1 /* $OpenBSD: print-atalk.c,v 1.35 2021/12/01 18:28:45 deraadt Exp $ */
2
3 /*
4 * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997
5 * The Regents of the University of California. All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that: (1) source code distributions
9 * retain the above copyright notice and this paragraph in its entirety, (2)
10 * distributions including binary code include the above copyright notice and
11 * this paragraph in its entirety in the documentation or other materials
12 * provided with the distribution, and (3) all advertising materials mentioning
13 * features or use of this software display the following acknowledgement:
14 * ``This product includes software developed by the University of California,
15 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
16 * the University nor the names of its contributors may be used to endorse
17 * or promote products derived from this software without specific prior
18 * written permission.
19 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
20 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
21 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
22 *
23 * Format and print AppleTalk packets.
24 */
25
26 #include <sys/time.h>
27 #include <sys/socket.h>
28
29 #include <net/if.h>
30
31 #include <netinet/in.h>
32 #include <netinet/ip.h>
33 #include <netinet/ip_var.h>
34 #include <netinet/if_ether.h>
35 #include <netinet/udp.h>
36 #include <netinet/udp_var.h>
37 #include <netinet/tcp.h>
38
39 #include <inttypes.h>
40 #include <stdio.h>
41 #include <stdlib.h>
42 #include <string.h>
43 #include <limits.h>
44
45 #include "interface.h"
46 #include "addrtoname.h"
47 #include "ethertype.h"
48 #include "extract.h" /* must come after interface.h */
49 #include "appletalk.h"
50 #include "savestr.h"
51 #include "privsep.h"
52
53 static struct tok type2str[] = {
54 { ddpRTMP, "rtmp" },
55 { ddpRTMPrequest, "rtmpReq" },
56 { ddpECHO, "echo" },
57 { ddpIP, "IP" },
58 { ddpARP, "ARP" },
59 { ddpKLAP, "KLAP" },
60 { 0, NULL }
61 };
62
63 struct aarp {
64 u_int16_t htype, ptype;
65 u_int8_t halen, palen;
66 u_int16_t op;
67 u_int8_t hsaddr[6];
68 u_int8_t psaddr[4];
69 u_int8_t hdaddr[6];
70 u_int8_t pdaddr[4];
71 };
72
73 static char tstr[] = "[|atalk]";
74
75 static void atp_print(const struct atATP *, u_int);
76 static void atp_bitmap_print(u_char);
77 static void nbp_print(const struct atNBP *, u_int, u_short, u_char, u_char);
78 static const char *print_cstring(const char *, const u_char *);
79 static const struct atNBPtuple *nbp_tuple_print(const struct atNBPtuple *,
80 const u_char *,
81 u_short, u_char, u_char);
82 static const struct atNBPtuple *nbp_name_print(const struct atNBPtuple *,
83 const u_char *);
84 static const char *ataddr_string(u_short, u_char);
85 static void ddp_print(const u_char *, u_int, int, u_short, u_char, u_char);
86 static const char *ddpskt_string(int);
87
88 /*
89 * Print AppleTalk Datagram Delivery Protocol packets
90 * without the LLAP encapsulating header (i.e.
91 * from Ethertalk)
92 */
93 void
atalk_print(const u_char * bp,u_int length)94 atalk_print(const u_char *bp, u_int length)
95 {
96 const struct atDDP *dp;
97 u_short snet;
98
99 if (length < ddpSize) {
100 printf(" [|ddp %d]", length);
101 return;
102 }
103 dp = (const struct atDDP *)bp;
104 snet = EXTRACT_16BITS(&dp->srcNet);
105 printf("%s.%s", ataddr_string(snet, dp->srcNode),
106 ddpskt_string(dp->srcSkt));
107 printf(" > %s.%s:",
108 ataddr_string(EXTRACT_16BITS(&dp->dstNet), dp->dstNode),
109 ddpskt_string(dp->dstSkt));
110 bp += ddpSize;
111 length -= ddpSize;
112 ddp_print(bp, length, dp->type, snet, dp->srcNode, dp->srcSkt);
113 }
114
115 /*
116 * Print AppleTalk Datagram Delivery Protocol packets
117 * from localtalk (i.e. the 230 Kbps net built into
118 * every Macintosh). We can get these from a localtalk
119 * interface if we have one, or from UDP encapsulated tunnels.
