1 /* 2 * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997 3 * The Regents of the University of California. All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that: (1) source code distributions 7 * retain the above copyright notice and this paragraph in its entirety, (2) 8 * distributions including binary code include the above copyright notice and 9 * this paragraph in its entirety in the documentation or other materials 10 * provided with the distribution, and (3) all advertising materials mentioning 11 * features or use of this software display the following acknowledgement: 12 * ``This product includes software developed by the University of California, 13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of 14 * the University nor the names of its contributors may be used to endorse 15 * or promote products derived from this software without specific prior 16 * written permission. 17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED 18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF 19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 20 * 21 * Format and print AppleTalk packets. 22 * 23 * $FreeBSD$ 24 */ 25 26 #ifndef lint 27 static const char rcsid[] = 28 "@(#) $Header: /tcpdump/master/tcpdump/print-atalk.c,v 1.64 2000/10/30 06:22:14 guy Exp $ (LBL)"; 29 #endif 30 31 #ifdef HAVE_CONFIG_H 32 #include "config.h" 33 #endif 34 35 #include <sys/param.h> 36 #include <sys/time.h> 37 #include <sys/socket.h> 38 39 #include <netinet/in.h> 40 41 #include <stdio.h> 42 #include <stdlib.h> 43 #include <string.h> 44 #include <netdb.h> /* for MAXHOSTNAMELEN on some platforms */ 45 46 #include "interface.h" 47 #include "addrtoname.h" 48 #include "ethertype.h" 49 #include "extract.h" /* must come after interface.h */ 50 #include "appletalk.h" 51 #include "savestr.h" 52 53 static struct tok type2str[] = { 54 { ddpRTMP, "rtmp" }, 55 { ddpRTMPrequest, "rtmpReq" }, 56 { ddpECHO, "echo" }, 57 { ddpIP, "IP" }, 58 { ddpARP, "ARP" }, 59 { ddpKLAP, "KLAP" }, 60 { 0, NULL } 61 }; 62 63 struct aarp { 64 u_int16_t htype, ptype; 65 u_int8_t halen, palen; 66 u_int16_t op; 67 u_int8_t hsaddr[6]; 68 u_int8_t psaddr[4]; 69 u_int8_t hdaddr[6]; 70 u_int8_t pdaddr[4]; 71 }; 72 73 static char tstr[] = "[|atalk]"; 74 75 static void atp_print(const struct atATP *, u_int); 76 static void atp_bitmap_print(u_char); 77 static void nbp_print(const struct atNBP *, u_int, u_short, u_char, u_char); 78 static const char *print_cstring(const char *, const u_char *); 79 static const struct atNBPtuple *nbp_tuple_print(const struct atNBPtuple *, 80 const u_char *, 81 u_short, u_char, u_char); 82 static const struct atNBPtuple *nbp_name_print(const struct atNBPtuple *, 83 const u_char *); 84 static const char *ataddr_string(u_short, u_char); 85 static void ddp_print(const u_char *, u_int, int, u_short, u_char, u_char); 86 static const char *ddpskt_string(int); 87 88 /* 89 * Print AppleTalk LLAP packets. 