtop * 72 / 25.4) + .5);
left += (int) ((global_xleft * 72 / 25.4) + .5);
width = (int) ((global_hsize * 72 / 25.4) + .5);
height = (int) ((global_vsize * 72 / 25.4) + .5);
break;
case SIZE_RELATIVE:
default:
top += height * global_xtop;
left += width * global_xleft;
width *= global_hsize;
height *= global_vsize;
break;
}
stp_set_width(v, width);
stp_set_height(v, height);
#if 0
width = (width / global_steps) * global_steps;
height = (height / global_n_testpatterns) * global_n_testpatterns;
#endif
if (global_steps > width)
global_steps = width;
global_printer_width = width * x / 72;
global_printer_height = height * y / 72;
global_band_height = global_printer_height / global_n_testpatterns;
if (global_band_height == 0)
global_band_height = 1;
stp_set_left(v, left);
stp_set_top(v, top);
stp_merge_printvars(v, stp_printer_get_defaults(the_printer));
if (stp_verify(v))
{
bytes_written = 0;
if (start_job)
{
stp_start_job(v, &theImage);
start_job = 0;
}
if (stp_print(v, &theImage) != 1)
{
if (!global_quiet)
fputs("FAILED", stderr);
failures++;
status = 2;
if (global_halt_on_error)
return status;
}
else if (bytes_written == 0)
{
if (!global_quiet)
fputs("FAILED: No output", stderr);
failures++;
status = 2;
if (global_halt_on_error)
return status;
}
else
passes++;
if (end_job)
{
stp_end_job(v, &theImage);
end_job = 0;
}
}
else
{
if (! global_fail_verify_ok)
{
if (!global_quiet)
fputs("FAILED", stderr);
failures++;
status = 2;
if (global_halt_on_error)
return status;
}
else
{
if (!global_quiet)
fputs("(skipped)", stderr);
skipped++;
}
}
if (!global_quiet)
fputc('\n', stderr);
stp_vars_destroy(v);
stp_free(static_testpatterns);
static_testpatterns = NULL;
return status;
}
/*
* Returns non-zero IFF it succeeds in printing the header
*/
int
llc_print(const u_char *p, u_int length, u_int caplen,
const u_char *esrc, const u_char *edst, u_short *extracted_ethertype)
{
u_int8_t dsap, ssap;
u_int16_t control;
int is_u;
register int ret;
if (caplen < 3) {
(void)printf("[|llc]");
default_print((u_char *)p, caplen);
return(0);
}
dsap = *p;
ssap = *(p + 1);
/*
* OK, what type of LLC frame is this? The length
* of the control field depends on that - I frames
* have a two-byte control field, and U frames have
* a one-byte control field.
*/
control = *(p + 2);
if ((control & LLC_U_FMT) == LLC_U_FMT) {
/*
* U frame.
*/
is_u = 1;
} else {
/*
* The control field in I and S frames is
* 2 bytes...
*/
if (caplen < 4) {
(void)printf("[|llc]");
default_print((u_char *)p, caplen);
return(0);
}
/*
* ...and is little-endian.
*/
control = EXTRACT_LE_16BITS(p + 2);
is_u = 0;
}
#if !defined(EMBED) || defined(CONFIG_IPX) || defined(CONFIG_IPX_MODULE)
if (ssap == LLCSAP_GLOBAL && dsap == LLCSAP_GLOBAL) {
/*
* This is an Ethernet_802.3 IPX frame; it has an
* 802.3 header (i.e., an Ethernet header where the
* type/length field is <= ETHERMTU, i.e. it's a length
* field, not a type field), but has no 802.2 header -
* the IPX packet starts right after the Ethernet header,
* with a signature of two bytes of 0xFF (which is
* LLCSAP_GLOBAL).
*
* (It might also have been an Ethernet_802.3 IPX at
* one time, but got bridged onto another network,
* such as an 802.11 network; this has appeared in at
* least one capture file.)
*/
if (eflag)
printf("IPX-802.3: ");
ipx_print(p, length);
return (1);
}
#endif
if (eflag) {
if (is_u) {
printf("LLC, dsap %s (0x%02x), ssap %s (0x%02x), cmd 0x%02x: ",
tok2str(llc_values, "Unknown", dsap),
dsap,
tok2str(llc_values, "Unknown", ssap),
ssap,
control);
} else {
printf("LLC, dsap %s (0x%02x), ssap %s (0x%02x), cmd 0x%04x: ",
tok2str(llc_values, "Unknown", dsap),
dsap,
tok2str(llc_values, "Unknown", ssap),
ssap,
control);
}
}
#if !defined(EMBED) || defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
if (ssap == LLCSAP_8021D && dsap == LLCSAP_8021D &&
control == LLC_UI) {
stp_print(p+3, length-3);
return (1);
}
#endif
if (ssap == LLCSAP_IP && dsap == LLCSAP_IP &&
control == LLC_UI) {
ip_print(gndo, p+4, length-4);
return (1);
}
#if !defined(EMBED) || defined(CONFIG_IPX) || defined(CONFIG_IPX_MODULE)
if (ssap == LLCSAP_IPX && dsap == LLCSAP_IPX &&
control == LLC_UI) {
/*
* This is an Ethernet_802.2 IPX frame, with an 802.3
* header and an 802.2 LLC header with the source and
* destination SAPs being the IPX SAP.
