1 /* $OpenBSD: print-atalk.c,v 1.20 2003/04/14 21:28:10 pvalchev Exp $ */ 2 3 /* 4 * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997 5 * The Regents of the University of California. All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that: (1) source code distributions 9 * retain the above copyright notice and this paragraph in its entirety, (2) 10 * distributions including binary code include the above copyright notice and 11 * this paragraph in its entirety in the documentation or other materials 12 * provided with the distribution, and (3) all advertising materials mentioning 13 * features or use of this software display the following acknowledgement: 14 * ``This product includes software developed by the University of California, 15 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of 16 * the University nor the names of its contributors may be used to endorse 17 * or promote products derived from this software without specific prior 18 * written permission. 19 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED 20 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF 21 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 22 * 23 * Format and print AppleTalk packets. 24 */ 25 26 #ifndef lint 27 static const char rcsid[] = 28 "@(#) $Header: /home/cvs/src/usr.sbin/tcpdump/print-atalk.c,v 1.20 2003/04/14 21:28:10 pvalchev Exp $ (LBL)"; 29 #endif 30 31 #include <sys/param.h> 32 #include <sys/time.h> 33 #include <sys/socket.h> 34 35 struct mbuf; 36 struct rtentry; 37 #include <net/if.h> 38 39 #include <netinet/in.h> 40 #include <netinet/in_systm.h> 41 #include <netinet/ip.h> 42 #include <netinet/ip_var.h> 43 #include <netinet/if_ether.h> 44 #include <netinet/udp.h> 45 #include <netinet/udp_var.h> 46 #include <netinet/tcp.h> 47 #include <netinet/tcpip.h> 48 49 #include <stdio.h> 50 #include <stdlib.h> 51 #include <string.h> 52 53 #include "interface.h" 54 #include "addrtoname.h" 55 #include "ethertype.h" 56 #include "extract.h" /* must come after interface.h */ 57 #include "appletalk.h" 58 #include "savestr.h" 59 60 static struct tok type2str[] = { 61 { ddpRTMP, "rtmp" }, 62 { ddpRTMPrequest, "rtmpReq" }, 63 { ddpECHO, "echo" }, 64 { ddpIP, "IP" }, 65 { ddpARP, "ARP" }, 66 { ddpKLAP, "KLAP" }, 67 { 0, NULL } 68 }; 69 70 struct aarp { 71 u_int16_t htype, ptype; 72 u_int8_t halen, palen; 73 u_int16_t op; 74 u_int8_t hsaddr[6]; 75 u_int8_t psaddr[4]; 76 u_int8_t hdaddr[6]; 77 u_int8_t pdaddr[4]; 78 }; 79 80 static char tstr[] = "[|atalk]"; 81 82 static void atp_print(const struct atATP *, u_int); 83 static void atp_bitmap_print(u_char); 84 static void nbp_print(const struct atNBP *, u_int, u_short, u_char, u_char); 85 static const char *print_cstring(const char *, const u_char *); 86 static const struct atNBPtuple *nbp_tuple_print(const struct atNBPtuple *, 87 const u_char *, 88 u_short, u_char, u_char); 89 static const struct atNBPtuple *nbp_name_print(const struct atNBPtuple *, 90 const u_char *); 91 static const char *ataddr_string(u_short, u_char); 92 static void ddp_print(const u_char *, u_int, int, u_short, u_char, u_char); 93 static const char *ddpskt_string(int); 94 95 /* 96 * Print AppleTalk Datagram Delivery Protocol packets 97 * without the LLAP encapsulating header (i.e. 98 * from Ethertalk) 99 */ 100 void 101 atalk_print(register const u_char *bp, u_int length) 102 { 103 register const struct atDDP *dp; 104 u_short snet; 105 106 if (length < ddpSize) { 107 (void)printf(" [|ddp %d]", length); 108 return; 109 } 110 dp = (const struct atDDP *)bp; 111 snet = EXTRACT_16BITS(&dp->srcNet); 112 printf("%s.