120 */
121 void
atalk_print_llap(const u_char * bp,u_int length)122 atalk_print_llap(const u_char *bp, u_int length)
123 {
124 const struct LAP *lp;
125 const struct atDDP *dp;
126 const struct atShortDDP *sdp;
127 u_short snet;
128
129 if (length < sizeof(*lp)) {
130 printf(" [|llap %d]", length);
131 return;
132 }
133
134 lp = (struct LAP *)bp;
135 bp += sizeof(*lp);
136 length -= sizeof(*lp);
137 switch (lp->type) {
138
139 case lapShortDDP:
140 if (length < ddpSSize) {
141 printf(" [|sddp %d]", length);
142 return;
143 }
144 sdp = (const struct atShortDDP *)bp;
145 printf("%s.%s",
146 ataddr_string(0, lp->src), ddpskt_string(sdp->srcSkt));
147 printf(" > %s.%s:",
148 ataddr_string(0, lp->dst), ddpskt_string(sdp->dstSkt));
149 bp += ddpSSize;
150 length -= ddpSSize;
151 ddp_print(bp, length, sdp->type, 0, lp->src, sdp->srcSkt);
152 break;
153
154 case lapDDP:
155 if (length < ddpSize) {
156 printf(" [|ddp %d]", length);
157 return;
158 }
159 dp = (const struct atDDP *)bp;
160 snet = EXTRACT_16BITS(&dp->srcNet);
161 printf("%s.%s", ataddr_string(snet, dp->srcNode),
162 ddpskt_string(dp->srcSkt));
163 printf(" > %s.%s:",
164 ataddr_string(EXTRACT_16BITS(&dp->dstNet), dp->dstNode),
165 ddpskt_string(dp->dstSkt));
166 bp += ddpSize;
167 length -= ddpSize;
168 ddp_print(bp, length, dp->type, snet, dp->srcNode, dp->srcSkt);
169 break;
170
171 #ifdef notdef
172 case lapKLAP:
173 klap_print(bp, length);
174 break;
175 #endif
176
177 default:
178 printf("%d > %d at-lap#%d %d",
179 lp->src, lp->dst, lp->type, length);
180 break;
181 }
182 }
183
184 /* XXX should probably pass in the snap header and do checks like arp_print() */
185 void
aarp_print(const u_char * bp,u_int length)186 aarp_print(const u_char *bp, u_int length)
187 {
188 const struct aarp *ap;
189
190 #define AT(member) ataddr_string((ap->member[1]<<8)|ap->member[2],ap->member[3])
191
192 printf("aarp ");
193 ap = (const struct aarp *)bp;
194 if (ntohs(ap->htype) == 1 && ntohs(ap->ptype) == ETHERTYPE_ATALK &&
195 ap->halen == 6 && ap->palen == 4 )
196 switch (ntohs(ap->op)) {
197
198 case 1: /* request */
199 printf("who-has %s tell %s",
200 AT(pdaddr), AT(psaddr));
201 return;
202
203 case 2: /* response */
204 printf("reply %s is-at %s",
205 AT(pdaddr), etheraddr_string(ap->hdaddr));
206 return;
207
208 case 3: /* probe (oy!) */
209 printf("probe %s tell %s",
210 AT(pdaddr), AT(psaddr));
211 return;
212 }
213 printf("len %u op %u htype %u ptype %#x halen %u palen %u",
214 length, ntohs(ap->op), ntohs(ap->htype), ntohs(ap->ptype),
215 ap->halen, ap->palen);
216 }
217
218 static void
ddp_print(const u_char * bp,u_int length,int t,u_short snet,u_char snode,u_char skt)219 ddp_print(const u_char *bp, u_int length, int t,
220 u_short snet, u_char snode, u_char skt)
221 {
222
223 if ((intptr_t)bp & (sizeof(long)-1)) {
224 static u_char *abuf = NULL;
225 int clen = snapend - bp;
