/* * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that: (1) source code * distributions retain the above copyright notice and this paragraph * in its entirety, and (2) distributions including binary code include * the above copyright notice and this paragraph in its entirety in * the documentation or other materials provided with the distribution. * THIS SOFTWARE IS PROVIDED ``AS IS'' AND * WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, WITHOUT * LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS * FOR A PARTICULAR PURPOSE. * * Original code by Hannes Gredler (hannes@juniper.net) */ #ifndef lint static const char rcsid[] _U_ = "@(#) $Header: /tcpdump/master/tcpdump/print-juniper.c,v 1.8 2005/04/06 21:32:41 mcr Exp $ (LBL)"; #endif #ifdef HAVE_CONFIG_H #include "config.h" #endif #include #include #include #include "interface.h" #include "extract.h" #include "ppp.h" #include "llc.h" #include "nlpid.h" #define JUNIPER_BPF_OUT 0 /* Outgoing packet */ #define JUNIPER_BPF_IN 1 /* Incoming packet */ #define JUNIPER_BPF_PKT_IN 0x1 /* Incoming packet */ #define JUNIPER_BPF_NO_L2 0x2 /* L2 header stripped */ #define LS_COOKIE_ID 0x54 #define LS_MLFR_LEN 4 #define ML_MLFR_LEN 2 #define ATM2_PKT_TYPE_MASK 0x70 #define ATM2_GAP_COUNT_MASK 0x3F int ip_heuristic_guess(register const u_char *, u_int); int juniper_ppp_heuristic_guess(register const u_char *, u_int); static int juniper_parse_header (const u_char *, u_int8_t *, u_int); u_int juniper_mlppp_print(const struct pcap_pkthdr *h, register const u_char *p) { register u_int length = h->len; register u_int caplen = h->caplen; u_int8_t direction,bundle,cookie_len; u_int32_t cookie,proto; if(juniper_parse_header(p, &direction,length) == 0) return 0; p+=4; length-=4; caplen-=4; if (p[0] == LS_COOKIE_ID) { cookie=EXTRACT_32BITS(p); if (eflag) printf("LSPIC-MLPPP cookie 0x%08x, ",cookie); cookie_len = LS_MLFR_LEN; bundle = cookie & 0xff; } else { cookie=EXTRACT_16BITS(p); if (eflag) printf("MLPIC-MLPPP cookie 0x%04x, ",cookie); cookie_len = ML_MLFR_LEN; bundle = (cookie >> 8) & 0xff; } proto = EXTRACT_16BITS(p+cookie_len); p += cookie_len; length-= cookie_len; caplen-= cookie_len; /* suppress Bundle-ID if frame was captured on a child-link * this may be the case if the cookie looks like a proto */ if (eflag && cookie != PPP_OSI && cookie != (PPP_ADDRESS << 8 | PPP_CONTROL)) printf("Bundle-ID %u, ",bundle); switch (cookie) { case PPP_OSI: ppp_print(p-2,length+2); break; case (PPP_ADDRESS << 8 | PPP_CONTROL): /* fall through */ default: ppp_print(p,length); break; } return cookie_len; } u_int juniper_mlfr_print(const struct pcap_pkthdr *h, register const u_char *p) { register u_int length = h->len; register u_int caplen = h->caplen; u_int8_t direction,bundle,cookie_len; u_int32_t cookie,proto,frelay_len = 0; if(juniper_parse_header(p, &direction,length) == 0) return 0; p+=4; length-=4; caplen-=4; if (p[0] == LS_COOKIE_ID) { cookie=EXTRACT_32BITS(p); if (eflag) printf("LSPIC-MLFR cookie 0x%08x, ",cookie); cookie_len = LS_MLFR_LEN; bundle = cookie & 0xff; } else { cookie=EXTRACT_16BITS(p); if (eflag) printf("MLPIC-MLFR cookie 0x%04x, ",cookie); cookie_len = ML_MLFR_LEN; bundle = (cookie >> 8) & 0xff; } proto = EXTRACT_16BITS(p+cookie_len); p += cookie_len+2; length-= cookie_len+2; caplen-= cookie_len+2; /* suppress Bundle-ID if frame was captured on a child-link */ if (eflag && cookie != 1) printf("Bundle-ID %u, ",bundle); switch (proto) { case (LLC_UI): case (LLC_UI<<8): isoclns_print(p, length, caplen); break; case (LLC_UI<<8 | NLPID_Q933): case (LLC_UI<<8 | NLPID_IP): case (LLC_UI<<8 | NLPID_IP6): isoclns_print(p-1, length+1, caplen+1); /* pass IP{4,6} to the OSI layer for proper link-layer printing */ break; default: printf("unknown protocol 0x%04x, length %u",proto, length); } return cookie_len + frelay_len; } /* * ATM1 PIC cookie format * * +-----+-------------------------+-------------------------------+ * |fmtid| vc index | channel ID | * +-----+-------------------------+-------------------------------+ */ u_int juniper_atm1_print(const struct pcap_pkthdr *h, register const u_char *p) { register u_int length = h->len; register u_int caplen = h->caplen; u_int16_t extracted_ethertype; u_int8_t direction; u_int32_t cookie1; if(juniper_parse_header(p, &direction,length) == 