%s", ataddr_string(snet, dp->srcNode), 113 ddpskt_string(dp->srcSkt)); 114 printf(" > %s.%s:", 115 ataddr_string(EXTRACT_16BITS(&dp->dstNet), dp->dstNode), 116 ddpskt_string(dp->dstSkt)); 117 bp += ddpSize; 118 length -= ddpSize; 119 ddp_print(bp, length, dp->type, snet, dp->srcNode, dp->srcSkt); 120 } 121 122 /* 123 * Print AppleTalk Datagram Delivery Protocol packets 124 * from localtalk (i.e. the 230 Kbps net built into 125 * every Macintosh). We can get these from a localtalk 126 * interface if we have one, or from UDP encapsulated tunnels. 127 */ 128 void 129 atalk_print_llap(register const u_char *bp, u_int length) 130 { 131 register const struct LAP *lp; 132 register const struct atDDP *dp; 133 register const struct atShortDDP *sdp; 134 u_short snet; 135 136 lp = (struct LAP *)bp; 137 bp += sizeof(*lp); 138 length -= sizeof(*lp); 139 switch (lp->type) { 140 141 case lapShortDDP: 142 if (length < ddpSSize) { 143 (void)printf(" [|sddp %d]", length); 144 return; 145 } 146 sdp = (const struct atShortDDP *)bp; 147 printf("%s.%s", 148 ataddr_string(0, lp->src), ddpskt_string(sdp->srcSkt)); 149 printf(" > %s.%s:", 150 ataddr_string(0, lp->dst), ddpskt_string(sdp->dstSkt)); 151 bp += ddpSSize; 152 length -= ddpSSize; 153 ddp_print(bp, length, sdp->type, 0, lp->src, sdp->srcSkt); 154 break; 155 156 case lapDDP: 157 if (length < ddpSize) { 158 (void)printf(" [|ddp %d]", length); 159 return; 160 } 161 dp = (const struct atDDP *)bp; 162 snet = EXTRACT_16BITS(&dp->srcNet); 163 printf("%s.%s", ataddr_string(snet, dp->srcNode), 164 ddpskt_string(dp->srcSkt)); 165 printf(" > %s.%s:", 166 ataddr_string(EXTRACT_16BITS(&dp->dstNet), dp->dstNode), 167 ddpskt_string(dp->dstSkt)); 168 bp += ddpSize; 169 length -= ddpSize; 170 ddp_print(bp, length, dp->type, snet, dp->srcNode, dp->srcSkt); 171 break; 172 173 #ifdef notdef 174 case lapKLAP: 175 klap_print(bp, length); 176 break; 177 #endif 178 179 default: 180 printf("%d > %d at-lap#%d %d", 181 lp->src, lp->dst, lp->type, length); 182 break; 183 } 184 } 185 186 /* XXX should probably pass in the snap header and do checks like arp_print() */ 187 void 188 aarp_print(register const u_char *bp, u_int length) 189 { 190 register const struct aarp *ap; 191 192 #define AT(member) ataddr_string((ap->member[1]<<8)|ap->member[2],ap->member[3]) 193 194 printf("aarp "); 195 ap = (const struct aarp *)bp; 196 if (ntohs(ap->htype) == 1 && ntohs(ap->ptype) == ETHERTYPE_ATALK && 197 ap->halen == 6 && ap->palen == 4 ) 198 switch (ntohs(ap->op)) { 199 200 case 1: /* request */ 201 (void)printf("who-has %s tell %s", 202 AT(pdaddr), AT(psaddr)); 203 return; 204 205 case 2: /* response */ 206 (void)printf("reply %s is-at %s", 207 AT(pdaddr), etheraddr_string(ap->hdaddr)); 208 return; 209 210 case 3: /* probe (oy!) */ 211 (void)printf("probe %s tell %s", 212 AT(pdaddr), AT(psaddr)); 213 return; 214 } 215 (void)printf("len %u op %u htype %u ptype %#x halen %u palen %u", 216 length, ntohs(ap->op), ntohs(ap->htype), ntohs(ap->ptype), 217 ap->halen, ap->palen); 218 } 219 220 static void 221 ddp_print(register const u_char *bp, register u_int length, register int t, 222 register u_short snet, register u_char snode, u_char skt) 223 { 224 225 #ifdef LBL_ALIGN 226 if ((long)bp & 3) { 227 static