1 /*
2 * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997
3 * The Regents of the University of California. All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
16 * written permission.
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
20 */
21
22
23 #include <unistd.h>
24 #include <stdlib.h>
25
26 #include <argus_compat.h>
27
28 #include <rabins.h>
29 #include <argus_util.h>
30 #include <argus_client.h>
31 #include <argus_main.h>
32 #include <argus_filter.h>
33
34 #include <signal.h>
35 #include <ctype.h>
36 #include <argus/extract.h>
37
38 extern u_char *snapend;
39
40 #include "interface.h"
41
42 /*
43 * Address Resolution Protocol.
44 *
45 * See RFC 826 for protocol description. ARP packets are variable
46 * in size; the arphdr structure defines the fixed-length portion.
47 * Protocol type values are the same as those for 10 Mb/s Ethernet.
48 * It is followed by the variable-sized fields ar_sha, arp_spa,
49 * arp_tha and arp_tpa in that order, according to the lengths
50 * specified. Field names used correspond to RFC 826.
51 */
52
53 #define ARPHRD_ETHER 1 /* ethernet hardware format */
54 #define ARPHRD_IEEE802 6 /* token-ring hardware format */
55 #define ARPHRD_ARCNET 7 /* arcnet hardware format */
56 #define ARPHRD_FRELAY 15 /* frame relay hardware format */
57 #define ARPHRD_STRIP 23 /* Ricochet Starmode Radio hardware format */
58 #define ARPHRD_IEEE1394 24 /* IEEE 1394 (FireWire) hardware format */
59
60 #define ARPOP_REQUEST 1 /* request to resolve address */
61 #define ARPOP_REPLY 2 /* response to previous request */
62 #define ARPOP_REVREQUEST 3 /* request protocol address given hardware */
63 #define ARPOP_REVREPLY 4 /* response giving protocol address */
64 #define ARPOP_INVREQUEST 8 /* request to identify peer */
65 #define ARPOP_INVREPLY 9 /* response identifying peer */
66
67 #if !defined(ar_sha)
68 #define ar_sha(ap) (((const u_char *)((ap)+1))+0)
69 #endif
70 #if !defined(ar_spa)
71 #define ar_spa(ap) (((const u_char *)((ap)+1))+ (ap)->ar_hln)
72 #endif
73 #if !defined(ar_tha)
74 #define ar_tha(ap) (((const u_char *)((ap)+1))+ (ap)->ar_hln+(ap)->ar_pln)
75 #endif
76 #if !defined(ar_tpa)
77 #define ar_tpa(ap) (((const u_char *)((ap)+1))+2*(ap)->ar_hln+(ap)->ar_pln)
78 #endif
79
80 struct arp_pkthdr {
81 u_short ar_hrd; /* format of hardware address */
82 u_short ar_pro; /* format of protocol address */
83 u_char ar_hln; /* length of hardware address */
84 u_char ar_pln; /* length of protocol address */
85 u_short ar_op; /* one of: */
86
87 /*
88 * The remaining fields are variable in size,
89 * according to the sizes above.
90 */
91 #ifdef COMMENT_ONLY
92 u_char ar_sha[]; /* sender hardware address */
93 u_char ar_spa[]; /* sender protocol address */
94 u_char ar_tha[]; /* target hardware address */
95 u_char ar_tpa[]; /* target protocol address */
96 #endif
97 };
98
99 #define ARP_HDRLEN 8
100
101 #define HRD(ap) EXTRACT_16BITS(&(ap)->ar_hrd)
102 #define HLN(ap) ((ap)->ar_hln)
103 #define PLN(ap) ((ap)->ar_pln)
104 #define OP(ap) EXTRACT_16BITS(&(ap)->ar_op)
105 #define PRO(ap) EXTRACT_16BITS(&(ap)->ar_pro)
106 #define ARPSHA(ap) (ar_sha(ap))
107 #define ARPSPA(ap) (ar_spa(ap))
108 #define ARPTHA(ap) (ar_tha(ap))
109 #define ARPTPA(ap) (ar_tpa(ap))
110
111 /*
112 * ATM Address Resolution Protocol.
113 *
114 * See RFC 2225 for protocol description. ATMARP packets are similar
115 * to ARP packets, except that there are no length fields for the
116 * protocol address - instead, there are type/length fields for
117 * the ATM number and subaddress - and the hardware addresses consist
118 * of an ATM number and an ATM subaddress.
