1 /* 2 * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997 3 * The Regents of the University of California. All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that: (1) source code distributions 7 * retain the above copyright notice and this paragraph in its entirety, (2) 8 * distributions including binary code include the above copyright notice and 9 * this paragraph in its entirety in the documentation or other materials 10 * provided with the distribution, and (3) all advertising materials mentioning 11 * features or use of this software display the following acknowledgement: 12 * ``This product includes software developed by the University of California, 13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of 14 * the University nor the names of its contributors may be used to endorse 15 * or promote products derived from this software without specific prior 16 * written permission. 17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED 18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF 19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 20 */ 21 22 /* \summary: Address Resolution Protocol (ARP) printer */ 23 24 #include <config.h> 25 26 #include "netdissect-stdinc.h" 27 28 #define ND_LONGJMP_FROM_TCHECK 29 #include "netdissect.h" 30 #include "addrtoname.h" 31 #include "ethertype.h" 32 #include "extract.h" 33 34 35 /* 36 * Address Resolution Protocol. 37 * 38 * See RFC 826 for protocol description. ARP packets are variable 39 * in size; the arphdr structure defines the fixed-length portion. 40 * Protocol type values are the same as those for 10 Mb/s Ethernet. 41 * It is followed by the variable-sized fields ar_sha, arp_spa, 42 * arp_tha and arp_tpa in that order, according to the lengths 43 * specified. Field names used correspond to RFC 826. 44 */ 45 struct arp_pkthdr { 46 nd_uint16_t ar_hrd; /* format of hardware address */ 47 #define ARPHRD_ETHER 1 /* ethernet hardware format */ 48 #define ARPHRD_IEEE802 6 /* token-ring hardware format */ 49 #define ARPHRD_ARCNET 7 /* arcnet hardware format */ 50 #define ARPHRD_FRELAY 15 /* frame relay hardware format */ 51 #define ARPHRD_ATM2225 19 /* ATM (RFC 2225) */ 52 #define ARPHRD_STRIP 23 /* Ricochet Starmode Radio hardware format */ 53 #define ARPHRD_IEEE1394 24 /* IEEE 1394 (FireWire) hardware format */ 54 #define ARPHRD_INFINIBAND 32 /* InfiniBand RFC 4391 */ 55 nd_uint16_t ar_pro; /* format of protocol address */ 56 nd_uint8_t ar_hln; /* length of hardware address */ 57 nd_uint8_t ar_pln; /* length of protocol address */ 58 nd_uint16_t ar_op; /* one of: */ 59 #define ARPOP_REQUEST 1 /* request to resolve address */ 60 #define ARPOP_REPLY 2 /* response to previous request */ 61 #define ARPOP_REVREQUEST 3 /* request protocol address given hardware */ 62 #define ARPOP_REVREPLY 4 /* response giving protocol address */ 63 #define ARPOP_INVREQUEST 8 /* request to identify peer */ 64 #define ARPOP_INVREPLY 9 /* response identifying peer */ 65 #define ARPOP_NAK 10 /* NAK - only valid for ATM ARP */ 66 67 /* 68 * The remaining fields are variable in size, 69 * according to the sizes above. 