2 * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997
3 * The Regents of the University of California. All rights reserved.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
21 * Format and print AppleTalk packets.
24 #include <sys/cdefs.h>
26 __RCSID("$NetBSD: print-atalk.c,v 1.5 2014/11/20 03:05:03 christos Exp $");
29 #define NETDISSECT_REWORKED
34 #include <tcpdump-stdinc.h>
39 #include "interface.h"
40 #include "addrtoname.h"
41 #include "ethertype.h"
42 #include "extract.h" /* must come after interface.h */
43 #include "appletalk.h"
45 static const char tstr
[] = "[|atalk]";
47 static const struct tok type2str
[] = {
49 { ddpRTMPrequest
, "rtmpReq" },
58 uint16_t htype
, ptype
;
67 static void atp_print(netdissect_options
*, const struct atATP
*, u_int
);
68 static void atp_bitmap_print(netdissect_options
*, u_char
);
69 static void nbp_print(netdissect_options
*, const struct atNBP
*, u_int
, u_short
, u_char
, u_char
);
70 static const struct atNBPtuple
*nbp_tuple_print(netdissect_options
*ndo
, const struct atNBPtuple
*,
72 u_short
, u_char
, u_char
);
73 static const struct atNBPtuple
*nbp_name_print(netdissect_options
*, const struct atNBPtuple
*,
75 static const char *ataddr_string(netdissect_options
*, u_short
, u_char
);
76 static void ddp_print(netdissect_options
*, const u_char
*, u_int
, int, u_short
, u_char
, u_char
);
77 static const char *ddpskt_string(netdissect_options
*, int);
80 * Print LLAP packets received on a physical LocalTalk interface.
83 ltalk_if_print(netdissect_options
*ndo
,
84 const struct pcap_pkthdr
*h
, const u_char
*p
)
86 return (llap_print(ndo
, p
, h
->caplen
));
90 * Print AppleTalk LLAP packets.
93 llap_print(netdissect_options
*ndo
,
94 register const u_char
*bp
, u_int length
)
96 register const struct LAP
*lp
;
97 register const struct atDDP
*dp
;
98 register const struct atShortDDP
*sdp
;
102 if (length
< sizeof(*lp
)) {
103 ND_PRINT((ndo
, " [|llap %u]", length
));
106 lp
= (const struct LAP
*)bp
;
108 length
-= sizeof(*lp
);
109 hdrlen
= sizeof(*lp
);
113 if (length
< ddpSSize
) {
114 ND_PRINT((ndo
, " [|sddp %u]", length
));
117 sdp
= (const struct atShortDDP
*)bp
;
118 ND_PRINT((ndo
, "%s.%s",
119 ataddr_string(ndo
, 0, lp
->src
), ddpskt_string(ndo
, sdp
->srcSkt
)));
120 ND_PRINT((ndo
, " > %s.%s:",
121 ataddr_string(ndo
, 0, lp
->dst
), ddpskt_string(ndo
, sdp
->dstSkt
)));
125 ddp_print(ndo
, bp
, length
, sdp
->type
, 0, lp
->src
, sdp
->srcSkt
);
129 if (length
< ddpSize
) {
130 ND_PRINT((ndo
, " [|ddp %u]", length
));
133 dp
= (const struct atDDP
*)bp
;
134 snet
= EXTRACT_16BITS(&dp
->srcNet
);
135 ND_PRINT((ndo
, "%s.%s", ataddr_string(ndo
, snet
, dp
->srcNode
),
136 ddpskt_string(ndo
, dp
->srcSkt
)));
137 ND_PRINT((ndo
, " > %s.%s:",
138 ataddr_string(ndo
, EXTRACT_16BITS(&dp
->dstNet
), dp
->dstNode
),
139 ddpskt_string(ndo
, dp
->dstSkt
)));
143 ddp_print(ndo
, bp
, length
, dp
->type
, snet
, dp
->srcNode
, dp
->srcSkt
);
148 klap_print(bp
, length
);
153 ND_PRINT((ndo
, "%d > %d at-lap#%d %u",
154 lp
->src
, lp
->dst
, lp
->type
, length
));
161 * Print EtherTalk/TokenTalk packets (or FDDITalk, or whatever it's called
162 * when it runs over FDDI; yes, I've seen FDDI captures with AppleTalk
166 atalk_print(netdissect_options
*ndo
,
167 register const u_char
*bp
, u_int length
)
169 register const struct atDDP
*dp
;
173 ND_PRINT((ndo
, "AT "));
175 if (length
< ddpSize
) {
176 ND_PRINT((ndo
, " [|ddp %u]", length
));
179 dp
= (const struct atDDP
*)bp
;
180 snet
= EXTRACT_16BITS(&dp
->srcNet
);
181 ND_PRINT((ndo
, "%s.%s", ataddr_string(ndo
, snet
, dp
->srcNode
),
182 ddpskt_string(ndo
, dp
->srcSkt
)));
183 ND_PRINT((ndo