119 */
120 struct atmarp_pkthdr {
121 u_short aar_hrd; /* format of hardware address */
122 #define ARPHRD_ATM2225 19 /* ATM (RFC 2225) */
123 u_short aar_pro; /* format of protocol address */
124 u_char aar_shtl; /* length of source ATM number */
125 u_char aar_sstl; /* length of source ATM subaddress */
126 #define ATMARP_IS_E164 0x40 /* bit in type/length for E.164 format */
127 #define ATMARP_LEN_MASK 0x3F /* length of {sub}address in type/length */
128 u_short aar_op; /* same as regular ARP */
129 #define ATMARPOP_NAK 10 /* NAK */
130 u_char aar_spln; /* length of source protocol address */
131 u_char aar_thtl; /* length of target ATM number */
132 u_char aar_tstl; /* length of target ATM subaddress */
133 u_char aar_tpln; /* length of target protocol address */
134 /*
135 * The remaining fields are variable in size,
136 * according to the sizes above.
137 */
138 #ifdef COMMENT_ONLY
139 u_char aar_sha[]; /* source ATM number */
140 u_char aar_ssa[]; /* source ATM subaddress */
141 u_char aar_spa[]; /* sender protocol address */
142 u_char aar_tha[]; /* target ATM number */
143 u_char aar_tsa[]; /* target ATM subaddress */
144 u_char aar_tpa[]; /* target protocol address */
145 #endif
146
147 #define ATMHRD(ap) EXTRACT_16BITS(&(ap)->aar_hrd)
148 #define ATMSHLN(ap) ((ap)->aar_shtl & ATMARP_LEN_MASK)
149 #define ATMSSLN(ap) ((ap)->aar_sstl & ATMARP_LEN_MASK)
150 #define ATMSPLN(ap) ((ap)->aar_spln)
151 #define ATMOP(ap) EXTRACT_16BITS(&(ap)->aar_op)
152 #define ATMPRO(ap) EXTRACT_16BITS(&(ap)->aar_pro)
153 #define ATMTHLN(ap) ((ap)->aar_thtl & ATMARP_LEN_MASK)
154 #define ATMTSLN(ap) ((ap)->aar_tstl & ATMARP_LEN_MASK)
155 #define ATMTPLN(ap) ((ap)->aar_tpln)
156 #define aar_sha(ap) ((const u_char *)((ap)+1))
157 #define aar_ssa(ap) (aar_sha(ap) + ATMSHLN(ap))
158 #define aar_spa(ap) (aar_ssa(ap) + ATMSSLN(ap))
159 #define aar_tha(ap) (aar_spa(ap) + ATMSPLN(ap))
160 #define aar_tsa(ap) (aar_tha(ap) + ATMTHLN(ap))
161 #define aar_tpa(ap) (aar_tsa(ap) + ATMTSLN(ap))
162 };
163
164 #define ATMSHA(ap) (aar_sha(ap))
165 #define ATMSSA(ap) (aar_ssa(ap))
166 #define ATMSPA(ap) (aar_spa(ap))
167 #define ATMTHA(ap) (aar_tha(ap))
168 #define ATMTSA(ap) (aar_tsa(ap))
169 #define ATMTPA(ap) (aar_tpa(ap))
170
171 /*
172 static void
173 atmarp_addr_print(const u_char *ha, u_int ha_len, const u_char *srca, u_int srca_len)
174 {
175 if (ha_len == 0)
176 sprintf(&ArgusBuf[strlen(ArgusBuf)],"<No address>");
177 else {
178 sprintf(&ArgusBuf[strlen(ArgusBuf)],"%s", linkaddr_string(ArgusParser, ha, ha_len));
179 if (srca_len != 0)
180 sprintf(&ArgusBuf[strlen(ArgusBuf)],",%s", linkaddr_string(ArgusParser, srca, srca_len));
181 }
182 }
183
184 static void
185 atmarp_print(const u_char *bp, u_int length, u_int caplen)
186 {
187 const struct atmarp_pkthdr *ap;
188 u_short pro, hrd, op;
189
190 ap = (const struct atmarp_pkthdr *)bp;
191 TCHECK(*ap);
192
193 hrd = ATMHRD(ap);
194 pro = ATMPRO(ap);
195 op = ATMOP(ap);
196
197 if (!TTEST2(*aar_tpa(ap), ATMTPLN(ap))) {
198 sprintf(&ArgusBuf[strlen(ArgusBuf)],"truncated-atmarp");
199 return;
200 }
201
202 if ((pro != ETHERTYPE_IP && pro != ETHERTYPE_TRAIL) ||
203 ATMSPLN(ap) != 4 || ATMTPLN(ap) != 4) {
204 sprintf(&ArgusBuf[strlen(ArgusBuf)],"atmarp-#%d for proto #%d (%d/%d) hardware #%d",
205 op, pro, ATMSPLN(ap), ATMTPLN(ap), hrd);
206 return;
207 }
208 if (pro == ETHERTYPE_TRAIL)