90 */ 91 void 92 llap_print(register const u_char *bp, u_int length) 93 { 94 register const struct LAP *lp; 95 register const struct atDDP *dp; 96 register const struct atShortDDP *sdp; 97 u_short snet; 98 99 #if 0 100 lp = (struct LAP *)bp; 101 bp += sizeof(*lp); 102 length -= sizeof(*lp); 103 #else 104 { 105 static struct LAP lp_ = {0, 0, lapDDP}; 106 lp = &lp_; 107 } 108 #endif 109 switch (lp->type) { 110 111 case lapShortDDP: 112 if (length < ddpSSize) { 113 (void)printf(" [|sddp %d]", length); 114 return; 115 } 116 sdp = (const struct atShortDDP *)bp; 117 printf("%s.%s", 118 ataddr_string(0, lp->src), ddpskt_string(sdp->srcSkt)); 119 printf(" > %s.%s:", 120 ataddr_string(0, lp->dst), ddpskt_string(sdp->dstSkt)); 121 bp += ddpSSize; 122 length -= ddpSSize; 123 ddp_print(bp, length, sdp->type, 0, lp->src, sdp->srcSkt); 124 break; 125 126 case lapDDP: 127 if (length < ddpSize) { 128 (void)printf(" [|ddp %d]", length); 129 return; 130 } 131 dp = (const struct atDDP *)bp; 132 snet = EXTRACT_16BITS(&dp->srcNet); 133 printf("%s.%s", ataddr_string(snet, dp->srcNode), 134 ddpskt_string(dp->srcSkt)); 135 printf(" > %s.%s:", 136 ataddr_string(EXTRACT_16BITS(&dp->dstNet), dp->dstNode), 137 ddpskt_string(dp->dstSkt)); 138 bp += ddpSize; 139 length -= ddpSize; 140 ddp_print(bp, length, dp->type, snet, dp->srcNode, dp->srcSkt); 141 break; 142 143 #ifdef notdef 144 case lapKLAP: 145 klap_print(bp, length); 146 break; 147 #endif 148 149 default: 150 printf("%d > %d at-lap#%d %d", 151 lp->src, lp->dst, lp->type, length); 152 break; 153 } 154 } 155 156 /* 157 * Print EtherTalk/TokenTalk packets (or FDDITalk, or whatever it's called 158 * when it runs over FDDI; yes, I've seen FDDI captures with AppleTalk 159 * packets in them). 160 */ 161 void 162 atalk_print(register const u_char *bp, u_int length) 163 { 164 register const struct atDDP *dp; 165 u_short snet; 166 167 if (length < ddpSize) { 168 (void)printf(" [|ddp %d]", length); 169 return; 170 } 171 dp = (const struct atDDP *)bp; 172 snet = EXTRACT_16BITS(&dp->srcNet); 173 printf("%s.%s", ataddr_string(snet, dp->srcNode), 174 ddpskt_string(dp->srcSkt)); 175 printf(" > %s.%s:", 176 ataddr_string(EXTRACT_16BITS(&dp->dstNet), dp->dstNode), 177 ddpskt_string(dp->dstSkt)); 178 bp += ddpSize; 179 length -= ddpSize; 180 ddp_print(bp, length, dp->type, snet, dp->srcNode, dp->srcSkt); 181 } 182 183 /* XXX should probably pass in the snap header and do checks like arp_print() */ 184 void 185 aarp_print(register const u_char *bp, u_int length) 186 { 187 register const struct aarp *ap; 188 189 #define AT(member) ataddr_string((ap->member[1]<<8)|ap->member[2],ap->member[3]) 190 191 printf("aarp "); 192 ap = (const struct aarp *)bp; 193 if (ntohs(ap->htype) == 1 && ntohs(ap->ptype) == ETHERTYPE_ATALK && 194 ap->halen == 6 && ap->palen == 4 ) 195 switch (ntohs(ap->op)) { 196 197 case 1: /* request */ 198 (void)printf("who-has %s tell %s", 199 AT(pdaddr), AT(psaddr)); 200 return; 201 202 case 2: /* response */ 203 (void)printf("reply %s is-at %s", 204 AT(psaddr), etheraddr_string(ap->hsaddr)); 205 return; 206 207 case 3: /* probe (oy!) */ 208 (void)printf("probe %s tell %s", 209 AT(pdaddr), AT(psaddr)); 210 return; 211 } 212 (void)printf("len %u op %u htype %u ptype %#x halen %u palen %u", 213 length, ntohs(ap->op), ntohs(ap->htype), ntohs(ap->ptype), 214 ap->halen, ap->palen); 215 } 216 217 /* 218 * Print AppleTalk Datagram Delivery Protocol packets. 