70 */ 71 #ifdef COMMENT_ONLY 72 nd_byte ar_sha[]; /* sender hardware address */ 73 nd_byte ar_spa[]; /* sender protocol address */ 74 nd_byte ar_tha[]; /* target hardware address */ 75 nd_byte ar_tpa[]; /* target protocol address */ 76 #endif 77 #define ar_sha(ap) (((const u_char *)((ap)+1))+ 0) 78 #define ar_spa(ap) (((const u_char *)((ap)+1))+ GET_U_1((ap)->ar_hln)) 79 #define ar_tha(ap) (((const u_char *)((ap)+1))+ GET_U_1((ap)->ar_hln)+GET_U_1((ap)->ar_pln)) 80 #define ar_tpa(ap) (((const u_char *)((ap)+1))+2*GET_U_1((ap)->ar_hln)+GET_U_1((ap)->ar_pln)) 81 }; 82 83 #define ARP_HDRLEN 8 84 85 #define HRD(ap) GET_BE_U_2((ap)->ar_hrd) 86 #define HRD_LEN(ap) GET_U_1((ap)->ar_hln) 87 #define PROTO_LEN(ap) GET_U_1((ap)->ar_pln) 88 #define OP(ap) GET_BE_U_2((ap)->ar_op) 89 #define PRO(ap) GET_BE_U_2((ap)->ar_pro) 90 #define SHA(ap) (ar_sha(ap)) 91 #define SPA(ap) (ar_spa(ap)) 92 #define THA(ap) (ar_tha(ap)) 93 #define TPA(ap) (ar_tpa(ap)) 94 95 96 static const struct tok arpop_values[] = { 97 { ARPOP_REQUEST, "Request" }, 98 { ARPOP_REPLY, "Reply" }, 99 { ARPOP_REVREQUEST, "Reverse Request" }, 100 { ARPOP_REVREPLY, "Reverse Reply" }, 101 { ARPOP_INVREQUEST, "Inverse Request" }, 102 { ARPOP_INVREPLY, "Inverse Reply" }, 103 { ARPOP_NAK, "NACK Reply" }, 104 { 0, NULL } 105 }; 106 107 static const struct tok arphrd_values[] = { 108 { ARPHRD_ETHER, "Ethernet" }, 109 { ARPHRD_IEEE802, "TokenRing" }, 110 { ARPHRD_ARCNET, "ArcNet" }, 111 { ARPHRD_FRELAY, "FrameRelay" }, 112 { ARPHRD_STRIP, "Strip" }, 113 { ARPHRD_IEEE1394, "IEEE 1394" }, 114 { ARPHRD_ATM2225, "ATM" }, 115 { ARPHRD_INFINIBAND, "InfiniBand" }, 116 { 0, NULL } 117 }; 118 119 /* 120 * ATM Address Resolution Protocol. 121 * 122 * See RFC 2225 for protocol description. ATMARP packets are similar 123 * to ARP packets, except that there are no length fields for the 124 * protocol address - instead, there are type/length fields for 125 * the ATM number and subaddress - and the hardware addresses consist 126 * of an ATM number and an ATM subaddress. 127 */ 128 struct atmarp_pkthdr { 129 nd_uint16_t aar_hrd; /* format of hardware address */ 130 nd_uint16_t aar_pro; /* format of protocol address */ 131 nd_uint8_t aar_shtl; /* length of source ATM number */ 132 nd_uint8_t aar_sstl; /* length of source ATM subaddress */ 133 #define ATMARP_IS_E164 0x40 /* bit in type/length for E.164 format */ 134 #define ATMARP_LEN_MASK 0x3F /* length of {sub}address in type/length */ 135 nd_uint16_t aar_op; /* same as regular ARP */ 136 nd_uint8_t aar_spln; /* length of source protocol address */ 137 nd_uint8_t aar_thtl; /* length of target ATM number */ 138 nd_uint8_t aar_tstl; /* length of target ATM subaddress */ 139 nd_uint8_t aar_tpln; /* length of target protocol address */ 140 /* 141 * The remaining fields are variable in size, 142 * according to the sizes above. 