u_int
juniper_mlppp_print(netdissect_options *ndo,
const struct pcap_pkthdr *h, register const u_char *p)
{
struct juniper_l2info_t l2info;
l2info.pictype = DLT_JUNIPER_MLPPP;
if (juniper_parse_header(ndo, p, h, &l2info) == 0)
return l2info.header_len;
/* suppress Bundle-ID if frame was captured on a child-link
* best indicator if the cookie looks like a proto */
if (ndo->ndo_eflag &&
EXTRACT_16BITS(&l2info.cookie) != PPP_OSI &&
EXTRACT_16BITS(&l2info.cookie) != (PPP_ADDRESS << 8 | PPP_CONTROL))
ND_PRINT((ndo, "Bundle-ID %u: ", l2info.bundle));
p+=l2info.header_len;
/* first try the LSQ protos */
switch(l2info.proto) {
case JUNIPER_LSQ_L3_PROTO_IPV4:
/* IP traffic going to the RE would not have a cookie
* -> this must be incoming IS-IS over PPP
*/
if (l2info.cookie[4] == (JUNIPER_LSQ_COOKIE_RE|JUNIPER_LSQ_COOKIE_DIR))
ppp_print(ndo, p, l2info.length);
else
ip_print(ndo, p, l2info.length);
return l2info.header_len;
#ifdef INET6
case JUNIPER_LSQ_L3_PROTO_IPV6:
ip6_print(ndo, p,l2info.length);
return l2info.header_len;
#endif
case JUNIPER_LSQ_L3_PROTO_MPLS:
mpls_print(ndo, p, l2info.length);
return l2info.header_len;
case JUNIPER_LSQ_L3_PROTO_ISO:
isoclns_print(ndo, p, l2info.length, l2info.caplen);
return l2info.header_len;
default:
break;
}
/* zero length cookie ? */
switch (EXTRACT_16BITS(&l2info.cookie)) {
case PPP_OSI:
ppp_print(ndo, p - 2, l2info.length + 2);
break;
case (PPP_ADDRESS << 8 | PPP_CONTROL): /* fall through */
default:
ppp_print(ndo, p, l2info.length);
break;
}
return l2info.header_len;
}
u_int
juniper_mlppp_print(const struct pcap_pkthdr *h, register const u_char *p)
{
struct juniper_l2info_t l2info;
l2info.pictype = DLT_JUNIPER_MLPPP;
if(juniper_parse_header(p, h, &l2info) == 0)
return l2info.header_len;
if (eflag &&
EXTRACT_16BITS(&l2info.cookie) != PPP_OSI &&
EXTRACT_16BITS(&l2info.cookie) != (PPP_ADDRESS << 8 | PPP_CONTROL))
printf("Bundle-ID %u: ",l2info.bundle);
p+=l2info.header_len;
switch(l2info.proto) {
case JUNIPER_LSQ_L3_PROTO_IPV4:
if (l2info.cookie[4] == (JUNIPER_LSQ_COOKIE_RE|JUNIPER_LSQ_COOKIE_DIR))
ppp_print(p, l2info.length);
else
ip_print(gndo, p, l2info.length);
return l2info.header_len;
#ifdef INET6
case JUNIPER_LSQ_L3_PROTO_IPV6:
ip6_print(p,l2info.length);
return l2info.header_len;
#endif
case JUNIPER_LSQ_L3_PROTO_MPLS:
mpls_print(p,l2info.length);
return l2info.header_len;
case JUNIPER_LSQ_L3_PROTO_ISO:
isoclns_print(p,l2info.length,l2info.caplen);
return l2info.header_len;
default:
break;
}
switch (EXTRACT_16BITS(&l2info.cookie)) {
case PPP_OSI:
ppp_print(p-2,l2info.length+2);
break;
case (PPP_ADDRESS << 8 | PPP_CONTROL):
default:
ppp_print(p,l2info.length);
break;
}
return l2info.header_len;
}
int
juniper_ppp_heuristic_guess(register const u_char *p, u_int length) {
switch(EXTRACT_16BITS(p)) {
case PPP_IP :
case PPP_OSI :
case PPP_MPLS_UCAST :
case PPP_MPLS_MCAST :
case PPP_IPCP :
case PPP_OSICP :
case PPP_MPLSCP :
case PPP_LCP :
case PPP_PAP :
case PPP_CHAP :
case PPP_ML :