226 if (clen > snaplen)
227 clen = snaplen;
228
229 if (abuf == NULL) {
230 abuf = malloc(snaplen);
231 if (abuf == NULL)
232 error("ddp_print: malloc");
233 }
234 memmove((char *)abuf, (char *)bp, min(length, clen));
235 snapend = abuf + clen;
236 packetp = abuf;
237 bp = abuf;
238 }
239
240 switch (t) {
241
242 case ddpNBP:
243 nbp_print((const struct atNBP *)bp, length, snet, snode, skt);
244 break;
245
246 case ddpATP:
247 atp_print((const struct atATP *)bp, length);
248 break;
249
250 default:
251 printf(" at-%s %d", tok2str(type2str, NULL, t), length);
252 break;
253 }
254 }
255
256 static void
atp_print(const struct atATP * ap,u_int length)257 atp_print(const struct atATP *ap, u_int length)
258 {
259 char c;
260 u_int32_t data;
261
262 if ((const u_char *)(ap + 1) > snapend) {
263 /* Just bail if we don't have the whole chunk. */
264 printf("%s", tstr);
265 return;
266 }
267 length -= sizeof(*ap);
268 switch (ap->control & 0xc0) {
269
270 case atpReqCode:
271 printf(" atp-req%s %d",
272 ap->control & atpXO? " " : "*",
273 EXTRACT_16BITS(&ap->transID));
274
275 atp_bitmap_print(ap->bitmap);
276
277 if (length != 0)
278 printf(" [len=%d]", length);
279
280 switch (ap->control & (atpEOM|atpSTS)) {
281 case atpEOM:
282 printf(" [EOM]");
283 break;
284 case atpSTS:
285 printf(" [STS]");
286 break;
287 case atpEOM|atpSTS:
288 printf(" [EOM,STS]");
289 break;
290 }
291 break;
292
293 case atpRspCode:
294 printf(" atp-resp%s%d:%d (%d)",
295 ap->control & atpEOM? "*" : " ",
296 EXTRACT_16BITS(&ap->transID), ap->bitmap, length);
297 switch (ap->control & (atpXO|atpSTS)) {
298 case atpXO:
299 printf(" [XO]");
300 break;
301 case atpSTS:
302 printf(" [STS]");
303 break;
304 case atpXO|atpSTS:
305 printf(" [XO,STS]");
306 break;
307 }
308 break;
309
310 case atpRelCode:
311 printf(" atp-rel %d", EXTRACT_16BITS(&ap->transID));
312
313 atp_bitmap_print(ap->bitmap);
314
315 /* length should be zero */
316 if (length)
317 printf(" [len=%d]", length);
318
319 /* there shouldn't be any control flags */
320 if (ap->control & (atpXO|atpEOM|atpSTS)) {
321 c = '[';
322 if (ap->control & atpXO) {
323 printf("%cXO", c);
324 c = ',';
325 }
326 if (ap->control & atpEOM) {
327 printf("%cEOM", c);
328 c = ',';
329 }
330 if (ap->control & atpSTS) {
331 printf("%cSTS", c);
332 c = ',';
333 }
334 printf("]");
335 }
336 break;
337
338 default:
339 printf(" atp-0x%x %d (%d)", ap->control,
340 EXTRACT_16BITS(&ap->transID), length);
341 break;
342 }
343 data = EXTRACT_32BITS(&ap->userData);
344 if (data != 0)
345 printf(" 0x%x", data);
346 }
347
348 static void
atp_bitmap_print(u_char bm)349 atp_bitmap_print(u_char bm)
350 {
351 char c;
352 int i;
353
354 /*
355 * The '& 0xff' below is needed for compilers that want to sign
356 * extend a u_char, which is the case with the Ultrix compiler.
357 * (gcc is smart enough to eliminate it, at least on the Sparc).