143 */ 144 #ifdef COMMENT_ONLY 145 nd_byte aar_sha[]; /* source ATM number */ 146 nd_byte aar_ssa[]; /* source ATM subaddress */ 147 nd_byte aar_spa[]; /* sender protocol address */ 148 nd_byte aar_tha[]; /* target ATM number */ 149 nd_byte aar_tsa[]; /* target ATM subaddress */ 150 nd_byte aar_tpa[]; /* target protocol address */ 151 #endif 152 153 #define ATMHRD(ap) GET_BE_U_2((ap)->aar_hrd) 154 #define ATMSHRD_LEN(ap) (GET_U_1((ap)->aar_shtl) & ATMARP_LEN_MASK) 155 #define ATMSSLN(ap) (GET_U_1((ap)->aar_sstl) & ATMARP_LEN_MASK) 156 #define ATMSPROTO_LEN(ap) GET_U_1((ap)->aar_spln) 157 #define ATMOP(ap) GET_BE_U_2((ap)->aar_op) 158 #define ATMPRO(ap) GET_BE_U_2((ap)->aar_pro) 159 #define ATMTHRD_LEN(ap) (GET_U_1((ap)->aar_thtl) & ATMARP_LEN_MASK) 160 #define ATMTSLN(ap) (GET_U_1((ap)->aar_tstl) & ATMARP_LEN_MASK) 161 #define ATMTPROTO_LEN(ap) GET_U_1((ap)->aar_tpln) 162 #define aar_sha(ap) ((const u_char *)((ap)+1)) 163 #define aar_ssa(ap) (aar_sha(ap) + ATMSHRD_LEN(ap)) 164 #define aar_spa(ap) (aar_ssa(ap) + ATMSSLN(ap)) 165 #define aar_tha(ap) (aar_spa(ap) + ATMSPROTO_LEN(ap)) 166 #define aar_tsa(ap) (aar_tha(ap) + ATMTHRD_LEN(ap)) 167 #define aar_tpa(ap) (aar_tsa(ap) + ATMTSLN(ap)) 168 }; 169 170 #define ATMSHA(ap) (aar_sha(ap)) 171 #define ATMSSA(ap) (aar_ssa(ap)) 172 #define ATMSPA(ap) (aar_spa(ap)) 173 #define ATMTHA(ap) (aar_tha(ap)) 174 #define ATMTSA(ap) (aar_tsa(ap)) 175 #define ATMTPA(ap) (aar_tpa(ap)) 176 177 static int 178 isnonzero(netdissect_options *ndo, const u_char *a, size_t len) 179 { 180 while (len > 0) { 181 if (GET_U_1(a) != 0) 182 return (1); 183 a++; 184 len--; 185 } 186 return (0); 187 } 188 189 static void 190 tpaddr_print_ip(netdissect_options *ndo, 191 const struct arp_pkthdr *ap, u_short pro) 192 { 193 if (pro != ETHERTYPE_IP && pro != ETHERTYPE_TRAIL) 194 ND_PRINT("<wrong proto type>"); 195 else if (PROTO_LEN(ap) != 4) 196 ND_PRINT("<wrong len>"); 197 else 198 ND_PRINT("%s", GET_IPADDR_STRING(TPA(ap))); 199 } 200 201 static void 202 spaddr_print_ip(netdissect_options *ndo, 203 const struct arp_pkthdr *ap, u_short pro) 204 { 205 if (pro != ETHERTYPE_IP && pro != ETHERTYPE_TRAIL) 206 ND_PRINT("<wrong proto type>"); 207 else if (PROTO_LEN(ap) != 4) 208 ND_PRINT("<wrong len>"); 209 else 210 ND_PRINT("%s", GET_IPADDR_STRING(SPA(ap))); 211 } 212 213 static void 214 atmarp_addr_print(netdissect_options *ndo, 215 const u_char *ha, u_int ha_len, const u_char *srca, 216 u_int srca_len) 217 { 218 if (ha_len == 0) 219 ND_PRINT("<No address>"); 220 else { 221 ND_PRINT("%s", GET_LINKADDR_STRING(ha, LINKADDR_ATM, ha_len)); 222 if (srca_len != 0) 223 ND_PRINT(",%s", 224 GET_LINKADDR_STRING(srca, LINKADDR_ATM, srca_len)); 225 } 226 } 227 228 static void 229 atmarp_tpaddr_print(netdissect_options *ndo, 230 const struct atmarp_pkthdr *ap, u_short pro) 231 { 232 if (pro != ETHERTYPE_IP && pro != ETHERTYPE_TRAIL) 233 ND_PRINT("<wrong proto type>"); 234 else if (ATMTPROTO_LEN(ap) != 4) 235 ND_PRINT("<wrong