#ifdef INET6
case PPP_IPV6 :
case PPP_IPV6CP :
#endif
ppp_print(p, length);
break;
default:
return 0;
break;
}
return 1;
}
/* try to guess, based on all PPP protos that are supported in
* a juniper router if the payload data is encapsulated using PPP */
int
juniper_ppp_heuristic_guess(packetbody_t p, u_int length) {
switch(EXTRACT_16BITS(p)) {
case PPP_IP :
case PPP_OSI :
case PPP_MPLS_UCAST :
case PPP_MPLS_MCAST :
case PPP_IPCP :
case PPP_OSICP :
case PPP_MPLSCP :
case PPP_LCP :
case PPP_PAP :
case PPP_CHAP :
case PPP_ML :
#ifdef INET6
case PPP_IPV6 :
case PPP_IPV6CP :
#endif
ppp_print(p, length);
break;
default:
return 0; /* did not find a ppp header */
break;
}
return 1; /* we printed a ppp packet */
}
/* try to guess, based on all PPP protos that are supported in
* a juniper router if the payload data is encapsulated using PPP */
static int
juniper_ppp_heuristic_guess(netdissect_options *ndo,
register const u_char *p, u_int length) {
switch(EXTRACT_16BITS(p)) {
case PPP_IP :
case PPP_OSI :
case PPP_MPLS_UCAST :
case PPP_MPLS_MCAST :
case PPP_IPCP :
case PPP_OSICP :
case PPP_MPLSCP :
case PPP_LCP :
case PPP_PAP :
case PPP_CHAP :
case PPP_ML :
#ifdef INET6
case PPP_IPV6 :
case PPP_IPV6CP :
#endif
ppp_print(ndo, p, length);
break;
default:
return 0; /* did not find a ppp header */
break;
}
return 1; /* we printed a ppp packet */
}
/* PPP I/F printer */
u_int
ppp_if_print(netdissect_options *ndo,
const struct pcap_pkthdr *h, const u_char *p)
{
u_int length = h->len;
u_int caplen = h->caplen;
if (caplen < PPP_HDRLEN) {
ND_PRINT("[|ppp]");
return (caplen);
}
#if 0
/*
* XXX: seems to assume that there are 2 octets prepended to an
* actual PPP frame. The 1st octet looks like Input/Output flag
* while 2nd octet is unknown, at least to me
* ([email protected]).
*
* That was what the original tcpdump code did.
*
* FreeBSD's "if_ppp.c" *does* set the first octet to 1 for outbound
* packets and 0 for inbound packets - but only if the
* protocol field has the 0x8000 bit set (i.e., it's a network
* control protocol); it does so before running the packet through
* "bpf_filter" to see if it should be discarded, and to see
* if we should update the time we sent the most recent packet...
*
* ...but it puts the original address field back after doing
* so.
*
* NetBSD's "if_ppp.c" doesn't set the first octet in that fashion.
*
* I don't know if any PPP implementation handed up to a BPF
* device packets with the first octet being 1 for outbound and
* 0 for inbound packets, so I ([email protected]) don't know
* whether that ever needs to be checked or not.
*
* Note that NetBSD has a DLT_PPP_SERIAL, which it uses for PPP,
* and its tcpdump appears to assume that the frame always
* begins with an address field and a control field, and that
* the address field might be 0x0f or 0x8f, for Cisco
* point-to-point with HDLC framing as per section 4.3.1 of RFC
* 1547, as well as 0xff, for PPP in HDLC-like framing as per
* RFC 1662.