219 */ 220 static void 221 ddp_print(register const u_char *bp, register u_int length, register int t, 222 register u_short snet, register u_char snode, u_char skt) 223 { 224 225 switch (t) { 226 227 case ddpNBP: 228 nbp_print((const struct atNBP *)bp, length, snet, snode, skt); 229 break; 230 231 case ddpATP: 232 atp_print((const struct atATP *)bp, length); 233 break; 234 235 default: 236 (void)printf(" at-%s %d", tok2str(type2str, NULL, t), length); 237 break; 238 } 239 } 240 241 static void 242 atp_print(register const struct atATP *ap, u_int length) 243 { 244 char c; 245 u_int32_t data; 246 247 if ((const u_char *)(ap + 1) > snapend) { 248 /* Just bail if we don't have the whole chunk. */ 249 fputs(tstr, stdout); 250 return; 251 } 252 length -= sizeof(*ap); 253 switch (ap->control & 0xc0) { 254 255 case atpReqCode: 256 (void)printf(" atp-req%s %d", 257 ap->control & atpXO? " " : "*", 258 EXTRACT_16BITS(&ap->transID)); 259 260 atp_bitmap_print(ap->bitmap); 261 262 if (length != 0) 263 (void)printf(" [len=%d]", length); 264 265 switch (ap->control & (atpEOM|atpSTS)) { 266 case atpEOM: 267 (void)printf(" [EOM]"); 268 break; 269 case atpSTS: 270 (void)printf(" [STS]"); 271 break; 272 case atpEOM|atpSTS: 273 (void)printf(" [EOM,STS]"); 274 break; 275 } 276 break; 277 278 case atpRspCode: 279 (void)printf(" atp-resp%s%d:%d (%d)", 280 ap->control & atpEOM? "*" : " ", 281 EXTRACT_16BITS(&ap->transID), ap->bitmap, length); 282 switch (ap->control & (atpXO|atpSTS)) { 283 case atpXO: 284 (void)printf(" [XO]"); 285 break; 286 case atpSTS: 287 (void)printf(" [STS]"); 288 break; 289 case atpXO|atpSTS: 290 (void)printf(" [XO,STS]"); 291 break; 292 } 293 break; 294 295 case atpRelCode: 296 (void)printf(" atp-rel %d", EXTRACT_16BITS(&ap->transID)); 297 298 atp_bitmap_print(ap->bitmap); 299 300 /* length should be zero */ 301 if (length) 302 (void)printf(" [len=%d]", length); 303 304 /* there shouldn't be any control flags */ 305 if (ap->control & (atpXO|atpEOM|atpSTS)) { 306 c = '['; 307 if (ap->control & atpXO) { 308 (void)printf("%cXO", c); 309 c = ','; 310 } 311 if (ap->control & atpEOM) { 312 (void)printf("%cEOM", c); 313 c = ','; 314 } 315 if (ap->control & atpSTS) { 316 (void)printf("%cSTS", c); 317 c = ','; 318 } 319 (void)printf("]"); 320 } 321 break; 322 323 default: 324 (void)printf(" atp-0x%x %d (%d)", ap->control, 325 EXTRACT_16BITS(&ap->transID), length); 326 break; 327 } 328 data = EXTRACT_32BITS(&ap->userData); 329 if (data != 0) 330 (void)printf(" 0x%x", data); 331 } 332 333 static void 334 atp_bitmap_print(register u_char bm) 335 { 336 register char c; 337 register int i; 338 339 /* 340 * The '& 0xff' below is needed for compilers that want to sign 341 * extend a u_char, which is the case with the Ultrix compiler. 342 * (gcc is smart enough to eliminate it, at least on the Sparc). 