0) return 0; p+=4; length-=4; caplen-=4; cookie1=EXTRACT_32BITS(p); if (eflag) { /* FIXME decode channel-id, vc-index, fmt-id for once lets just hexdump the cookie */ printf("ATM1 cookie 0x%08x, ", cookie1); } p+=4; length-=4; caplen-=4; if ((cookie1 >> 24) == 0x80) { /* OAM cell ? */ oam_print(p,length); return 0; } if (EXTRACT_24BITS(p) == 0xfefe03 || /* NLPID encaps ? */ EXTRACT_24BITS(p) == 0xaaaa03) { /* SNAP encaps ? */ if (llc_print(p, length, caplen, NULL, NULL, &extracted_ethertype) != 0) return 8; } if (p[0] == 0x03) { /* Cisco style NLPID encaps ? */ isoclns_print(p + 1, length - 1, caplen - 1); /* FIXME check if frame was recognized */ return 8; } if(ip_heuristic_guess(p, length) != 0) /* last try - vcmux encaps ? */ return 0; return (8); } /* * ATM2 PIC cookie format * * +-------------------------------+---------+---+-----+-----------+ * | channel ID | reserv |AAL| CCRQ| gap cnt | * +-------------------------------+---------+---+-----+-----------+ */ u_int juniper_atm2_print(const struct pcap_pkthdr *h, register const u_char *p) { register u_int length = h->len; register u_int caplen = h->caplen; u_int16_t extracted_ethertype; u_int8_t direction; u_int32_t cookie1,cookie2; if(juniper_parse_header(p, &direction,length) == 0) return 0; p+=4; length-=4; caplen-=4; cookie1=EXTRACT_32BITS(p); cookie2=EXTRACT_32BITS(p+4); if (eflag) { /* FIXME decode channel, fmt-id, ccrq, aal, gap cnt for once lets just hexdump the cookie */ printf("ATM2 cookie 0x%08x%08x, ", EXTRACT_32BITS(p), EXTRACT_32BITS(p+4)); } p+=8; length-=8; caplen-=8; if (cookie2 & ATM2_PKT_TYPE_MASK) { /* OAM cell ? */ oam_print(p,length); return 12; } if (EXTRACT_24BITS(p) == 0xfefe03 || /* NLPID encaps ? */ EXTRACT_24BITS(p) == 0xaaaa03) { /* SNAP encaps ? */ if (llc_print(p, length, caplen, NULL, NULL, &extracted_ethertype) != 0) return 12; } if (direction != JUNIPER_BPF_PKT_IN && /* ether-over-1483 encaps ? */ (cookie1 & ATM2_GAP_COUNT_MASK)) { ether_print(p, length, caplen); return 12; } if (p[0] == 0x03) { /* Cisco style NLPID encaps ? */ isoclns_print(p + 1, length - 1, caplen - 1); /* FIXME check if frame was recognized */ return 12; } if(juniper_ppp_heuristic_guess(p, length) != 0) /* PPPoA vcmux encaps ? */ return 12; if(ip_heuristic_guess(p, length) != 0) /* last try - vcmux encaps ? */ return 12; return (12); } /* try to guess, based on all PPP protos that are supported in * a juniper router if the payload data is encapsulated using PPP */ int juniper_ppp_heuristic_guess(register const u_char *p, u_int length) { switch(EXTRACT_16BITS(p)) { case PPP_IP : case PPP_OSI : case PPP_MPLS_UCAST : case PPP_MPLS_MCAST : case PPP_IPCP : case PPP_OSICP : case PPP_MPLSCP : case PPP_LCP : case PPP_PAP : case PPP_CHAP : case PPP_ML : #ifdef INET6 case PPP_IPV6 : case PPP_IPV6CP : #endif ppp_print(p, length); break; default: return 0; /* did not find a ppp header */ break; } return 1; /* we printed a ppp packet */ } int ip_heuristic_guess(register const u_char *p, u_int length) { switch(p[0]) { case 0x45: case 0x46: case 0x47: case 0x48: case 0x49: case 0x4a: case 0x4b: case 0x4c: case 0x4d: case 0x4e: case 0x4f: ip_print(gndo, p, length); break; #ifdef INET6 case 0x60: case 0x61: case 0x62: case 0x63: case 0x64: case 0x65: case 0x66: case 0x67: case 0x68: case 0x69: case 0x6a: case 0x6b: case 0x6c: case 0x6d: case 0x6e: case 0x6f: ip6_print(p, length); break; #endif default: return 0; /* did not find a ip header */ break; } return 1; /* we printed an v4/v6 packet */ } static int juniper_parse_header (const u_char *p, u_int8_t *direction, u_int length) { *direction = p[3]&JUNIPER_BPF_PKT_IN; if (EXTRACT_24BITS(p) != 0x4d4743) /* magic number found ? */ return -1; if (*direction == JUNIPER_BPF_PKT_IN) { if (eflag) printf("%3s ", "In"); } else { if (eflag) printf("%3s ", "Out"); } if ((p[3] & JUNIPER_BPF_NO_L2 ) == JUNIPER_BPF_NO_L2 ) { if (eflag) printf("no-L2-hdr, "); /* there is no link-layer present - * perform the v4/v6 heuristics * to figure out what it is */ if(ip_heuristic_guess(p+8,length-8) == 0) printf("no IP-hdr found!"); return 0; /* stop parsing the output further */ } return 1; /* everything went ok so far. continue parsing */ } /* * Local Variables: * c-style: whitesmith * c-basic-offset: 8 * End: */