*
* (Is the Cisco framing in question what DLT_C_HDLC, in
* BSD/OS, is?)
*/
if (ndo->ndo_eflag)
ND_PRINT("%c %4d %02x ", EXTRACT_U_1(p) ? 'O' : 'I',
length, EXTRACT_U_1(p + 1));
#endif
ppp_print(ndo, p, length);
return (0);
}
u_int
juniper_ppp_print(const struct pcap_pkthdr *h, register const u_char *p)
{
struct juniper_l2info_t l2info;
l2info.pictype = DLT_JUNIPER_PPP;
if(juniper_parse_header(p, h, &l2info) == 0)
return l2info.header_len;
p+=l2info.header_len;
ppp_print(p, l2info.length);
return l2info.header_len;
}
u_int
juniper_ppp_print(const struct pcap_pkthdr *h, packetbody_t p)
{
struct juniper_l2info_t l2info;
l2info.pictype = DLT_JUNIPER_PPP;
if(juniper_parse_header(p, h, &l2info) == 0)
return l2info.header_len;
p+=l2info.header_len;
/* this DLT contains nothing but raw ppp frames */
ppp_print(p, l2info.length);
return l2info.header_len;
}
u_int
juniper_ppp_print(netdissect_options *ndo,
const struct pcap_pkthdr *h, register const u_char *p)
{
struct juniper_l2info_t l2info;
l2info.pictype = DLT_JUNIPER_PPP;
if (juniper_parse_header(ndo, p, h, &l2info) == 0)
return l2info.header_len;
p+=l2info.header_len;
/* this DLT contains nothing but raw ppp frames */
ppp_print(ndo, p, l2info.length);
return l2info.header_len;
}
int
ethertype_print(netdissect_options *ndo,
u_short ether_type, const u_char *p,
u_int length, u_int caplen)
{
switch (ether_type) {
case ETHERTYPE_IP:
ip_print(ndo, p, length);
return (1);
case ETHERTYPE_IPV6:
ip6_print(ndo, p, length);
return (1);
case ETHERTYPE_ARP:
case ETHERTYPE_REVARP:
arp_print(ndo, p, length, caplen);
return (1);
case ETHERTYPE_DN:
decnet_print(ndo, p, length, caplen);
return (1);
case ETHERTYPE_ATALK:
if (ndo->ndo_vflag)
ND_PRINT((ndo, "et1 "));
atalk_print(ndo, p, length);
return (1);
case ETHERTYPE_AARP:
aarp_print(ndo, p, length);
return (1);
case ETHERTYPE_IPX:
ND_PRINT((ndo, "(NOV-ETHII) "));
ipx_print(ndo, p, length);
return (1);
case ETHERTYPE_ISO:
isoclns_print(ndo, p + 1, length - 1, length - 1);
return(1);
case ETHERTYPE_PPPOED:
case ETHERTYPE_PPPOES:
case ETHERTYPE_PPPOED2:
case ETHERTYPE_PPPOES2:
pppoe_print(ndo, p, length);
return (1);
case ETHERTYPE_EAPOL:
eap_print(ndo, p, length);
return (1);
case ETHERTYPE_RRCP:
rrcp_print(ndo, p - 14 , length + 14);
return (1);
case ETHERTYPE_PPP:
if (length) {
ND_PRINT((ndo, ": "));
ppp_print(ndo, p, length);
}
return (1);
case ETHERTYPE_MPCP:
mpcp_print(ndo, p, length);
return (1);
case ETHERTYPE_SLOW:
slow_print(ndo, p, length);
return (1);
case ETHERTYPE_CFM:
case ETHERTYPE_CFM_OLD:
cfm_print(ndo, p, length);
return (1);
case ETHERTYPE_LLDP:
lldp_print(ndo, p, length);