343 */ 344 if ((bm + 1) & (bm & 0xff)) { 345 c = '<'; 346 for (i = 0; bm; ++i) { 347 if (bm & 1) { 348 (void)printf("%c%d", c, i); 349 c = ','; 350 } 351 bm >>= 1; 352 } 353 (void)printf(">"); 354 } else { 355 for (i = 0; bm; ++i) 356 bm >>= 1; 357 if (i > 1) 358 (void)printf("<0-%d>", i - 1); 359 else 360 (void)printf("<0>"); 361 } 362 } 363 364 static void 365 nbp_print(register const struct atNBP *np, u_int length, register u_short snet, 366 register u_char snode, register u_char skt) 367 { 368 register const struct atNBPtuple *tp = 369 (struct atNBPtuple *)((u_char *)np + nbpHeaderSize); 370 int i; 371 const u_char *ep; 372 373 length -= nbpHeaderSize; 374 if (length < 8) { 375 /* must be room for at least one tuple */ 376 (void)printf(" truncated-nbp %d", length + nbpHeaderSize); 377 return; 378 } 379 /* ep points to end of available data */ 380 ep = snapend; 381 if ((const u_char *)tp > ep) { 382 fputs(tstr, stdout); 383 return; 384 } 385 switch (i = np->control & 0xf0) { 386 387 case nbpBrRq: 388 case nbpLkUp: 389 (void)printf(i == nbpLkUp? " nbp-lkup %d:":" nbp-brRq %d:", 390 np->id); 391 if ((const u_char *)(tp + 1) > ep) { 392 fputs(tstr, stdout); 393 return; 394 } 395 (void)nbp_name_print(tp, ep); 396 /* 397 * look for anomalies: the spec says there can only 398 * be one tuple, the address must match the source 399 * address and the enumerator should be zero. 400 */ 401 if ((np->control & 0xf) != 1) 402 (void)printf(" [ntup=%d]", np->control & 0xf); 403 if (tp->enumerator) 404 (void)printf(" [enum=%d]", tp->enumerator); 405 if (EXTRACT_16BITS(&tp->net) != snet || 406 tp->node != snode || tp->skt != skt) 407 (void)printf(" [addr=%s.%d]", 408 ataddr_string(EXTRACT_16BITS(&tp->net), 409 tp->node), tp->skt); 410 break; 411 412 case nbpLkUpReply: 413 (void)printf(" nbp-reply %d:", np->id); 414 415 /* print each of the tuples in the reply */ 416 for (i = np->control & 0xf; --i >= 0 && tp; ) 417 tp = nbp_tuple_print(tp, ep, snet, snode, skt); 418 break; 419 420 default: 421 (void)printf(" nbp-0x%x %d (%d)", np->control, np->id, 422 length); 423 break; 424 } 425 } 426 427 /* print a counted string */ 428 static const char * 429 print_cstring(register const char *cp, register const u_char *ep) 430 { 431 register u_int length; 432 433 if (cp >= (const char *)ep) { 434 fputs(tstr, stdout); 435 return (0); 436 } 437 length = *cp++; 438 439 /* Spec says string can be at most 32 bytes long */ 440 if (length > 32) { 441 (void)printf("[len=%u]", length); 442 return (0); 443 } 444 while ((int)--length >= 0) { 445 if (cp >= (char *)ep) { 446 fputs(tstr, stdout); 447 return (0); 448 } 449 putchar(*cp++); 450 } 451 return (cp); 452 } 453 454 static const struct atNBPtuple * 455 nbp_tuple_print(register const struct atNBPtuple *tp, 456 register const u_char *ep, 457 register u_short snet, register u_char snode, 458 register u_char skt) 459 { 460 register const struct atNBPtuple *tpn; 461 462 if ((const u_char *)(tp + 1) > ep) { 463 fputs(tstr, stdout); 464 return 0; 465 } 466 tpn = nbp_name_print(tp, ep); 467 468 /* if the enumerator isn't 1, print it */ 469 if (tp->enumerator != 1) 470 (void)printf("(%d)", tp->enumerator); 471 472 /* if the socket doesn't match the src socket, print it */ 473 if (tp->skt != skt) 474 (void)printf(" %d", tp->skt); 475 476 /* if the address doesn't match the src address, it's an anomaly */ 477 if (EXTRACT_16BITS(&tp->net) != snet || tp->node != snode) 478 (void)printf(" [addr=%s]", 479 ataddr_string(EXTRACT_16BITS(&tp->net), tp->node)); 480 481 