*
* Skip DSAP, LSAP, and control field.
*/
printf("(NOV-802.2) ");
ipx_print(p+3, length-3);
return (1);
}
#endif
#ifdef TCPDUMP_DO_SMB
if (ssap == LLCSAP_NETBEUI && dsap == LLCSAP_NETBEUI
&& (!(control & LLC_S_FMT) || control == LLC_U_FMT)) {
/*
* we don't actually have a full netbeui parser yet, but the
* smb parser can handle many smb-in-netbeui packets, which
* is very useful, so we call that
*
* We don't call it for S frames, however, just I frames
* (which are frames that don't have the low-order bit,
* LLC_S_FMT, set in the first byte of the control field)
* and UI frames (whose control field is just 3, LLC_U_FMT).
*/
/*
* Skip the LLC header.
*/
if (is_u) {
p += 3;
length -= 3;
caplen -= 3;
} else {
p += 4;
length -= 4;
caplen -= 4;
}
netbeui_print(control, p, length);
return (1);
}
#endif
#if !defined(EMBED)
if (ssap == LLCSAP_ISONS && dsap == LLCSAP_ISONS
&& control == LLC_UI) {
isoclns_print(p + 3, length - 3, caplen - 3);
return (1);
}
#endif
if (ssap == LLCSAP_SNAP && dsap == LLCSAP_SNAP
&& control == LLC_UI) {
/*
* XXX - what *is* the right bridge pad value here?
* Does anybody ever bridge one form of LAN traffic
* over a networking type that uses 802.2 LLC?
*/
ret = snap_print(p+3, length-3, caplen-3, extracted_ethertype,
2);
if (ret)
return (ret);
}
if (!eflag) {
if ((ssap & ~LLC_GSAP) == dsap) {
if (esrc == NULL || edst == NULL)
(void)printf("%s ", llcsap_string(dsap));
else
(void)printf("%s > %s %s ",
etheraddr_string(esrc),
etheraddr_string(edst),
llcsap_string(dsap));
} else {
if (esrc == NULL || edst == NULL)
(void)printf("%s > %s ",
llcsap_string(ssap & ~LLC_GSAP),
llcsap_string(dsap));
else
(void)printf("%s %s > %s %s ",
etheraddr_string(esrc),
llcsap_string(ssap & ~LLC_GSAP),
etheraddr_string(edst),
llcsap_string(dsap));
}
}
if (is_u) {
const char *m;
char f;
m = tok2str(cmd2str, "%02x", LLC_U_CMD(control));
switch ((ssap & LLC_GSAP) | (control & LLC_U_POLL)) {
case 0: f = 'C'; break;
case LLC_GSAP: f = 'R'; break;
case LLC_U_POLL: f = 'P'; break;
case LLC_GSAP|LLC_U_POLL: f = 'F'; break;
default: f = '?'; break;
}
printf("%s/%c", m, f);
p += 3;
length -= 3;
caplen -= 3;
if ((control & ~LLC_U_POLL) == LLC_XID) {
if (*p == LLC_XID_FI) {
printf(": %02x %02x", p[1], p[2]);
p += 3;
length -= 3;
caplen -= 3;
}
}
} else {
char f;
switch ((ssap & LLC_GSAP) | (control & LLC_IS_POLL)) {
case 0: f = 'C'; break;
case LLC_GSAP: f = 'R'; break;
case LLC_IS_POLL: f = 'P'; break;
case LLC_GSAP|LLC_IS_POLL: f = 'F'; break;
default: f = '?'; break;
}
if ((control & LLC_S_FMT) == LLC_S_FMT) {
static const char *llc_s[] = { "rr", "rej", "rnr", "03" };
(void)printf("%s (r=%d,%c)",
llc_s[LLC_S_CMD(control)],
LLC_IS_NR(control),
f);
} else {
(void)printf("I (s=%d,r=%d,%c)",
LLC_I_NS(control),
LLC_IS_NR(control),
f);
}
p += 4;
length -= 4;
caplen -= 4;
}
return(1);
}
char *