u_char *abuf = NULL; 228 229 if (abuf == NULL) { 230 abuf = (u_char *)malloc(snaplen); 231 if (abuf == NULL) 232 error("ddp_print: malloc"); 233 } 234 memcpy(abuf, bp, min(length, snaplen)); 235 snapend += abuf - bp; 236 packetp = abuf; 237 bp = abuf; 238 } 239 #endif 240 241 switch (t) { 242 243 case ddpNBP: 244 nbp_print((const struct atNBP *)bp, length, snet, snode, skt); 245 break; 246 247 case ddpATP: 248 atp_print((const struct atATP *)bp, length); 249 break; 250 251 default: 252 (void)printf(" at-%s %d", tok2str(type2str, NULL, t), length); 253 break; 254 } 255 } 256 257 static void 258 atp_print(register const struct atATP *ap, u_int length) 259 { 260 char c; 261 u_int32_t data; 262 263 if ((const u_char *)(ap + 1) > snapend) { 264 /* Just bail if we don't have the whole chunk. */ 265 fputs(tstr, stdout); 266 return; 267 } 268 length -= sizeof(*ap); 269 switch (ap->control & 0xc0) { 270 271 case atpReqCode: 272 (void)printf(" atp-req%s %d", 273 ap->control & atpXO? " " : "*", 274 EXTRACT_16BITS(&ap->transID)); 275 276 atp_bitmap_print(ap->bitmap); 277 278 if (length != 0) 279 (void)printf(" [len=%d]", length); 280 281 switch (ap->control & (atpEOM|atpSTS)) { 282 case atpEOM: 283 (void)printf(" [EOM]"); 284 break; 285 case atpSTS: 286 (void)printf(" [STS]"); 287 break; 288 case atpEOM|atpSTS: 289 (void)printf(" [EOM,STS]"); 290 break; 291 } 292 break; 293 294 case atpRspCode: 295 (void)printf(" atp-resp%s%d:%d (%d)", 296 ap->control & atpEOM? "*" : " ", 297 EXTRACT_16BITS(&ap->transID), ap->bitmap, length); 298 switch (ap->control & (atpXO|atpSTS)) { 299 case atpXO: 300 (void)printf(" [XO]"); 301 break; 302 case atpSTS: 303 (void)printf(" [STS]"); 304 break; 305 case atpXO|atpSTS: 306 (void)printf(" [XO,STS]"); 307 break; 308 } 309 break; 310 311 case atpRelCode: 312 (void)printf(" atp-rel %d", EXTRACT_16BITS(&ap->transID)); 313 314 atp_bitmap_print(ap->bitmap); 315 316 /* length should be zero */ 317 if (length) 318 (void)printf(" [len=%d]", length); 319 320 /* there shouldn't be any control flags */ 321 if (ap->control & (atpXO|atpEOM|atpSTS)) { 322 c = '['; 323 if (ap->control & atpXO) { 324 (void)printf("%cXO", c); 325 c = ','; 326 } 327 if (ap->control & atpEOM) { 328 (void)printf("%cEOM", c); 329 c = ','; 330 } 331 if (ap->control & atpSTS) { 332 (void)printf("%cSTS", c); 333 c = ','; 334 } 335 (void)printf("]"); 336 } 337 break; 338 339 default: 340 (void)printf(" atp-0x%x %d (%d)", ap->control, 341 EXTRACT_16BITS(&ap->transID), length); 342 break; 343 } 344 data = EXTRACT_32BITS(&ap->userData); 345 if (data != 0) 346 (void)printf(" 0x%x", data); 347 } 348 349 static void 350 atp_bitmap_print(register u_char bm) 351 { 352 register char c; 353 register int i; 354 355 /* 356 * The '& 0xff' below is needed for compilers that want to sign 357 * extend a u_char, which is the case with the Ultrix compiler. 358 * (gcc is smart enough to eliminate it, at least on the Sparc). 