2 * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997
3 * The Regents of the University of California. All rights reserved.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
22 /* \summary: AppleTalk printer */
28 #include "netdissect-stdinc.h"
33 #include "netdissect.h"
34 #include "addrtoname.h"
35 #include "ethertype.h"
37 #include "appletalk.h"
40 static const struct tok type2str[] = {
42 { ddpRTMPrequest, "rtmpReq" },
51 nd_uint16_t htype, ptype;
52 nd_uint8_t halen, palen;
60 static void atp_print(netdissect_options *, const struct atATP *, u_int);
61 static void atp_bitmap_print(netdissect_options *, u_char);
62 static void nbp_print(netdissect_options *, const struct atNBP *, u_int, u_short, u_char, u_char);
63 static const struct atNBPtuple *nbp_tuple_print(netdissect_options *ndo, const struct atNBPtuple *,
65 u_short, u_char, u_char);
66 static const struct atNBPtuple *nbp_name_print(netdissect_options *, const struct atNBPtuple *,
68 static const char *ataddr_string(netdissect_options *, u_short, u_char);
69 static void ddp_print(netdissect_options *, const u_char *, u_int, u_int, u_short, u_char, u_char);
70 static const char *ddpskt_string(netdissect_options *, u_int);
73 * Print LLAP packets received on a physical LocalTalk interface.
76 ltalk_if_print(netdissect_options *ndo,
77 const struct pcap_pkthdr *h, const u_char *p)
81 ndo->ndo_protocol = "ltalk";
82 hdrlen = llap_print(ndo, p, h->len);
84 /* Cut short by the snapshot length. */
85 ndo->ndo_ll_hdr_len += h->caplen;
88 ndo->ndo_ll_hdr_len += hdrlen;
92 * Print AppleTalk LLAP packets.
95 llap_print(netdissect_options *ndo,
96 const u_char *bp, u_int length)
99 const struct atDDP *dp;
100 const struct atShortDDP *sdp;
104 ndo->ndo_protocol = "llap";
105 if (length < sizeof(*lp)) {
106 ND_PRINT(" [|llap %u]", length);
109 if (!ND_TTEST_LEN(bp, sizeof(*lp))) {
111 return (0); /* cut short by the snapshot length */
113 lp = (const struct LAP *)bp;
115 length -= sizeof(*lp);
116 hdrlen = sizeof(*lp);
117 switch (GET_U_1(lp->type)) {
120 if (length < ddpSSize) {
121 ND_PRINT(" [|sddp %u]", length);
124 if (!ND_TTEST_LEN(bp, ddpSSize)) {
125 ND_PRINT(" [|sddp]");
126 return (0); /* cut short by the snapshot length */
128 sdp = (const struct atShortDDP *)bp;
130 ataddr_string(ndo, 0, GET_U_1(lp->src)),
131 ddpskt_string(ndo, GET_U_1(sdp->srcSkt)));
132 ND_PRINT(" > %s.%s:",
133 ataddr_string(ndo, 0, GET_U_1(lp->dst)),
134 ddpskt_string(ndo, GET_U_1(sdp->dstSkt)));
138 ddp_print(ndo, bp, length, GET_U_1(sdp->type), 0,
139 GET_U_1(lp->src), GET_U_1(sdp->srcSkt));
143 if (length < ddpSize) {
144 ND_PRINT(" [|ddp %u]", length);
