1 /*
2  * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 2000
3  *	The Regents of the University of California.  All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that: (1) source code distributions
7  * retain the above copyright notice and this paragraph in its entirety, (2)
8  * distributions including binary code include the above copyright notice and
9  * this paragraph in its entirety in the documentation or other materials
10  * provided with the distribution, and (3) all advertising materials mentioning
11  * features or use of this software display the following acknowledgement:
12  * ``This product includes software developed by the University of California,
13  * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14  * the University nor the names of its contributors may be used to endorse
15  * or promote products derived from this software without specific prior
16  * written permission.
17  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
20  */
21 #ifndef lint
22 static const char rcsid[] _U_ =
23     "@(#) $Header: /tcpdump/master/tcpdump/print-symantec.c,v 1.5 2005-07-07 01:22:21 guy Exp $ (LBL)";
24 #endif
25 
26 #ifdef HAVE_CONFIG_H
27 #include "config.h"
28 #endif
29 
30 #include <tcpdump-stdinc.h>
31 
32 #include <stdio.h>
33 #include <pcap.h>
34 
35 #include "interface.h"
36 #include "extract.h"
37 #include "addrtoname.h"
38 #include "ethertype.h"
39 
40 #include "ether.h"
41 
42 struct symantec_header {
43 	u_int8_t  stuff1[6];
44 	u_int16_t ether_type;
45 	u_int8_t  stuff2[36];
46 };
47 
48 static inline void
49 symantec_hdr_print(register const u_char *bp, u_int length)
50 {
51 	register const struct symantec_header *sp;
52 	u_int16_t etype;
53 
54 	sp = (const struct symantec_header *)bp;
55 
56 	etype = EXTRACT_16BITS(&sp->ether_type);
57 	if (!qflag) {
58 	        if (etype <= ETHERMTU)
59 		          (void)printf("invalid ethertype %u", etype);
60                 else
61 		          (void)printf("ethertype %s (0x%04x)",
62 				       tok2str(ethertype_values,"Unknown", etype),
63                                        etype);
64         } else {
65                 if (etype <= ETHERMTU)
66                           (void)printf("invalid ethertype %u", etype);
67                 else
68                           (void)printf("%s", tok2str(ethertype_values,"Unknown Ethertype (0x%04x)", etype));
69         }
70 
71 	(void)printf(", length %u: ", length);
72 }
73 
74 /*
75  * This is the top level routine of the printer.  'p' points
76  * to the ether header of the packet, 'h->ts' is the timestamp,
77  * 'h->len' is the length of the packet off the wire, and 'h->caplen'
78  * is the number of bytes actually captured.
79  */
80 u_int
81 symantec_if_print(const struct pcap_pkthdr *h, const u_char *p)
82 {
83 	u_int length = h->len;
84 	u_int caplen = h->caplen;
85 	struct symantec_header *sp;
86 	u_short ether_type;
87 
88 	if (caplen < sizeof (struct symantec_header)) {
89 		printf("[|symantec]");
90 		return caplen;
91 	}
92 
93 	if (eflag)
94 		symantec_hdr_print(p, length);
95 
96 	length -= sizeof (struct symantec_header);
97 	caplen -= sizeof (struct symantec_header);
98 	sp = (struct symantec_header *)p;
99 	p += sizeof (struct symantec_header);
100 
101 	ether_type = EXTRACT_16BITS(&sp->ether_type);
102 
103 	if (ether_type <= ETHERMTU) {
104 		/* ether_type not known, print raw packet */
105 		if (!eflag)
106 			symantec_hdr_print((u_char *)sp, length + sizeof (struct symantec_header));
107 
108 		if (!suppress_default_print)
109 			default_print(p, caplen);
110 	} else if (ethertype_print(gndo, ether_type, p, length, caplen) == 0) {
111 		/* ether_type not known, print raw packet */
112 		if (!eflag)
113 			symantec_hdr_print((u_char *)sp, length + sizeof (struct symantec_header));
114 
115 		if (!suppress_default_print)
116 			default_print(p, caplen);
117 	}
118 
119 	return (sizeof (struct symantec_header));
120 }
121