358 */
359 if ((bm + 1) & (bm & 0xff)) {
360 c = '<';
361 for (i = 0; bm; ++i) {
362 if (bm & 1) {
363 printf("%c%d", c, i);
364 c = ',';
365 }
366 bm >>= 1;
367 }
368 printf(">");
369 } else {
370 for (i = 0; bm; ++i)
371 bm >>= 1;
372 if (i > 1)
373 printf("<0-%d>", i - 1);
374 else
375 printf("<0>");
376 }
377 }
378
379 static void
nbp_print(const struct atNBP * np,u_int length,u_short snet,u_char snode,u_char skt)380 nbp_print(const struct atNBP *np, u_int length, u_short snet,
381 u_char snode, u_char skt)
382 {
383 const struct atNBPtuple *tp =
384 (struct atNBPtuple *)((u_char *)np + nbpHeaderSize);
385 int i;
386 const u_char *ep;
387
388 if (length < nbpHeaderSize) {
389 printf(" truncated-nbp %d", length);
390 return;
391 }
392
393 length -= nbpHeaderSize;
394 if (length < 8) {
395 /* must be room for at least one tuple */
396 if (np->control == nbpNATLKerr) {
397 printf(" nbp-netatalk_err");
398 return;
399 } else if (np->control == nbpNATLKok) {
400 printf(" nbp-netatalk_ok");
401 return;
402 }
403 printf(" truncated-nbp nbp-0x%x %d (%d)",
404 np->control, np->id, length + nbpHeaderSize);
405 return;
406 }
407 /* ep points to end of available data */
408 ep = snapend;
409 if ((const u_char *)tp > ep) {
410 printf("%s", tstr);
411 return;
412 }
413 switch (i = np->control & 0xf0) {
414
415 case nbpBrRq:
416 case nbpLkUp:
417 printf(i == nbpLkUp? " nbp-lkup %d:":" nbp-brRq %d:", np->id);
418 if ((const u_char *)(tp + 1) > ep) {
419 printf("%s", tstr);
420 return;
421 }
422 (void)nbp_name_print(tp, ep);
423 /*
424 * look for anomalies: the spec says there can only
425 * be one tuple, the address must match the source
426 * address and the enumerator should be zero.
427 */
428 if ((np->control & 0xf) != 1)
429 printf(" [ntup=%d]", np->control & 0xf);
430 if (tp->enumerator)
431 printf(" [enum=%d]", tp->enumerator);
432 if (EXTRACT_16BITS(&tp->net) != snet ||
433 tp->node != snode || tp->skt != skt)
434 printf(" [addr=%s.%d]",
435 ataddr_string(EXTRACT_16BITS(&tp->net),
436 tp->node), tp->skt);
437 break;
438
439 case nbpLkUpReply:
440 printf(" nbp-reply %d:", np->id);
441
442 /* print each of the tuples in the reply */
443 for (i = np->control & 0xf; --i >= 0 && tp; )
444 tp = nbp_tuple_print(tp, ep, snet, snode, skt);
445 break;
446
447 case nbpNATLKrgstr:
448 case nbpNATLKunrgstr:
449 printf((i == nbpNATLKrgstr) ?
450 " nbp-netatalk_rgstr %d:" :
451 " nbp-netatalk_unrgstr %d:",
452 np->id);
453 for (i = np->control & 0xf; --i >= 0 && tp; )
454 tp = nbp_tuple_print(tp, ep, snet, snode, skt);
455 break;
456
457 default:
458 printf(" nbp-0x%x %d (%d)", np->control, np->id,
459 length);
460 break;
461 }
462 }
463
464 /* print a counted string */
465 static const char *
print_cstring(const char * cp,const u_char * ep)466 print_cstring(const char *cp, const u_char *ep)
467 {
468 u_int length;
469
470 if (cp >= (const char *)ep) {
471 printf("%s", tstr);
472 return (0);
473 }
474 length = *cp++;
475
476 /* Spec says string can be at most 32 bytes long */
477 if (length > 32) {
478 printf("[len=%d]", length);
479 return (0);
480 }
481 while ((int)--length >= 0) {
482 if (cp >= (char *)ep) {
483 printf("%s", tstr);
484 return (0);
485 }
486 putchar(*cp++);
487 }
488 return (cp);
489 }
490