return (1);
case ETHERTYPE_LOOPBACK:
loopback_print(ndo, p, length);
return (1);
case ETHERTYPE_MPLS:
case ETHERTYPE_MPLS_MULTI:
mpls_print(ndo, p, length);
return (1);
case ETHERTYPE_TIPC:
tipc_print(ndo, p, length, caplen);
return (1);
case ETHERTYPE_MS_NLB_HB:
msnlb_print(ndo, p);
return (1);
case ETHERTYPE_GEONET_OLD:
case ETHERTYPE_GEONET:
geonet_print(ndo, p-14, p, length);
return (1);
case ETHERTYPE_CALM_FAST:
calm_fast_print(ndo, p-14, p, length);
return (1);
case ETHERTYPE_AOE:
aoe_print(ndo, p, length);
return (1);
case ETHERTYPE_LAT:
case ETHERTYPE_SCA:
case ETHERTYPE_MOPRC:
case ETHERTYPE_MOPDL:
case ETHERTYPE_IEEE1905_1:
/* default_print for now */
default:
return (0);
}
}
void
gre_print_1(const u_char *bp, u_int length)
{
u_int len = length;
u_int16_t flags, prot;
flags = EXTRACT_16BITS(bp);
len -= 2;
bp += 2;
if (vflag)
printf(", Flags [%s]",
bittok2str(gre_flag_values,"none",flags));
if (len < 2)
goto trunc;
prot = EXTRACT_16BITS(bp);
len -= 2;
bp += 2;
if (flags & GRE_KP) {
u_int32_t k;
if (len < 4)
goto trunc;
k = EXTRACT_32BITS(bp);
printf(", call %d", k & 0xffff);
len -= 4;
bp += 4;
}
if (flags & GRE_SP) {
if (len < 4)
goto trunc;
printf(", seq %u", EXTRACT_32BITS(bp));
bp += 4;
len -= 4;
}
if (flags & GRE_AP) {
if (len < 4)
goto trunc;
printf(", ack %u", EXTRACT_32BITS(bp));
bp += 4;
len -= 4;
}
if ((flags & GRE_SP) == 0)
printf(", no-payload");
if (eflag)
printf(", proto %s (0x%04x)",
tok2str(ethertype_values,"unknown",prot),
prot);
printf(", length %u",length);
if ((flags & GRE_SP) == 0)
return;
if (vflag < 1)
printf(": "); /* put in a colon as protocol demarc */
else
printf("\n\t"); /* if verbose go multiline */
switch (prot) {
case ETHERTYPE_PPP:
ppp_print(bp, len);
break;
default:
printf("gre-proto-0x%x", prot);
break;
}
return;
trunc:
printf("[|gre]");
}
static void
gre_print_1(netdissect_options *ndo, const u_char *bp, u_int length)
{
u_int len = length;
uint16_t flags, prot;
/* 16 bits ND_TCHECKed in gre_print() */
flags = EXTRACT_BE_U_2(bp);
len -= 2;
bp += 2;
if (ndo->ndo_vflag)
ND_PRINT(", Flags [%s]",
bittok2str(gre_flag_values,"none",flags));
ND_TCHECK_2(bp);
if (len < 2)
goto trunc;
prot = EXTRACT_BE_U_2(bp);
len -= 2;
bp += 2;
if (flags & GRE_KP) {
uint32_t k;
ND_TCHECK_4(bp);
if (len < 4)
goto trunc;
k = EXTRACT_BE_U_4(bp);
ND_PRINT(", call %u", k & 0xffff);
len -= 4;
bp += 4;
}
if (flags & GRE_SP) {
ND_TCHECK_4(bp);
if (len < 4)
goto trunc;
ND_PRINT(", seq %u", EXTRACT_BE_U_4(bp));
bp += 4;
len -= 4;
}
if (flags & GRE_AP) {
ND_TCHECK_4(bp);
if (len < 4)
goto trunc;
ND_PRINT(", ack %u", EXTRACT_BE_U_4(bp));
bp += 4;