RaDumpUserBuffer (struct ArgusParserStruct *parser, struct ArgusRecordStruct *argus, int ind, int len)
{
struct ArgusFlow *flow = (struct ArgusFlow *) argus->dsrs[ARGUS_FLOW_INDEX];
unsigned short sport = 0, dport = 0;
int type, proto, process = 0;
struct ArgusDataStruct *user = NULL;
u_char buf[MAXSTRLEN], *bp = NULL, dchr;
int slen = 0, done = 0;
switch (ind) {
case ARGUS_SRCUSERDATA_INDEX:
dchr = 's';
break;
case ARGUS_DSTUSERDATA_INDEX:
dchr = 'd';
break;
}
if ((user = (struct ArgusDataStruct *)argus->dsrs[ind]) != NULL) {
bp = (u_char *) &user->array;
slen = (user->hdr.argus_dsrvl16.len - 2 ) * 4;
slen = (user->count < slen) ? user->count : slen;
slen = (slen > len) ? len : slen;
snapend = bp + slen;
}
if (flow != NULL) {
switch (flow->hdr.subtype & 0x3F) {
case ARGUS_FLOW_CLASSIC5TUPLE: {
switch (type = flow->hdr.argus_dsrvl8.qual) {
case ARGUS_TYPE_IPV4:
switch (flow->ip_flow.ip_p) {
case IPPROTO_TCP:
case IPPROTO_UDP: {
proto = flow->ip_flow.ip_p;
sport = flow->ip_flow.sport;
dport = flow->ip_flow.dport;
process++;
break;
}
case IPPROTO_IGMP: {
struct ArgusMetricStruct *metric = (void *)argus->dsrs[ARGUS_METRIC_INDEX];
if ((metric != NULL) && (((ind == ARGUS_SRCUSERDATA_INDEX) && metric->src.pkts) ||
((ind == ARGUS_DSTUSERDATA_INDEX) && metric->dst.pkts))) {
igmp_print(bp, slen);
done++;
break;
}
}
case IPPROTO_PIM: {
struct ArgusMetricStruct *metric = (void *)argus->dsrs[ARGUS_METRIC_INDEX];
if ((metric != NULL) && (((ind == ARGUS_SRCUSERDATA_INDEX) && metric->src.pkts) ||
((ind == ARGUS_DSTUSERDATA_INDEX) && metric->dst.pkts))) {
pim_print(bp, slen);
done++;
break;
}
}
}
break;
case ARGUS_TYPE_IPV6: {
switch (flow->ipv6_flow.ip_p) {
case IPPROTO_TCP:
case IPPROTO_UDP: {
proto = flow->ipv6_flow.ip_p;
sport = flow->ipv6_flow.sport;
dport = flow->ipv6_flow.dport;
process++;
break;
}
case IPPROTO_PIM: {
struct ArgusMetricStruct *metric = (void *)argus->dsrs[ARGUS_METRIC_INDEX];
if ((metric != NULL) && (((ind == ARGUS_SRCUSERDATA_INDEX) && metric->src.pkts) ||
((ind == ARGUS_DSTUSERDATA_INDEX) && metric->dst.pkts))) {
pim_print(bp, slen);
done++;
break;
}
}
}
break;
}
case ARGUS_TYPE_ARP: {
if (ind == ARGUS_SRCUSERDATA_INDEX) {
arp_src_print(parser, argus);
}
if (ind == ARGUS_DSTUSERDATA_INDEX) {
arp_dst_print(parser, argus);
}
done++;
break;
}
/*
struct ArgusMacFlow {
struct ether_header ehdr;
unsigned char dsap, ssap;
};
*/
case ARGUS_TYPE_ETHER: {
if (flow != NULL)
if ((flow->mac_flow.mac_union.ether.ssap == LLCSAP_BPDU) &&
(flow->mac_flow.mac_union.ether.dsap == LLCSAP_BPDU))
stp_print (bp, slen);
done++;
break;
}
}
}
}
}
if (process && bp) {
*(int *)&buf = 0;
#define ISPORT(p) (dport == (p) || sport == (p))
switch (proto) {
case IPPROTO_TCP: {
if (ISPORT(BGP_PORT))
bgp_print(bp, slen);
else if (ISPORT(TELNET_PORT))
telnet_print(bp, slen);
else if (ISPORT(PPTP_PORT))
pptp_print(bp, slen);
else if (ISPORT(NETBIOS_SSN_PORT))
nbt_tcp_print(bp, slen);