209 sprintf(&ArgusBuf[strlen(ArgusBuf)],"trailer-");
210 switch (op) {
211
212 case ARPOP_REQUEST:
213 sprintf(&ArgusBuf[strlen(ArgusBuf)],"arp who-has %s", ipaddr_string(ATMTPA(ap)));
214 if (ATMTHLN(ap) != 0) {
215 sprintf(&ArgusBuf[strlen(ArgusBuf)]," (");
216 atmarp_addr_print(ATMTHA(ap), ATMTHLN(ap), ATMTSA(ap), ATMTSLN(ap));
217 sprintf(&ArgusBuf[strlen(ArgusBuf)],")");
218 }
219 sprintf(&ArgusBuf[strlen(ArgusBuf)]," tell %s", ipaddr_string(ATMSPA(ap)));
220 break;
221
222 case ARPOP_REPLY:
223 sprintf(&ArgusBuf[strlen(ArgusBuf)],"arp reply %s", ipaddr_string(ATMSPA(ap)));
224 sprintf(&ArgusBuf[strlen(ArgusBuf)]," is-at ");
225 atmarp_addr_print(ATMSHA(ap), ATMSHLN(ap), ATMSSA(ap), ATMSSLN(ap));
226 break;
227
228 case ARPOP_INVREQUEST:
229 sprintf(&ArgusBuf[strlen(ArgusBuf)],"invarp who-is ");
230 atmarp_addr_print(ATMTHA(ap), ATMTHLN(ap), ATMTSA(ap), ATMTSLN(ap));
231 sprintf(&ArgusBuf[strlen(ArgusBuf)]," tell ");
232 atmarp_addr_print(ATMSHA(ap), ATMSHLN(ap), ATMSSA(ap), ATMSSLN(ap));
233 break;
234
235 case ARPOP_INVREPLY:
236 sprintf(&ArgusBuf[strlen(ArgusBuf)],"invarp reply ");
237 atmarp_addr_print(ATMSHA(ap), ATMSHLN(ap), ATMSSA(ap), ATMSSLN(ap));
238 sprintf(&ArgusBuf[strlen(ArgusBuf)]," at %s", ipaddr_string(ATMSPA(ap)));
239 break;
240
241 case ATMARPOP_NAK:
242 sprintf(&ArgusBuf[strlen(ArgusBuf)],"nak reply for %s", ipaddr_string(ATMSPA(ap)));
243 break;
244
245 default:
246 sprintf(&ArgusBuf[strlen(ArgusBuf)],"atmarp-#%d", op);
247 return;
248 }
249 return;
250 trunc:
251 sprintf(&ArgusBuf[strlen(ArgusBuf)],"[|atmarp]");
252 }
253 */
254
255 #include <argus_def.h>
256 extern char ArgusBuf[];
257
258 char *
arp_src_print(struct ArgusParserStruct * parser,struct ArgusRecordStruct * argus)259 arp_src_print(struct ArgusParserStruct *parser, struct ArgusRecordStruct *argus)
260 {
261 struct ArgusFlow *flow = (struct ArgusFlow *) argus->dsrs[ARGUS_FLOW_INDEX];
262 struct ArgusMetricStruct *metric = (void *) argus->dsrs[ARGUS_METRIC_INDEX];
263 struct ArgusArpFlow *arp = (struct ArgusArpFlow *) &flow->arp_flow;
264
265 if ((metric != NULL) && metric->src.pkts) {
266 switch (flow->hdr.argus_dsrvl8.qual & 0x1F) {
267 case ARGUS_TYPE_ARP:
268 sprintf(&ArgusBuf[strlen(ArgusBuf)],"who-has %s tell %s", ArgusGetName(parser, (unsigned char *)&arp->arp_tpa),
269 ArgusGetName(parser, (unsigned char *)&arp->arp_spa));
270 break;
271 }
272 }
273
274 return (ArgusBuf);
275 }
276
277 char *
arp_dst_print(struct ArgusParserStruct * parser,struct ArgusRecordStruct * argus)278 arp_dst_print(struct ArgusParserStruct *parser, struct ArgusRecordStruct *argus)
279 {
280 struct ArgusFlow *flow = (struct ArgusFlow *) argus->dsrs[ARGUS_FLOW_INDEX];
281 struct ArgusMetricStruct *metric = (void *) argus->dsrs[ARGUS_METRIC_INDEX];
282 struct ArgusNetworkStruct *net = (struct ArgusNetworkStruct *) argus->dsrs[ARGUS_NETWORK_INDEX];
283 struct ArgusArpFlow *arp = (struct ArgusArpFlow *) &flow->arp_flow;
284
285 if (net && ((metric != NULL) && metric->dst.pkts)) {
286 switch (net->hdr.subtype & 0x1F) {
287 case ARGUS_NETWORK_SUBTYPE_ARP:
288 sprintf(&ArgusBuf[strlen(ArgusBuf)],"%s is-at %s", ArgusGetName(parser, (unsigned char *)&arp->arp_tpa),
289 etheraddr_string(parser, (unsigned char *)&net->net_union.arp.respaddr));
290 break;
291 }
292 }
293
294 return (ArgusBuf);
295 }
296
297 /*
298 * Local Variables:
299 * c-style: bsd
300 * End:
301 */
302
303