491 static const struct atNBPtuple *
nbp_tuple_print(const struct atNBPtuple * tp,const u_char * ep,u_short snet,u_char snode,u_char skt)492 nbp_tuple_print(const struct atNBPtuple *tp,
493 const u_char *ep,
494 u_short snet, u_char snode,
495 u_char skt)
496 {
497 const struct atNBPtuple *tpn;
498
499 if ((const u_char *)(tp + 1) > ep) {
500 printf("%s", tstr);
501 return 0;
502 }
503 tpn = nbp_name_print(tp, ep);
504
505 /* if the enumerator isn't 1, print it */
506 if (tp->enumerator != 1)
507 printf("(%d)", tp->enumerator);
508
509 /* if the socket doesn't match the src socket, print it */
510 if (tp->skt != skt)
511 printf(" %d", tp->skt);
512
513 /* if the address doesn't match the src address, it's an anomaly */
514 if (EXTRACT_16BITS(&tp->net) != snet || tp->node != snode)
515 printf(" [addr=%s]",
516 ataddr_string(EXTRACT_16BITS(&tp->net), tp->node));
517
518 return (tpn);
519 }
520
521 static const struct atNBPtuple *
nbp_name_print(const struct atNBPtuple * tp,const u_char * ep)522 nbp_name_print(const struct atNBPtuple *tp, const u_char *ep)
523 {
524 const char *cp = (const char *)tp + nbpTupleSize;
525
526 putchar(' ');
527
528 /* Object */
529 putchar('"');
530 if ((cp = print_cstring(cp, ep)) != NULL) {
531 /* Type */
532 putchar(':');
533 if ((cp = print_cstring(cp, ep)) != NULL) {
534 /* Zone */
535 putchar('@');
536 if ((cp = print_cstring(cp, ep)) != NULL)
537 putchar('"');
538 }
539 }
540 return ((const struct atNBPtuple *)cp);
541 }
542
543
544 #define HASHNAMESIZE 4096
545
546 struct hnamemem {
547 int addr;
548 char *name;
549 struct hnamemem *nxt;
550 };
551
552 static struct hnamemem hnametable[HASHNAMESIZE];
553
554 static const char *
ataddr_string(u_short atnet,u_char athost)555 ataddr_string(u_short atnet, u_char athost)
556 {
557 struct hnamemem *tp, *tp2;
558 int i = (atnet << 8) | athost;
559 char nambuf[HOST_NAME_MAX+1 + 20];
560
561 for (tp = &hnametable[i & (HASHNAMESIZE-1)]; tp->nxt; tp = tp->nxt)
562 if (tp->addr == i)
563 return (tp->name);
564
565 /* didn't have the node name -- see if we've got the net name */
566 i |= 255;
567 for (tp2 = &hnametable[i & (HASHNAMESIZE-1)]; tp2->nxt; tp2 = tp2->nxt)
568 if (tp2->addr == i) {
569 tp->addr = (atnet << 8) | athost;
570 tp->nxt = newhnamemem();
571 (void)snprintf(nambuf, sizeof nambuf, "%s.%d",
572 tp2->name, athost);
573 tp->name = savestr(nambuf);
574 return (tp->name);
575 }
576
577 tp->addr = (atnet << 8) | athost;
578 tp->nxt = newhnamemem();
579 if (athost != 255)
580 (void)snprintf(nambuf, sizeof nambuf, "%d.%d.%d",
581 atnet >> 8, atnet & 0xff, athost);
582 else
583 (void)snprintf(nambuf, sizeof nambuf, "%d.%d",
584 atnet >> 8, atnet & 0xff);
585 tp->name = savestr(nambuf);
586
587 return (tp->name);
588 }
589
590 static struct tok skt2str[] = {
591 { rtmpSkt, "rtmp" }, /* routing table maintenance */
592 { nbpSkt, "nis" }, /* name info socket */
593 { echoSkt, "echo" }, /* AppleTalk echo protocol */
594 { zipSkt, "zip" }, /* zone info protocol */
595 { 0, NULL }
596 };
597
598 static const char *
ddpskt_string(int skt)599 ddpskt_string(int skt)
600 {
601 static char buf[12];
602
603 if (nflag) {
604 (void)snprintf(buf, sizeof buf, "%d", skt);
605 return (buf);
606 }
607 return (tok2str(skt2str, "%d", skt));
608 }
609