147 if (!ND_TTEST_LEN(bp, ddpSize)) {
149 return (0); /* cut short by the snapshot length */
151 dp = (const struct atDDP *)bp;
152 snet = GET_BE_U_2(dp->srcNet);
154 ataddr_string(ndo, snet, GET_U_1(dp->srcNode)),
155 ddpskt_string(ndo, GET_U_1(dp->srcSkt)));
156 ND_PRINT(" > %s.%s:",
157 ataddr_string(ndo, GET_BE_U_2(dp->dstNet), GET_U_1(dp->dstNode)),
158 ddpskt_string(ndo, GET_U_1(dp->dstSkt)));
162 ddp_print(ndo, bp, length, GET_U_1(dp->type), snet,
163 GET_U_1(dp->srcNode), GET_U_1(dp->srcSkt));
168 klap_print(bp, length);
173 ND_PRINT("%u > %u at-lap#%u %u",
174 GET_U_1(lp->src), GET_U_1(lp->dst), GET_U_1(lp->type),
182 * Print EtherTalk/TokenTalk packets (or FDDITalk, or whatever it's called
183 * when it runs over FDDI; yes, I've seen FDDI captures with AppleTalk
187 atalk_print(netdissect_options *ndo,
188 const u_char *bp, u_int length)
190 const struct atDDP *dp;
193 ndo->ndo_protocol = "atalk";
197 if (length < ddpSize) {
198 ND_PRINT(" [|ddp %u]", length);
201 if (!ND_TTEST_LEN(bp, ddpSize)) {
205 dp = (const struct atDDP *)bp;
206 snet = GET_BE_U_2(dp->srcNet);
207 ND_PRINT("%s.%s", ataddr_string(ndo, snet, GET_U_1(dp->srcNode)),
208 ddpskt_string(ndo, GET_U_1(dp->srcSkt)));
209 ND_PRINT(" > %s.%s: ",
210 ataddr_string(ndo, GET_BE_U_2(dp->dstNet), GET_U_1(dp->dstNode)),
211 ddpskt_string(ndo, GET_U_1(dp->dstSkt)));
214 ddp_print(ndo, bp, length, GET_U_1(dp->type), snet,
215 GET_U_1(dp->srcNode), GET_U_1(dp->srcSkt));
218 /* XXX should probably pass in the snap header and do checks like arp_print() */
220 aarp_print(netdissect_options *ndo,
221 const u_char *bp, u_int length)
223 const struct aarp *ap;
225 #define AT(member) ataddr_string(ndo, (ap->member[1]<<8)|ap->member[2],ap->member[3])
227 ndo->ndo_protocol = "aarp";
229 ap = (const struct aarp *)bp;
230 if (!ND_TTEST_SIZE(ap)) {
231 /* Just bail if we don't have the whole chunk. */
235 if (length < sizeof(*ap)) {
236 ND_PRINT(" [|aarp %u]", length);
239 if (GET_BE_U_2(ap->htype) == 1 &&
240 GET_BE_U_2(ap->ptype) == ETHERTYPE_ATALK &&
241 GET_U_1(ap->halen) == MAC_ADDR_LEN && GET_U_1(ap->palen) == 4)
242 switch (GET_BE_U_2(ap->op)) {
244 case 1: /* request */
245 ND_PRINT("who-has %s tell %s", AT(pdaddr), AT(psaddr));
248 case 2: /* response */
249 ND_PRINT("reply %s is-at %s", AT(psaddr), GET_ETHERADDR_STRING(ap->hsaddr));
252 case 3: /* probe (oy!) */
253 ND_PRINT("probe %s tell %s", AT(pdaddr), AT(psaddr));
256 ND_PRINT("len %u op %u htype %u ptype %#x halen %u palen %u",
257 length, GET_BE_U_2(ap->op), GET_BE_U_2(ap->htype),
258 GET_BE_U_2(ap->ptype), GET_U_1(ap->halen), GET_U_1(ap->palen));
262 * Print AppleTalk Datagram Delivery Protocol packets.