, " > %s.%s: ",
184 ataddr_string(ndo
, EXTRACT_16BITS(&dp
->dstNet
), dp
->dstNode
),
185 ddpskt_string(ndo
, dp
->dstSkt
)));
188 ddp_print(ndo
, bp
, length
, dp
->type
, snet
, dp
->srcNode
, dp
->srcSkt
);
191 /* XXX should probably pass in the snap header and do checks like arp_print() */
193 aarp_print(netdissect_options
*ndo
,
194 register const u_char
*bp
, u_int length
)
196 register const struct aarp
*ap
;
198 #define AT(member) ataddr_string(ndo, (ap->member[1]<<8)|ap->member[2],ap->member[3])
200 ND_PRINT((ndo
, "aarp "));
201 ap
= (const struct aarp
*)bp
;
202 if (EXTRACT_16BITS(&ap
->htype
) == 1 &&
203 EXTRACT_16BITS(&ap
->ptype
) == ETHERTYPE_ATALK
&&
204 ap
->halen
== 6 && ap
->palen
== 4 )
205 switch (EXTRACT_16BITS(&ap
->op
)) {
207 case 1: /* request */
208 ND_PRINT((ndo
, "who-has %s tell %s", AT(pdaddr
), AT(psaddr
)));
211 case 2: /* response */
212 ND_PRINT((ndo
, "reply %s is-at %s", AT(psaddr
), etheraddr_string(ndo
, ap
->hsaddr
)));
215 case 3: /* probe (oy!) */
216 ND_PRINT((ndo
, "probe %s tell %s", AT(pdaddr
), AT(psaddr
)));
219 ND_PRINT((ndo
, "len %u op %u htype %u ptype %#x halen %u palen %u",
220 length
, EXTRACT_16BITS(&ap
->op
), EXTRACT_16BITS(&ap
->htype
),
221 EXTRACT_16BITS(&ap
->ptype
), ap
->halen
, ap
->palen
));
225 * Print AppleTalk Datagram Delivery Protocol packets.
228 ddp_print(netdissect_options
*ndo
,
229 register const u_char
*bp
, register u_int length
, register int t
,
230 register u_short snet
, register u_char snode
, u_char skt
)
236 nbp_print(ndo
, (const struct atNBP
*)bp
, length
, snet
, snode
, skt
);
240 atp_print(ndo
, (const struct atATP
*)bp
, length
);
244 eigrp_print(ndo
, bp
, length
);
248 ND_PRINT((ndo
, " at-%s %d", tok2str(type2str
, NULL
, t
), length
));
254 atp_print(netdissect_options
*ndo
,
255 register const struct atATP
*ap
, u_int length
)
260 if ((const u_char
*)(ap
+ 1) > ndo
->ndo_snapend
) {
261 /* Just bail if we don't have the whole chunk. */
262 ND_PRINT((ndo
, "%s", tstr
));
265 if (length
< sizeof(*ap
)) {
266 ND_PRINT((ndo
, " [|atp %u]", length
));
269 length
-= sizeof(*ap
);
270 switch (ap
->control
& 0xc0) {
273 ND_PRINT((ndo
, " atp-req%s %d",
274 ap
->control
& atpXO
? " " : "*",
275 EXTRACT_16BITS(&ap
->transID
)));
277 atp_bitmap_print(ndo
, ap
->bitmap
);
280 ND_PRINT((ndo
, " [len=%u]", length
));
282 switch (ap
->control
& (atpEOM
|atpSTS
)) {
284 ND_PRINT((ndo
, " [EOM]"));
287 ND_PRINT((ndo
, " [STS]"));
290 ND_PRINT((ndo
, " [EOM,STS]"));
296 ND_PRINT((ndo
, " atp-resp%s%d:%d (%u)",
297 ap
->control
& atpEOM
? "*" : " ",
298 EXTRACT_16BITS(&ap
->transID
), ap
->bitmap
, length
));
299 switch (ap
->control
& (atpXO
|atpSTS
)) {
301 ND_PRINT((ndo
, " [XO]"));
304 ND_PRINT((ndo
, " [STS]"));
307 ND_PRINT((ndo
, " [XO,STS]"));
313 ND_PRINT((ndo
, " atp-rel %d", EXTRACT_16BITS(&ap
->transID
)));
315 atp_bitmap_print(ndo
, ap
->bitmap
);
317 /* length should be zero */
319 ND_PRINT((ndo
, " [len=%u]", length
));
321 /* there shouldn't be any control flags */
322 if (ap
->control
& (atpXO
|atpEOM
|atpSTS
)) {
324 if (ap
->control
& atpXO
) {
325 ND_PRINT((ndo
, "%cXO", c
));
328 if (ap
->control
& atpEOM
) {
329 ND_PRINT((ndo
, "%cEOM", c
));
332 if (ap
->control
& atpSTS
) {
333 ND_PRINT((ndo
, "%cSTS", c
));
336 ND_PRINT((ndo
, "]"));
341 ND_PRINT((ndo
, " atp-0x%x %d (%u)", ap
->control
,
342 EXTRACT_16BITS(&ap
->transID
), length
));
345 data
= EXTRACT_32BITS(&ap
->userData
);
347 ND_PRINT((ndo
, " 0x%x", data
));
351 atp_bitmap_print(netdissect_options
*ndo
,
358 * The '& 0xff' below is needed for compilers that want to sign
359 * extend a u_char, which is the case with the Ultrix compiler.