else if (ISPORT(BEEP_PORT))
beep_print(bp, slen);
else if (ISPORT(NAMESERVER_PORT) || ISPORT(MULTICASTDNS_PORT))
ns_print(bp + 2, slen - 2, 0);
else if (ISPORT(MSDP_PORT))
msdp_print(bp, slen);
else if (ISPORT(LDP_PORT))
ldp_print(bp, slen);
else {
int elen = 0;
parser->eflag = ArgusThisEflag;
elen = ArgusEncode (parser, (const char *)bp, NULL, slen, ArgusBuf, sizeof(ArgusBuf));
parser->eflag = ARGUS_HEXDUMP;
}
break;
}
case IPPROTO_UDP: {
if (ISPORT(NAMESERVER_PORT))
ns_print(bp, slen, 0);
else if (ISPORT(MULTICASTDNS_PORT))
ns_print(bp, slen, 1);
else if (ISPORT(NTP_PORT))
ntp_print(bp, slen);
else if (ISPORT(LDP_PORT))
ldp_print(bp, slen);
else if (ISPORT(RADIUS_PORT) || ISPORT(RADIUS_NEW_PORT) ||
ISPORT(RADIUS_ACCOUNTING_PORT) ||
ISPORT(RADIUS_NEW_ACCOUNTING_PORT) )
radius_print(bp, slen);
else if (ISPORT(KERBEROS_PORT) || ISPORT(KERBEROS_SEC_PORT))
krb_print(bp, slen);
else if (ISPORT(SNMP_PORT) || ISPORT(SNMPTRAP_PORT))
snmp_print(bp, slen);
else if (ISPORT(TIMED_PORT))
timed_print(bp, slen);
else if (ISPORT(TFTP_PORT))
tftp_print(bp, slen);
else if (ISPORT(IPPORT_BOOTPC) || ISPORT(IPPORT_BOOTPS))
bootp_print(bp, slen);
else if (ISPORT(RIP_PORT))
rip_print(bp, slen);
else if (ISPORT(AODV_PORT))
aodv_print(bp, slen, 0);
else if (ISPORT(L2TP_PORT))
l2tp_print(bp, slen);
else if (ISPORT(SYSLOG_PORT))
syslog_print(bp, slen);
else if (ISPORT(LMP_PORT))
lmp_print(bp, slen);
else if ((sport >= RX_PORT_LOW && sport <= RX_PORT_HIGH) ||
(dport >= RX_PORT_LOW && dport <= RX_PORT_HIGH))
rx_print(bp, slen, sport, dport);
else if (dport == BFD_CONTROL_PORT || dport == BFD_ECHO_PORT )
bfd_print(bp, slen, dport);
else if (ISPORT(NETBIOS_NS_PORT))
nbt_udp137_print(bp, slen);
else if (ISPORT(NETBIOS_DGRAM_PORT))
nbt_udp138_print(bp, slen);
else if (ISPORT(ISAKMP_PORT))
isakmp_print(bp, slen);
else if (ISPORT(ISAKMP_PORT_NATT))
isakmp_rfc3948_print(bp, slen);
else if (ISPORT(ISAKMP_PORT_USER1) || ISPORT(ISAKMP_PORT_USER2))
isakmp_print(bp, slen);
else {
int elen = 0;
parser->eflag = ArgusThisEflag;
elen = ArgusEncode (parser, (const char *)bp, NULL, slen, ArgusBuf, sizeof(ArgusBuf));
parser->eflag = ARGUS_HEXDUMP;
}
/*
else if (ISPORT(3456))
vat_print(bp, slen);
else if (ISPORT(ZEPHYR_SRV_PORT) || ISPORT(ZEPHYR_CLT_PORT))
zephyr_print(bp, slen);
else if (ISPORT(RIPNG_PORT))
ripng_print(bp, slen);
else if (ISPORT(DHCP6_SERV_PORT) || ISPORT(DHCP6_CLI_PORT))
dhcp6_print(bp, slen);
else if (dport == 4567)
wb_print(bp, slen);
else if (ISPORT(CISCO_AUTORP_PORT))
cisco_autorp_print(bp, slen);
else if (ISPORT(RADIUS_PORT) || ISPORT(RADIUS_NEW_PORT) ||
ISPORT(RADIUS_ACCOUNTING_PORT) || ISPORT(RADIUS_NEW_ACCOUNTING_PORT) )
radius_print(bp, slen);
else if (dport == HSRP_PORT)
hsrp_print(bp, slen);
else if (ISPORT(LWRES_PORT))
lwres_print(bp, slen);
else if (ISPORT(MPLS_LSP_PING_PORT))
lspping_print(bp, slen);
*/
}
}
}
return (ArgusBuf);
}