265 ddp_print(netdissect_options *ndo,
266 const u_char *bp, u_int length, u_int t,
267 u_short snet, u_char snode, u_char skt)
273 nbp_print(ndo, (const struct atNBP *)bp, length, snet, snode, skt);
277 atp_print(ndo, (const struct atATP *)bp, length);
281 eigrp_print(ndo, bp, length);
285 ND_PRINT(" at-%s %u", tok2str(type2str, NULL, t), length);
291 atp_print(netdissect_options *ndo,
292 const struct atATP *ap, u_int length)
297 if ((const u_char *)(ap + 1) > ndo->ndo_snapend) {
298 /* Just bail if we don't have the whole chunk. */
302 if (length < sizeof(*ap)) {
303 ND_PRINT(" [|atp %u]", length);
306 length -= sizeof(*ap);
307 control = GET_U_1(ap->control);
308 switch (control & 0xc0) {
311 ND_PRINT(" atp-req%s %u",
312 control & atpXO? " " : "*",
313 GET_BE_U_2(ap->transID));
315 atp_bitmap_print(ndo, GET_U_1(ap->bitmap));
318 ND_PRINT(" [len=%u]", length);
320 switch (control & (atpEOM|atpSTS)) {
328 ND_PRINT(" [EOM,STS]");
334 ND_PRINT(" atp-resp%s%u:%u (%u)",
335 control & atpEOM? "*" : " ",
336 GET_BE_U_2(ap->transID), GET_U_1(ap->bitmap),
338 switch (control & (atpXO|atpSTS)) {
346 ND_PRINT(" [XO,STS]");
352 ND_PRINT(" atp-rel %u", GET_BE_U_2(ap->transID));
354 atp_bitmap_print(ndo, GET_U_1(ap->bitmap));
356 /* length should be zero */
358 ND_PRINT(" [len=%u]", length);
360 /* there shouldn't be any control flags */
361 if (control & (atpXO|atpEOM|atpSTS)) {
363 if (control & atpXO) {
367 if (control & atpEOM) {
368 ND_PRINT("%cEOM", c);
371 if (control & atpSTS) {
372 ND_PRINT("%cSTS", c);
379 ND_PRINT(" atp-0x%x %u (%u)", control,
380 GET_BE_U_2(ap->transID), length);
383 data = GET_BE_U_4(ap->userData);
385 ND_PRINT(" 0x%x", data);
389 atp_bitmap_print(netdissect_options *ndo,
395 * The '& 0xff' below is needed for compilers that want to sign
396 * extend a u_char, which is the case with the Ultrix compiler.
397 * (gcc is smart enough to eliminate it, at least on the Sparc).
399 if ((bm + 1) & (bm & 0xff)) {
401 for (i = 0; bm; ++i) {
403 ND_PRINT("%c%u", c, i);
413 ND_PRINT("<0-%u>", i - 1);
420 nbp_print(netdissect_options *ndo,
421 const struct atNBP *np, u_int length, u_short snet,
422 u_char snode, u_char skt)
424 const struct atNBPtuple *tp =
425 (const struct atNBPtuple *)((const u_char *)np + nbpHeaderSize);
430 if (length < nbpHeaderSize) {
431 ND_PRINT(" truncated-nbp %u", length);
435 length -= nbpHeaderSize;
437 /* must be room for at least one tuple */
438 ND_PRINT(" truncated-nbp %u", length + nbpHeaderSize);
441 /* ep points to end of available data */
442 ep = ndo->ndo_snapend;
443 if ((const u_char *)tp > ep) {
447 control = GET_U_1(np->control);
448 switch (i = (control & 0xf0)) {
452 ND_PRINT(i == nbpLkUp? " nbp-lkup %u:":" nbp-brRq %u:",
454 if ((const u_char *)(tp + 1) > ep) {
458 (void)nbp_name_print(ndo, tp, ep);
460 * look for anomalies: the spec says there can only
461 * be one tuple, the address must match the source
462 * address and the enumerator should be zero.