360 * (gcc is smart enough to eliminate it, at least on the Sparc).
362 if ((bm
+ 1) & (bm
& 0xff)) {
364 for (i
= 0; bm
; ++i
) {
366 ND_PRINT((ndo
, "%c%d", c
, i
));
371 ND_PRINT((ndo
, ">"));
376 ND_PRINT((ndo
, "<0-%d>", i
- 1));
378 ND_PRINT((ndo
, "<0>"));
383 nbp_print(netdissect_options
*ndo
,
384 register const struct atNBP
*np
, u_int length
, register u_short snet
,
385 register u_char snode
, register u_char skt
)
387 register const struct atNBPtuple
*tp
=
388 (const struct atNBPtuple
*)((u_char
*)np
+ nbpHeaderSize
);
392 if (length
< nbpHeaderSize
) {
393 ND_PRINT((ndo
, " truncated-nbp %u", length
));
397 length
-= nbpHeaderSize
;
399 /* must be room for at least one tuple */
400 ND_PRINT((ndo
, " truncated-nbp %u", length
+ nbpHeaderSize
));
403 /* ep points to end of available data */
404 ep
= ndo
->ndo_snapend
;
405 if ((const u_char
*)tp
> ep
) {
406 ND_PRINT((ndo
, "%s", tstr
));
409 switch (i
= np
->control
& 0xf0) {
413 ND_PRINT((ndo
, i
== nbpLkUp
? " nbp-lkup %d:":" nbp-brRq %d:", np
->id
));
414 if ((const u_char
*)(tp
+ 1) > ep
) {
415 ND_PRINT((ndo
, "%s", tstr
));
418 (void)nbp_name_print(ndo
, tp
, ep
);
420 * look for anomalies: the spec says there can only
421 * be one tuple, the address must match the source
422 * address and the enumerator should be zero.
424 if ((np
->control
& 0xf) != 1)
425 ND_PRINT((ndo
, " [ntup=%d]", np
->control
& 0xf));
427 ND_PRINT((ndo
, " [enum=%d]", tp
->enumerator
));
428 if (EXTRACT_16BITS(&tp
->net
) != snet
||
429 tp
->node
!= snode
|| tp
->skt
!= skt
)
430 ND_PRINT((ndo
, " [addr=%s.%d]",
431 ataddr_string(ndo
, EXTRACT_16BITS(&tp
->net
),
432 tp
->node
), tp
->skt
));
436 ND_PRINT((ndo
, " nbp-reply %d:", np
->id
));
438 /* print each of the tuples in the reply */
439 for (i
= np
->control
& 0xf; --i
>= 0 && tp
; )
440 tp
= nbp_tuple_print(ndo
, tp
, ep
, snet
, snode
, skt
);
444 ND_PRINT((ndo
, " nbp-0x%x %d (%u)", np
->control
, np
->id
, length
));
449 /* print a counted string */
451 print_cstring(netdissect_options
*ndo
,
452 register const char *cp
, register const u_char
*ep
)
454 register u_int length
;
456 if (cp
>= (const char *)ep
) {
457 ND_PRINT((ndo
, "%s", tstr
));
462 /* Spec says string can be at most 32 bytes long */
464 ND_PRINT((ndo
, "[len=%u]", length
));
467 while ((int)--length
>= 0) {
468 if (cp
>= (const char *)ep
) {
469 ND_PRINT((ndo
, "%s", tstr
));
472 ND_PRINT((ndo
, "%c", *cp
++));
477 static const struct atNBPtuple
*
478 nbp_tuple_print(netdissect_options
*ndo
,
479 register const struct atNBPtuple
*tp
, register const u_char
*ep
,
480 register u_short snet
, register u_char snode
, register u_char skt
)
482 register const struct atNBPtuple
*tpn
;
484 if ((const u_char
*)(tp
+ 1) > ep
) {
485 ND_PRINT((ndo
, "%s", tstr
));
488 tpn
= nbp_name_print(ndo
, tp
, ep
);
490 /* if the enumerator isn't 1, print it */
491 if (tp
->enumerator
!= 1)
492 ND_PRINT((ndo
, "(%d)", tp