359 */ 360 if ((bm + 1) & (bm & 0xff)) { 361 c = '<'; 362 for (i = 0; bm; ++i) { 363 if (bm & 1) { 364 (void)printf("%c%d", c, i); 365 c = ','; 366 } 367 bm >>= 1; 368 } 369 (void)printf(">"); 370 } else { 371 for (i = 0; bm; ++i) 372 bm >>= 1; 373 if (i > 1) 374 (void)printf("<0-%d>", i - 1); 375 else 376 (void)printf("<0>"); 377 } 378 } 379 380 static void 381 nbp_print(register const struct atNBP *np, u_int length, register u_short snet, 382 register u_char snode, register u_char skt) 383 { 384 register const struct atNBPtuple *tp = 385 (struct atNBPtuple *)((u_char *)np + nbpHeaderSize); 386 int i; 387 const u_char *ep; 388 389 if (length < nbpHeaderSize) { 390 (void)printf(" truncated-nbp %d", length); 391 return; 392 } 393 394 length -= nbpHeaderSize; 395 if (length < 8) { 396 /* must be room for at least one tuple */ 397 if (np->control == nbpNATLKerr) { 398 (void)printf(" nbp-netatalk_err"); 399 return; 400 } else if (np->control == nbpNATLKok) { 401 (void)printf(" nbp-netatalk_ok"); 402 return; 403 } 404 (void)printf(" truncated-nbp nbp-0x%x %d (%d)", 405 np->control, np->id, length + nbpHeaderSize); 406 return; 407 } 408 /* ep points to end of available data */ 409 ep = snapend; 410 if ((const u_char *)tp > ep) { 411 fputs(tstr, stdout); 412 return; 413 } 414 switch (i = np->control & 0xf0) { 415 416 case nbpBrRq: 417 case nbpLkUp: 418 (void)printf(i == nbpLkUp? " nbp-lkup %d:":" nbp-brRq %d:", 419 np->id); 420 if ((const u_char *)(tp + 1) > ep) { 421 fputs(tstr, stdout); 422 return; 423 } 424 (void)nbp_name_print(tp, ep); 425 /* 426 * look for anomalies: the spec says there can only 427 * be one tuple, the address must match the source 428 * address and the enumerator should be zero. 429 */ 430 if ((np->control & 0xf) != 1) 431 (void)printf(" [ntup=%d]", np->control & 0xf); 432 if (tp->enumerator) 433 (void)printf(" [enum=%d]", tp->enumerator); 434 if (EXTRACT_16BITS(&tp->net) != snet || 435 tp->node != snode || tp->skt != skt) 436 (void)printf(" [addr=%s.%d]", 437 ataddr_string(EXTRACT_16BITS(&tp->net), 438 tp->node), tp->skt); 439 break; 440 441 case nbpLkUpReply: 442 (void)printf(" nbp-reply %d:", np->id); 443 444 /* print each of the tuples in the reply */ 445 for (i = np->control & 0xf; --i >= 0 && tp; ) 446 tp = nbp_tuple_print(tp, ep, snet, snode, skt); 447 break; 448 449 case nbpNATLKrgstr: 450 case nbpNATLKunrgstr: 451 (void)printf((i == nbpNATLKrgstr) ? 452 " nbp-netatalk_rgstr %d:" : 453 " nbp-netatalk_unrgstr %d:", 454 np->id); 455 for (i = np->control & 0xf; --i >= 0 && tp; ) 456 tp = nbp_tuple_print(tp, ep, snet, snode, skt); 457 break; 458 459 default: 460 (void)printf(" nbp-0x%x %d (%d)", np->control, np->id, 461 length); 462 break; 463 } 464 } 465 466 /* print a counted string */ 467 static const char * 468 print_cstring(register const char *cp, register const u_char *ep) 469 { 470 register u_int length; 471 472 if (cp >= (const char *)ep) { 473 fputs(tstr, stdout); 474 return (0); 475 } 476 length = *cp++; 477 478 /* Spec says string can be at most 32 bytes long */ 479 if (length < 0 || length > 32) { 480 (void)printf("[len=%d]", length); 481 return (0); 482 } 483 while ((int)--length >= 0) { 484 if (cp >= (char *)ep) { 485 fputs(tstr, stdout); 486 return (0); 487 } 488 putchar(*cp++); 489 } 490 return (cp); 491 } 492 493 static const struct atNBPtuple * 494 nbp_tuple_print(register const struct atNBPtuple *tp, 495 register const u_char *ep, 496 register u_short snet, register u_char snode, 497 register u_char skt) 498 { 499 register const struct atNBPtuple *tpn; 500 501 if ((const u_char *)(tp + 1) > ep) { 502 fputs(tstr, stdout); 503 return 0; 504 } 505 tpn = nbp_name_print(tp, ep); 506 507 /* if the enumerator isn't 1, print it */ 508 if (tp->enumerator != 1) 509 (void)printf("(%d)", tp->enumerator); 510 511 /* if the socket doesn't match the src socket, print it */ 512 if (tp->skt != skt) 513 (void)printf(" %d", tp->skt); 