tplen>"); 236 else 237 ND_PRINT("%s", GET_IPADDR_STRING(ATMTPA(ap))); 238 } 239 240 static void 241 atmarp_spaddr_print(netdissect_options *ndo, 242 const struct atmarp_pkthdr *ap, u_short pro) 243 { 244 if (pro != ETHERTYPE_IP && pro != ETHERTYPE_TRAIL) 245 ND_PRINT("<wrong proto type>"); 246 else if (ATMSPROTO_LEN(ap) != 4) 247 ND_PRINT("<wrong splen>"); 248 else 249 ND_PRINT("%s", GET_IPADDR_STRING(ATMSPA(ap))); 250 } 251 252 static void 253 atmarp_print(netdissect_options *ndo, 254 const u_char *bp, u_int length, u_int caplen) 255 { 256 const struct atmarp_pkthdr *ap; 257 u_short pro, hrd, op; 258 259 ap = (const struct atmarp_pkthdr *)bp; 260 ND_TCHECK_SIZE(ap); 261 262 hrd = ATMHRD(ap); 263 pro = ATMPRO(ap); 264 op = ATMOP(ap); 265 266 ND_TCHECK_LEN(ATMTPA(ap), ATMTPROTO_LEN(ap)); 267 268 if (!ndo->ndo_eflag) { 269 ND_PRINT("ARP, "); 270 } 271 272 if ((pro != ETHERTYPE_IP && pro != ETHERTYPE_TRAIL) || 273 ATMSPROTO_LEN(ap) != 4 || 274 ATMTPROTO_LEN(ap) != 4 || 275 ndo->ndo_vflag) { 276 ND_PRINT("%s, %s (len %u/%u)", 277 tok2str(arphrd_values, "Unknown Hardware (%u)", hrd), 278 tok2str(ethertype_values, "Unknown Protocol (0x%04x)", pro), 279 ATMSPROTO_LEN(ap), 280 ATMTPROTO_LEN(ap)); 281 282 /* don't know about the address formats */ 283 if (!ndo->ndo_vflag) { 284 goto out; 285 } 286 } 287 288 /* print operation */ 289 ND_PRINT("%s%s ", 290 ndo->ndo_vflag ? ", " : "", 291 tok2str(arpop_values, "Unknown (%u)", op)); 292 293 switch (op) { 294 295 case ARPOP_REQUEST: 296 ND_PRINT("who-has "); 297 atmarp_tpaddr_print(ndo, ap, pro); 298 if (ATMTHRD_LEN(ap) != 0) { 299 ND_PRINT(" ("); 300 atmarp_addr_print(ndo, ATMTHA(ap), ATMTHRD_LEN(ap), 301 ATMTSA(ap), ATMTSLN(ap)); 302 ND_PRINT(")"); 303 } 304 ND_PRINT(" tell "); 305 atmarp_spaddr_print(ndo, ap, pro); 306 break; 307 308 case ARPOP_REPLY: 309 atmarp_spaddr_print(ndo, ap, pro); 310 ND_PRINT(" is-at "); 311 atmarp_addr_print(ndo, ATMSHA(ap), ATMSHRD_LEN(ap), ATMSSA(ap), 312 ATMSSLN(ap)); 313 break; 314 315 case ARPOP_INVREQUEST: 316 ND_PRINT("who-is "); 317 atmarp_addr_print(ndo, ATMTHA(ap), ATMTHRD_LEN(ap), ATMTSA(ap), 318 ATMTSLN(ap)); 319 ND_PRINT(" tell "); 320 atmarp_addr_print(ndo, ATMSHA(ap), ATMSHRD_LEN(ap), ATMSSA(ap), 321 ATMSSLN(ap)); 322 break; 323 324 case ARPOP_INVREPLY: 325 atmarp_addr_print(ndo, ATMSHA(ap), ATMSHRD_LEN(ap), ATMSSA(ap), 326 ATMSSLN(ap)); 327 ND_PRINT("at "); 328 atmarp_spaddr_print(ndo, ap, pro); 329 break; 330 331 case ARPOP_NAK: 332 ND_PRINT("for "); 333 atmarp_spaddr_print(ndo, ap, pro); 334 break; 335 336 default: 337 ND_DEFAULTPRINT((const u_char *)ap, caplen); 338 return; 339 } 340 341 out: 342 ND_PRINT(", length %u", length); 343 } 344 345 void 346 arp_print(netdissect_options *ndo, 347 const u_char *bp, u_int length, u_int caplen) 348 { 349 const struct arp_pkthdr *ap; 350 u_short pro, hrd, op, linkaddr; 351 352 ndo->ndo_protocol = "arp"; 353 ap = (const struct arp_pkthdr *)bp; 354 ND_TCHECK_SIZE(ap); 355 356 hrd = HRD(ap); 357 pro = PRO(ap); 