Print out SNAP frames reasonably, including Apple's bogus Ethertalk

pseudo-SNAP encapsulation.  Still needs some work, by someone who
has a listing of 802.2 LSAPs.

1 files changed, 126 insertions, 1 deletions

diff --git a/usr.sbin/tcpdump/tcpdump/print-ether.c b/usr.sbin/tcpdump/tcpdump/print-ether.c
index 2d01c17..563a506 100644
--- a/usr.sbin/tcpdump/tcpdump/print-ether.c
+++ b/usr.sbin/tcpdump/tcpdump/print-ether.c
@@ -20,13 +20,14 @@
  */
 #ifndef lint
 static char rcsid[] =
-    "@(#) $Header: print-ether.c,v 1.22 91/10/07 20:18:28 leres Exp $ (LBL)";
+    "@(#) $Header: /home/ncvs/src/usr.sbin/tcpdump/tcpdump/print-ether.c,v 1.1.1.1 1993/06/12 14:42:09 rgrimes Exp $ (LBL)";
 #endif
 
 #include <sys/param.h>
 #include <sys/types.h>
 #include <sys/socket.h>
 #include <net/if.h>
+#include <net/if_llc.h>
 #include <netinet/in.h>
 #include <netinet/if_ether.h>
 #include <netinet/in_systm.h>
@@ -39,6 +40,7 @@ static char rcsid[] =
 
 #include "interface.h"
 #include "addrtoname.h"
+#include "appletalk.h"
 
 u_char *packetp;
 u_char *snapend;
@@ -61,6 +63,123 @@ ether_print(ep, length)
 			     length);
 }
 
+static inline void
+eight02_print(ep, lp, length)
+	register struct ether_header *ep;
+	struct llc *lp;
+	int length;
+{
+	if(eflag || length < LLC_UFRAMELEN) {
+		(void)printf("%s %s %d: ",
+			     etheraddr_string(ESRC(ep)),
+			     etheraddr_string(EDST(ep)),
+			     length);
+	}
+
+	if(length < LLC_UFRAMELEN) {
+		printf("[|llc]");
+		return;
+	}
+
+	if(eflag && lp->llc_dsap != LLC_SNAP_LSAP) {
+		switch(lp->llc_control) {
+		case LLC_UI:	printf("ui "); break;
+		case LLC_UI_P:	printf("ui-p "); break;
+		case LLC_DISC:	printf("disc "); break;
+		case LLC_DISC_P: printf("disc-p "); break;
+		case LLC_UA:	printf("ua "); break;
+		case LLC_UA_P:	printf("ua-p "); break;
+		case LLC_TEST:	printf("test "); break;
+		case LLC_TEST_P: printf("test-p "); break;
+		case LLC_FRMR:	printf("frmr "); break;
+		case LLC_FRMR_P: printf("frmr-p "); break;
+		case LLC_DM:	printf("dm "); break;
+		case LLC_DM_P:	printf("dm-p "); break;
+		case LLC_XID:	printf("xid "); break;
+		case LLC_XID_P:	printf("xid-p "); break;
+		case LLC_SABME:	printf("sabme "); break;
+		case LLC_SABME_P: printf("sabme-p "); break;
+		case LLC_RR:	printf("rr "); break;
+		case LLC_RNR:	printf("rnr "); break;
+		case LLC_REJ:	printf("rej "); break;
+		case LLC_INFO:	printf("info "); break;
+
+		default:
+			printf("[control %d] ", lp->llc_control);
+			break;
+		}
+	}
+	switch(lp->llc_dsap) {
+	case LLC_SNAP_LSAP:
+		if(length < 6) {
+			printf(" [|snap]");
+			return;
+		}
+
+#define llc_snap_oui	llc_un.type_snap.org_code
+#define llc_snap_type	llc_un.type_snap.ether_type
+		if(lp->llc_snap_oui[0] == 0x08
+		   && lp->llc_snap_oui[1] == 0x00
+		   && lp->llc_snap_oui[2] == 0x07) {
+			printf("[ethertalk] ");
+			ddp_print((struct atDDP *)((char *)lp + 6),
+				  length - 6);
+		} else {
+			if(!eflag) {
+				(void)printf("%s %s %d: ",
+					     etheraddr_string(ESRC(ep)),
+					     etheraddr_string(EDST(ep)),
+					     length);
+			}
+			printf("snap %02x-%02x-%02x type %04x ",
+			       lp->llc_snap_oui[0], lp->llc_snap_oui[1],
+			       lp->llc_snap_oui[2], lp->llc_snap_type);
+		}
+		break;
+
+	default:
+		if(!eflag) {
+			(void)printf("%s %s %d: ",
+				     etheraddr_string(ESRC(ep)),
+				     etheraddr_string(EDST(ep)),
+				     length);
+			switch(lp->llc_control) {
+			case LLC_UI:	printf("ui "); break;
+			case LLC_UI_P:	printf("ui-p "); break;
+			case LLC_DISC:	printf("disc "); break;
+			case LLC_DISC_P: printf("disc-p "); break;
+			case LLC_UA:	printf("ua "); break;
+			case LLC_UA_P:	printf("ua-p "); break;
+			case LLC_TEST:	printf("test "); break;
+			case LLC_TEST_P: printf("test-p "); break;
+			case LLC_FRMR:	printf("frmr "); break;
+			case LLC_FRMR_P: printf("frmr-p "); break;
+			case LLC_DM:	printf("dm "); break;
+			case LLC_DM_P:	printf("dm-p "); break;
+			case LLC_XID:	printf("xid "); break;
+			case LLC_XID_P:	printf("xid-p "); break;
+			case LLC_SABME:	printf("sabme "); break;
+			case LLC_SABME_P: printf("sabme-p "); break;
+			case LLC_RR:	printf("rr "); break;
+			case LLC_RNR:	printf("rnr "); break;
+			case LLC_REJ:	printf("rej "); break;
+			case LLC_INFO:	printf("info "); break;
+
+			default:
+				printf("[control %d] ", lp->llc_control);
+				break;
+			}
+		}
+
+		printf("[dsap %d] [ssap %d] ",
+		       lp->llc_dsap, lp->llc_ssap);
+		break;
+	}
+
+	if (xflag)
+		default_print((u_short *)lp, length);
+}
+
 /*
  * This is the top level routine of the printer.  'p' is the points
  * to the ether header of the packet, 'tvp' is the timestamp, 
@@ -110,8 +229,14 @@ ether_if_print(p, tvp, length, caplen)
 		break;
 
 	default:
+		if (ntohs(ep->ether_type) < 1500) {
+			eight02_print(ep, (struct llc *)p,
+				      caplen - sizeof(*ep));
+			goto out;
+		}
 		if (!eflag)
 			ether_print(ep, length);
+
 		if (!xflag && !qflag)
 			default_print((u_short *)p, caplen - sizeof(*ep));
 		break;