len -= 4;
}
if ((flags & GRE_SP) == 0)
ND_PRINT(", no-payload");
if (ndo->ndo_eflag)
ND_PRINT(", proto %s (0x%04x)",
tok2str(ethertype_values,"unknown",prot),
prot);
ND_PRINT(", length %u",length);
if ((flags & GRE_SP) == 0)
return;
if (ndo->ndo_vflag < 1)
ND_PRINT(": "); /* put in a colon as protocol demarc */
else
ND_PRINT("\n\t"); /* if verbose go multiline */
switch (prot) {
case ETHERTYPE_PPP:
ppp_print(ndo, bp, len);
break;
default:
ND_PRINT("gre-proto-0x%x", prot);
break;
}
return;
trunc:
ND_PRINT("%s", tstr);
}
u_int
pppoe_print(register const u_char *bp, u_int length)
{
u_int16_t pppoe_ver, pppoe_type, pppoe_code, pppoe_sessionid;
u_int pppoe_length;
const u_char *pppoe_packet, *pppoe_payload;
if (length < PPPOE_HDRLEN) {
(void)printf("truncated-pppoe %u", length);
return (length);
}
length -= PPPOE_HDRLEN;
pppoe_packet = bp;
TCHECK2(*pppoe_packet, PPPOE_HDRLEN);
pppoe_ver = (pppoe_packet[0] & 0xF0) >> 4;
pppoe_type = (pppoe_packet[0] & 0x0F);
pppoe_code = pppoe_packet[1];
pppoe_sessionid = EXTRACT_16BITS(pppoe_packet + 2);
pppoe_length = EXTRACT_16BITS(pppoe_packet + 4);
pppoe_payload = pppoe_packet + PPPOE_HDRLEN;
if (pppoe_ver != 1) {
printf(" [ver %d]",pppoe_ver);
}
if (pppoe_type != 1) {
printf(" [type %d]",pppoe_type);
}
printf("PPPoE %s", tok2str(pppoecode2str, "PAD-%x", pppoe_code));
if (pppoe_code == PPPOE_PADI && pppoe_length > 1484 - PPPOE_HDRLEN) {
printf(" [len %u!]",pppoe_length);
}
if (pppoe_length > length) {
printf(" [len %u > %u!]", pppoe_length, length);
pppoe_length = length;
}
if (pppoe_sessionid) {
printf(" [ses 0x%x]", pppoe_sessionid);
}
if (pppoe_code) {
/* PPP session packets don't contain tags */
u_short tag_type = 0xffff, tag_len;
const u_char *p = pppoe_payload;
/*
* loop invariant:
* p points to current tag,
* tag_type is previous tag or 0xffff for first iteration
*/
while (tag_type && p < pppoe_payload + pppoe_length) {
TCHECK2(*p, 4);
tag_type = EXTRACT_16BITS(p);
tag_len = EXTRACT_16BITS(p + 2);
p += 4;
/* p points to tag_value */
if (tag_len) {
unsigned isascii = 0, isgarbage = 0;
const u_char *v;
char tag_str[MAXTAGPRINT];
unsigned tag_str_len = 0;
/* TODO print UTF-8 decoded text */
TCHECK2(*p, tag_len);
for (v = p; v < p + tag_len && tag_str_len < MAXTAGPRINT-1; v++)
if (*v >= 32 && *v < 127) {
tag_str[tag_str_len++] = *v;
isascii++;
} else {
tag_str[tag_str_len++] = '.';
isgarbage++;
}
tag_str[tag_str_len] = 0;
if (isascii > isgarbage) {
printf(" [%s \"%*.*s\"]",
tok2str(pppoetag2str, "TAG-0x%x", tag_type),
(int)tag_str_len,
(int)tag_str_len,
tag_str);
} else {
/* Print hex, not fast to abuse printf but this doesn't get used much */