514 515 /* if the address doesn't match the src address, it's an anomaly */ 516 if (EXTRACT_16BITS(&tp->net) != snet || tp->node != snode) 517 (void)printf(" [addr=%s]", 518 ataddr_string(EXTRACT_16BITS(&tp->net), tp->node)); 519 520 return (tpn); 521 } 522 523 static const struct atNBPtuple * 524 nbp_name_print(const struct atNBPtuple *tp, register const u_char *ep) 525 { 526 register const char *cp = (const char *)tp + nbpTupleSize; 527 528 putchar(' '); 529 530 /* Object */ 531 putchar('"'); 532 if ((cp = print_cstring(cp, ep)) != NULL) { 533 /* Type */ 534 putchar(':'); 535 if ((cp = print_cstring(cp, ep)) != NULL) { 536 /* Zone */ 537 putchar('@'); 538 if ((cp = print_cstring(cp, ep)) != NULL) 539 putchar('"'); 540 } 541 } 542 return ((const struct atNBPtuple *)cp); 543 } 544 545 546 #define HASHNAMESIZE 4096 547 548 struct hnamemem { 549 int addr; 550 char *name; 551 struct hnamemem *nxt; 552 }; 553 554 static struct hnamemem hnametable[HASHNAMESIZE]; 555 556 static const char * 557 ataddr_string(u_short atnet, u_char athost) 558 { 559 register struct hnamemem *tp, *tp2; 560 register int i = (atnet << 8) | athost; 561 char nambuf[MAXHOSTNAMELEN + 20]; 562 static int first = 1; 563 FILE *fp; 564 565 /* 566 * if this is the first call, see if there's an AppleTalk 567 * number to name map file. 568 */ 569 if (first && (first = 0, !nflag) 570 && (fp = fopen("/etc/atalk.names", "r"))) { 571 char line[256]; 572 int i1, i2, i3; 573 574 while (fgets(line, sizeof(line), fp)) { 575 if (line[0] == '\n' || line[0] == 0 || line[0] == '#') 576 continue; 577 if (sscanf(line, "%d.%d.%d %255s", &i1, &i2, &i3, 578 nambuf) == 4) 579 /* got a hostname. */ 580 i3 |= ((i1 << 8) | i2) << 8; 581 else if (sscanf(line, "%d.%d %255s", &i1, &i2, 582 nambuf) == 3) 583 /* got a net name */ 584 i3 = (((i1 << 8) | i2) << 8) | 255; 585 else 586 continue; 587 588 for (tp = &hnametable[i3 & (HASHNAMESIZE-1)]; 589 tp->nxt; tp = tp->nxt) 590 ; 591 tp->addr = i3; 592 tp->nxt = newhnamemem(); 593 tp->name = savestr(nambuf); 594 } 595 fclose(fp); 596 } 597 598 for (tp = &hnametable[i & (HASHNAMESIZE-1)]; tp->nxt; tp = tp->nxt) 599 if (tp->addr == i) 600 return (tp->name); 601 602 /* didn't have the node name -- see if we've got the net name */ 603 i |= 255; 604 for (tp2 = &hnametable[i & (HASHNAMESIZE-1)]; tp2->nxt; tp2 = tp2->nxt) 605 if (tp2->addr == i) { 606 tp->addr = (atnet << 8) | athost; 607 tp->nxt = newhnamemem(); 608 (void)snprintf(nambuf, sizeof nambuf, "%s.%d", 609 tp2->name, athost); 610 tp->name = savestr(nambuf); 611 return (tp->name); 612 } 613 614 tp->addr = (atnet << 8) | athost; 615 tp->nxt = newhnamemem(); 616 if (athost != 255) 617 (void)snprintf(nambuf, sizeof nambuf, "%d.%d.%d", 618 atnet >> 8, atnet & 0xff, athost); 619 else 620 (void)snprintf(nambuf, sizeof nambuf, "%d.%d", 621 atnet >> 8, atnet & 0xff); 622 tp->name = savestr(nambuf); 623 624 return (tp->name); 625 } 626 627 static struct tok skt2str[] = { 628 { rtmpSkt, "rtmp" }, /* routing table maintenance */ 629 { nbpSkt, "nis" }, /* name info socket */ 630 { echoSkt, "echo" }, /* AppleTalk echo protocol */ 631 { zipSkt, "zip" }, /* zone info protocol */ 632 { 0, NULL } 633 }; 634 635 static const char * 636 ddpskt_string(register int skt) 637 { 638 static char buf[12]; 639 640 if (nflag) { 641 (void)snprintf(buf, sizeof buf, "%d", skt); 642 return (buf); 643 } 644 return (tok2str(skt2str, "%d", skt)); 645 } 646