return (tpn); 482 } 483 484 static const struct atNBPtuple * 485 nbp_name_print(const struct atNBPtuple *tp, register const u_char *ep) 486 { 487 register const char *cp = (const char *)tp + nbpTupleSize; 488 489 putchar(' '); 490 491 /* Object */ 492 putchar('"'); 493 if ((cp = print_cstring(cp, ep)) != NULL) { 494 /* Type */ 495 putchar(':'); 496 if ((cp = print_cstring(cp, ep)) != NULL) { 497 /* Zone */ 498 putchar('@'); 499 if ((cp = print_cstring(cp, ep)) != NULL) 500 putchar('"'); 501 } 502 } 503 return ((const struct atNBPtuple *)cp); 504 } 505 506 507 #define HASHNAMESIZE 4096 508 509 struct hnamemem { 510 int addr; 511 char *name; 512 struct hnamemem *nxt; 513 }; 514 515 static struct hnamemem hnametable[HASHNAMESIZE]; 516 517 static const char * 518 ataddr_string(u_short atnet, u_char athost) 519 { 520 register struct hnamemem *tp, *tp2; 521 register int i = (atnet << 8) | athost; 522 char nambuf[MAXHOSTNAMELEN + 20]; 523 static int first = 1; 524 FILE *fp; 525 526 /* 527 * if this is the first call, see if there's an AppleTalk 528 * number to name map file. 529 */ 530 if (first && (first = 0, !nflag) 531 && (fp = fopen("/etc/atalk.names", "r"))) { 532 char line[256]; 533 int i1, i2, i3; 534 535 while (fgets(line, sizeof(line), fp)) { 536 if (line[0] == '\n' || line[0] == 0 || line[0] == '#') 537 continue; 538 if (sscanf(line, "%d.%d.%d %256s", &i1, &i2, &i3, 539 nambuf) == 4) 540 /* got a hostname. */ 541 i3 |= ((i1 << 8) | i2) << 8; 542 else if (sscanf(line, "%d.%d %256s", &i1, &i2, 543 nambuf) == 3) 544 /* got a net name */ 545 i3 = (((i1 << 8) | i2) << 8) | 255; 546 else 547 continue; 548 549 for (tp = &hnametable[i2 & (HASHNAMESIZE-1)]; 550 tp->nxt; tp = tp->nxt) 551 ; 552 tp->addr = i2; 553 tp->nxt = newhnamemem(); 554 tp->name = savestr(nambuf); 555 } 556 fclose(fp); 557 } 558 559 for (tp = &hnametable[i & (HASHNAMESIZE-1)]; tp->nxt; tp = tp->nxt) 560 if (tp->addr == i) 561 return (tp->name); 562 563 /* didn't have the node name -- see if we've got the net name */ 564 i |= 255; 565 for (tp2 = &hnametable[i & (HASHNAMESIZE-1)]; tp2->nxt; tp2 = tp2->nxt) 566 if (tp2->addr == i) { 567 tp->addr = (atnet << 8) | athost; 568 tp->nxt = newhnamemem(); 569 (void)snprintf(nambuf, sizeof(nambuf), "%s.%d", 570 tp2->name, athost); 571 tp->name = savestr(nambuf); 572 return (tp->name); 573 } 574 575 tp->addr = (atnet << 8) | athost; 576 tp->nxt = newhnamemem(); 577 if (athost != 255) 578 (void)snprintf(nambuf, sizeof(nambuf), "%d.%d.%d", 579 atnet >> 8, atnet & 0xff, athost); 580 else 581 (void)snprintf(nambuf, sizeof(nambuf), "%d.%d", atnet >> 8, 582 atnet & 0xff); 583 tp->name = savestr(nambuf); 584 585 return (tp->name); 586 } 587 588 static struct tok skt2str[] = { 589 { rtmpSkt, "rtmp" }, /* routing table maintenance */ 590 { nbpSkt, "nis" }, /* name info socket */ 591 { echoSkt, "echo" }, /* AppleTalk echo protocol */ 592 { zipSkt, "zip" }, /* zone info protocol */ 593 { 0, NULL } 594 }; 595 596 static const char * 597 ddpskt_string(register int skt) 598 { 599 static char buf[8]; 600 601 if (nflag) { 602 (void)snprintf(buf, sizeof(buf), "%d", skt); 603 return (buf); 604 } 605 return (tok2str(skt2str, "%d", skt)); 606 } 607