358 op = OP(ap); 359 360 361 /* if its ATM then call the ATM ARP printer 362 for Frame-relay ARP most of the fields 363 are similar to Ethernet so overload the Ethernet Printer 364 and set the linkaddr type for GET_LINKADDR_STRING() accordingly */ 365 366 switch(hrd) { 367 case ARPHRD_ATM2225: 368 atmarp_print(ndo, bp, length, caplen); 369 return; 370 case ARPHRD_FRELAY: 371 linkaddr = LINKADDR_FRELAY; 372 break; 373 default: 374 linkaddr = LINKADDR_ETHER; 375 break; 376 } 377 378 ND_TCHECK_LEN(TPA(ap), PROTO_LEN(ap)); 379 380 if (!ndo->ndo_eflag) { 381 ND_PRINT("ARP, "); 382 } 383 384 /* print hardware type/len and proto type/len */ 385 if ((pro != ETHERTYPE_IP && pro != ETHERTYPE_TRAIL) || 386 PROTO_LEN(ap) != 4 || 387 HRD_LEN(ap) == 0 || 388 ndo->ndo_vflag) { 389 ND_PRINT("%s (len %u), %s (len %u)", 390 tok2str(arphrd_values, "Unknown Hardware (%u)", hrd), 391 HRD_LEN(ap), 392 tok2str(ethertype_values, "Unknown Protocol (0x%04x)", pro), 393 PROTO_LEN(ap)); 394 395 /* don't know about the address formats */ 396 if (!ndo->ndo_vflag) { 397 goto out; 398 } 399 } 400 401 /* print operation */ 402 ND_PRINT("%s%s ", 403 ndo->ndo_vflag ? ", " : "", 404 tok2str(arpop_values, "Unknown (%u)", op)); 405 406 switch (op) { 407 408 case ARPOP_REQUEST: 409 ND_PRINT("who-has "); 410 tpaddr_print_ip(ndo, ap, pro); 411 if (isnonzero(ndo, (const u_char *)THA(ap), HRD_LEN(ap))) 412 ND_PRINT(" (%s)", 413 GET_LINKADDR_STRING(THA(ap), linkaddr, HRD_LEN(ap))); 414 ND_PRINT(" tell "); 415 spaddr_print_ip(ndo, ap, pro); 416 break; 417 418 case ARPOP_REPLY: 419 spaddr_print_ip(ndo, ap, pro); 420 ND_PRINT(" is-at %s", 421 GET_LINKADDR_STRING(SHA(ap), linkaddr, HRD_LEN(ap))); 422 break; 423 424 case ARPOP_REVREQUEST: 425 /* 426 * XXX - GET_LINKADDR_STRING() may return a pointer to 427 * a static buffer, so we only have one call to it per 428 * ND_PRINT() call. 429 * 430 * This should be done in a cleaner fashion. 431 */ 432 ND_PRINT("who-is %s", 433 GET_LINKADDR_STRING(THA(ap), linkaddr, HRD_LEN(ap))); 434 ND_PRINT(" tell %s", 435 GET_LINKADDR_STRING(SHA(ap), linkaddr, HRD_LEN(ap))); 436 break; 437 438 case ARPOP_REVREPLY: 439 ND_PRINT("%s at ", 440 GET_LINKADDR_STRING(THA(ap), linkaddr, HRD_LEN(ap))); 441 tpaddr_print_ip(ndo, ap, pro); 442 break; 443 444 case ARPOP_INVREQUEST: 445 /* 446 * XXX - GET_LINKADDR_STRING() may return a pointer to 447 * a static buffer, so we only have one call to it per 448 * ND_PRINT() call. 449 * 450 * This should be done in a cleaner fashion. 451 */ 452 ND_PRINT("who-is %s", 453 GET_LINKADDR_STRING(THA(ap), linkaddr, HRD_LEN(ap))); 454 ND_PRINT(" tell %s", 455 GET_LINKADDR_STRING(SHA(ap), linkaddr, HRD_LEN(ap))); 456 break; 457 458 case ARPOP_INVREPLY: 459 ND_PRINT("%s at ", 460 GET_LINKADDR_STRING(SHA(ap), linkaddr, HRD_LEN(ap))); 461 spaddr_print_ip(ndo, ap, pro); 462 break; 463 464 default: 465 ND_DEFAULTPRINT((const u_char *)ap, caplen); 466 return; 467 } 468 469 out: 470 ND_PRINT(", length %u", length); 471 } 472