1 /* 2 * Copyright (c) 1990, 1991, 1993, 1994, 1995, 1996, 1997 3 * The Regents of the University of California. All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that: (1) source code distributions 7 * retain the above copyright notice and this paragraph in its entirety, (2) 8 * distributions including binary code include the above copyright notice and 9 * this paragraph in its entirety in the documentation or other materials 10 * provided with the distribution, and (3) all advertising materials mentioning 11 * features or use of this software display the following acknowledgement: 12 * ``This product includes software developed by the University of California, 13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of 14 * the University nor the names of its contributors may be used to endorse 15 * or promote products derived from this software without specific prior 16 * written permission. 17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED 18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF 19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 20 */ 21 22 /* \summary: PPP Van Jacobson compression printer */ 23 24 /* specification: RFC 1144 */ 25 26 #ifdef HAVE_CONFIG_H 27 #include <config.h> 28 #endif 29 30 #include "netdissect-stdinc.h" 31 32 #include "netdissect.h" 33 #include "extract.h" 34 #include "slcompress.h" 35 #include "ppp.h" 36 37 /* 38 * XXX - for BSD/OS PPP, what packets get supplied with a PPP header type 39 * of PPP_VJC and what packets get supplied with a PPP header type of 40 * PPP_VJNC? PPP_VJNC is for "UNCOMPRESSED_TCP" packets, and PPP_VJC 41 * is for COMPRESSED_TCP packets (PPP_IP is used for TYPE_IP packets). 42 * 43 * RFC 1144 implies that, on the wire, the packet type is *not* needed 44 * for PPP, as different PPP protocol types can be used; it only needs 45 * to be put on the wire for SLIP. 46 * 47 * It also indicates that, for compressed SLIP: 48 * 49 * If the COMPRESSED_TCP bit is set in the first byte, it's 50 * a COMPRESSED_TCP packet; that byte is the change byte, and 51 * the COMPRESSED_TCP bit, 0x80, isn't used in the change byte. 52 * 53 * If the upper 4 bits of the first byte are 7, it's an 54 * UNCOMPRESSED_TCP packet; that byte is the first byte of 55 * the UNCOMPRESSED_TCP modified IP header, with a connection 56 * number in the protocol field, and with the version field 57 * being 7, not 4. 58 * 59 * Otherwise, the packet is an IPv4 packet (where the upper 4 bits 60 * of the packet are 4). 61 * 62 * So this routine looks as if it's sort-of intended to handle 63 * compressed SLIP, although it doesn't handle UNCOMPRESSED_TCP 64 * correctly for that (it doesn't fix the version number and doesn't 65 * do anything to the protocol field), and doesn't check for COMPRESSED_TCP 66 * packets correctly for that (you only check the first bit - see 67 * B.1 in RFC 1144). 68 * 69 * But it's called for BSD/OS PPP, not SLIP - perhaps BSD/OS does weird 70 * things with the headers? 71 * 72 * Without a BSD/OS VJC-compressed PPP trace, or knowledge of what the 73 * BSD/OS VJC code does, we can't say what's the case. 74 * 75 * We therefore leave "proto" - which is the PPP protocol type - in place, 76 * *not* marked as unused, for now, so that GCC warnings about the 77 * unused argument remind us that we should fix this some day. 78 * 79 * XXX - also, it fetches the TCP checksum field in COMPRESSED_TCP 80 * packets with GET_HE_U_2, rather than with GET_BE_U_2(); RFC 1144 says 81 * it's "the unmodified TCP checksum", which would imply that it's 82 * big-endian, but perhaps, on the platform where this was developed, 83 * the packets were munged by the networking stack before being handed 84 * to the packet capture mechanism. 85 */ 86 int 87 vjc_print(netdissect_options *ndo, const u_char *bp, u_short proto _U_) 88 { 89 int i; 90 91 ndo->ndo_protocol = "vjc"; 92 switch (GET_U_1(bp) & 0xf0) { 93 case TYPE_IP: 94 if (ndo->ndo_eflag) 95 ND_PRINT("(vjc type=IP) "); 96 return PPP_IP; 97 case TYPE_UNCOMPRESSED_TCP: 98 if (ndo->ndo_eflag) 99 ND_PRINT("(vjc type=raw TCP) "); 100 return PPP_IP; 101 case TYPE_COMPRESSED_TCP: 102 if (ndo->ndo_eflag) 103 ND_PRINT("(vjc type=compressed TCP) "); 104 for (i = 0; i < 8; i++) { 105 if (GET_U_1(bp + 1) & (0x80 >> i)) 106 ND_PRINT("%c", "?CI?SAWU"[i]); 107 } 108 if (GET_U_1(bp + 1)) 109 ND_PRINT(" "); 110 ND_PRINT("C=0x%02x ", GET_U_1(bp + 2)); 111 ND_PRINT("sum=0x%04x ", GET_HE_U_2(bp + 3)); 112 return -1; 113 case TYPE_ERROR: 114 if (ndo->ndo_eflag) 115 ND_PRINT("(vjc type=error) "); 116 return -1; 117 default: 118 if (ndo->ndo_eflag) 119 ND_PRINT("(vjc type=0x%02x) ", GET_U_1(bp) & 0xf0); 120 return -1; 121 } 122 } 123