printf(" [%s 0x", tok2str(pppoetag2str, "TAG-0x%x", tag_type));
for (v=p; v<p+tag_len; v++) {
printf("%02X", *v);
}
printf("]");
}
} else
printf(" [%s]", tok2str(pppoetag2str,
"TAG-0x%x", tag_type));
p += tag_len;
/* p points to next tag */
}
return (0);
} else {
/* PPPoE data */
printf(" ");
return (PPPOE_HDRLEN + ppp_print(pppoe_payload, pppoe_length));
}
trunc:
printf("[|pppoe]");
return (PPPOE_HDRLEN);
}
u_int
pppoe_print(register const u_char *bp, u_int length)
{
u_int16_t pppoe_ver, pppoe_type, pppoe_code, pppoe_sessionid;
u_int pppoe_length;
const u_char *pppoe_packet, *pppoe_payload;
if (length < PPPOE_HDRLEN) {
(void)printf("truncated-pppoe %u", length);
return (length);
}
length -= PPPOE_HDRLEN;
pppoe_packet = bp;
TCHECK2(*pppoe_packet, PPPOE_HDRLEN);
pppoe_ver = (pppoe_packet[0] & 0xF0) >> 4;
pppoe_type = (pppoe_packet[0] & 0x0F);
pppoe_code = pppoe_packet[1];
pppoe_sessionid = EXTRACT_16BITS(pppoe_packet + 2);
pppoe_length = EXTRACT_16BITS(pppoe_packet + 4);
pppoe_payload = pppoe_packet + PPPOE_HDRLEN;
if (pppoe_ver != 1) {
printf(" [ver %d]",pppoe_ver);
}
if (pppoe_type != 1) {
printf(" [type %d]",pppoe_type);
}
printf("PPPoE %s", tok2str(pppoecode2str, "PAD-%x", pppoe_code));
if (pppoe_code == PPPOE_PADI && pppoe_length > 1484 - PPPOE_HDRLEN) {
printf(" [len %u!]",pppoe_length);
}
if (pppoe_length > length) {
printf(" [len %u > %u!]", pppoe_length, length);
pppoe_length = length;
}
if (pppoe_sessionid) {
printf(" [ses 0x%x]", pppoe_sessionid);
}
if (pppoe_code) {
u_short tag_type = 0xffff, tag_len;
const u_char *p = pppoe_payload;
while (tag_type && p < pppoe_payload + pppoe_length) {
TCHECK2(*p, 4);
tag_type = EXTRACT_16BITS(p);
tag_len = EXTRACT_16BITS(p + 2);
p += 4;
if (tag_len) {
unsigned isascii = 0, isgarbage = 0;
const u_char *v = p;
char tag_str[MAXTAGPRINT];
unsigned tag_str_len = 0;
TCHECK2(*p, tag_len);
for (v = p; v < p + tag_len && tag_str_len < MAXTAGPRINT-1; v++)
if (*v >= 32 && *v < 127) {
tag_str[tag_str_len++] = *v;
isascii++;
} else {
tag_str[tag_str_len++] = '.';
isgarbage++;
}
tag_str[tag_str_len] = 0;
if (isascii > isgarbage) {
printf(" [%s \"%*.*s\"]",
tok2str(pppoetag2str, "TAG-0x%x", tag_type),
(int)tag_str_len,
(int)tag_str_len,
tag_str);
} else {
printf(" [%s 0x", tok2str(pppoetag2str, "TAG-0x%x", tag_type));
for (v=p; v<p+tag_len; v++) {
printf("%02X", *v);
}
printf("]");
}
} else
printf(" [%s]", tok2str(pppoetag2str,
"TAG-0x%x", tag_type));
p += tag_len;
}
return (0);
} else {
printf(" ");
return (PPPOE_HDRLEN + ppp_print(pppoe_payload, pppoe_length));
}
trunc:
printf("[|pppoe]");
return (PPPOE_HDRLEN);
}