->enumerator
));
494 /* if the socket doesn't match the src socket, print it */
496 ND_PRINT((ndo
, " %d", tp
->skt
));
498 /* if the address doesn't match the src address, it's an anomaly */
499 if (EXTRACT_16BITS(&tp
->net
) != snet
|| tp
->node
!= snode
)
500 ND_PRINT((ndo
, " [addr=%s]",
501 ataddr_string(ndo
, EXTRACT_16BITS(&tp
->net
), tp
->node
)));
506 static const struct atNBPtuple
*
507 nbp_name_print(netdissect_options
*ndo
,
508 const struct atNBPtuple
*tp
, register const u_char
*ep
)
510 register const char *cp
= (const char *)tp
+ nbpTupleSize
;
512 ND_PRINT((ndo
, " "));
515 ND_PRINT((ndo
, "\""));
516 if ((cp
= print_cstring(ndo
, cp
, ep
)) != NULL
) {
518 ND_PRINT((ndo
, ":"));
519 if ((cp
= print_cstring(ndo
, cp
, ep
)) != NULL
) {
521 ND_PRINT((ndo
, "@"));
522 if ((cp
= print_cstring(ndo
, cp
, ep
)) != NULL
)
523 ND_PRINT((ndo
, "\""));
526 return ((const struct atNBPtuple
*)cp
);
530 #define HASHNAMESIZE 4096
535 struct hnamemem
*nxt
;
538 static struct hnamemem hnametable
[HASHNAMESIZE
];
541 ataddr_string(netdissect_options
*ndo
,
542 u_short atnet
, u_char athost
)
544 register struct hnamemem
*tp
, *tp2
;
545 register int i
= (atnet
<< 8) | athost
;
547 static int first
= 1;
551 * if this is the first call, see if there's an AppleTalk
552 * number to name map file.
554 if (first
&& (first
= 0, !ndo
->ndo_nflag
)
555 && (fp
= fopen("/etc/atalk.names", "r"))) {
559 while (fgets(line
, sizeof(line
), fp
)) {
560 if (line
[0] == '\n' || line
[0] == 0 || line
[0] == '#')
562 if (sscanf(line
, "%d.%d %256s", &i1
, &i2
, nambuf
) == 3)
563 /* got a hostname. */
565 else if (sscanf(line
, "%d %256s", &i1
, nambuf
) == 2)
567 i2
= (i1
<< 8) | 255;
571 for (tp
= &hnametable
[i2
& (HASHNAMESIZE
-1)];
572 tp
->nxt
; tp
= tp
->nxt
)
575 tp
->nxt
= newhnamemem();
576 tp
->name
= strdup(nambuf
);
581 for (tp
= &hnametable
[i
& (HASHNAMESIZE
-1)]; tp
->nxt
; tp
= tp
->nxt
)
585 /* didn't have the node name -- see if we've got the net name */
587 for (tp2
= &hnametable
[i
& (HASHNAMESIZE
-1)]; tp2
->nxt
; tp2
= tp2
->nxt
)
588 if (tp2
->addr
== i
) {
589 tp
->addr
= (atnet
<< 8) | athost
;
590 tp
->nxt
= newhnamemem();
591 (void)snprintf(nambuf
, sizeof(nambuf
), "%s.%d",
593 tp
->name
= strdup(nambuf
);
597 tp
->addr
= (atnet
<< 8) | athost
;
598 tp
->nxt
= newhnamemem();
600 (void)snprintf(nambuf
, sizeof(nambuf
), "%d.%d", atnet
, athost
);
602 (void)snprintf(nambuf
, sizeof(nambuf
), "%d", atnet
);
603 tp
->name
= strdup(nambuf
);
608 static const struct tok skt2str
[] = {
609 { rtmpSkt
, "rtmp" }, /* routing table maintenance */
610 { nbpSkt
, "nis" }, /* name info socket */
611 { echoSkt
, "echo" }, /* AppleTalk echo protocol */
612 { zipSkt
, "zip" }, /* zone info protocol */
617 ddpskt_string(netdissect_options
*ndo
,
622 if (ndo
->ndo_nflag
) {
623 (void)snprintf(buf
, sizeof(buf
), "%d", skt
);
626 return (tok2str(skt2str
, "%d", skt
));