464 if ((control & 0xf) != 1)
465 ND_PRINT(" [ntup=%u]", control & 0xf);
466 if (GET_U_1(tp->enumerator))
467 ND_PRINT(" [enum=%u]", GET_U_1(tp->enumerator));
468 if (GET_BE_U_2(tp->net) != snet ||
469 GET_U_1(tp->node) != snode ||
470 GET_U_1(tp->skt) != skt)
471 ND_PRINT(" [addr=%s.%u]",
472 ataddr_string(ndo, GET_BE_U_2(tp->net),
478 ND_PRINT(" nbp-reply %u:", GET_U_1(np->id));
480 /* print each of the tuples in the reply */
481 for (i = control & 0xf; i != 0 && tp; i--)
482 tp = nbp_tuple_print(ndo, tp, ep, snet, snode, skt);
486 ND_PRINT(" nbp-0x%x %u (%u)", control, GET_U_1(np->id),
492 /* print a counted string */
493 static const u_char *
494 print_cstring(netdissect_options *ndo,
495 const u_char *cp, const u_char *ep)
503 length = GET_U_1(cp);
506 /* Spec says string can be at most 32 bytes long */
508 ND_PRINT("[len=%u]", length);
511 while (length != 0) {
516 fn_print_char(ndo, GET_U_1(cp));
523 static const struct atNBPtuple *
524 nbp_tuple_print(netdissect_options *ndo,
525 const struct atNBPtuple *tp, const u_char *ep,
526 u_short snet, u_char snode, u_char skt)
528 const struct atNBPtuple *tpn;
530 if ((const u_char *)(tp + 1) > ep) {
534 tpn = nbp_name_print(ndo, tp, ep);
536 /* if the enumerator isn't 1, print it */
537 if (GET_U_1(tp->enumerator) != 1)
538 ND_PRINT("(%u)", GET_U_1(tp->enumerator));
540 /* if the socket doesn't match the src socket, print it */
541 if (GET_U_1(tp->skt) != skt)
542 ND_PRINT(" %u", GET_U_1(tp->skt));
544 /* if the address doesn't match the src address, it's an anomaly */
545 if (GET_BE_U_2(tp->net) != snet ||
546 GET_U_1(tp->node) != snode)
547 ND_PRINT(" [addr=%s]",
548 ataddr_string(ndo, GET_BE_U_2(tp->net), GET_U_1(tp->node)));
553 static const struct atNBPtuple *
554 nbp_name_print(netdissect_options *ndo,
555 const struct atNBPtuple *tp, const u_char *ep)
557 const u_char *cp = (const u_char *)tp + nbpTupleSize;
563 if ((cp = print_cstring(ndo, cp, ep)) != NULL) {
566 if ((cp = print_cstring(ndo, cp, ep)) != NULL) {
569 if ((cp = print_cstring(ndo, cp, ep)) != NULL)
573 return ((const struct atNBPtuple *)cp);
577 #define HASHNAMESIZE 4096
582 struct hnamemem *nxt;
585 static struct hnamemem hnametable[HASHNAMESIZE];
588 ataddr_string(netdissect_options *ndo,
589 u_short atnet, u_char athost)
591 struct hnamemem *tp, *tp2;
592 u_int i = (atnet << 8) | athost;
594 static int first = 1;
598 * Are we doing address to name resolution?
600 if (!ndo->ndo_nflag) {
602 * Yes. Have we tried to open and read an AppleTalk
603 * number to name map file?
610 fp = fopen("/etc/atalk.names", "r");
615 while (fgets(line, sizeof(line), fp)) {
616 if (line[0] == '\n' || line[0] == 0 ||
619 if (sscanf(line, "%u.%u %256s", &i1,
621 /* got a hostname. */
623 else if (sscanf(line, "%u %256s", &i1,
626 i2 = (i1 << 8) | 255;
630 for (tp = &hnametable[i2 & (HASHNAMESIZE-1)];
631 tp->nxt; tp = tp->nxt)
634 tp->nxt = newhnamemem(ndo);
635 tp->name = strdup(nambuf);
636 if (tp->name == NULL)
637 (*ndo->ndo_error)(ndo,
639 "%s: strdup(nambuf)", __func__);
647 * Now try to look up the address in the table.
649 for (tp = &hnametable[i & (HASHNAMESIZE-1)]; tp->nxt; tp = tp->nxt)
653 /* didn't have the node name -- see if we've got the net name */
655 for (tp2 = &hnametable[i & (HASHNAMESIZE-1)]; tp2->nxt; tp2 = tp2->nxt)
656 if (tp2->addr == i) {
657 tp->addr = (atnet << 8) | athost;
658 tp->nxt = newhnamemem(ndo);
659 (void)snprintf(nambuf, sizeof(nambuf), "%s.%u",
661 tp->name = strdup(nambuf);
662 if (tp->name == NULL)
663 (*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
664 "%s: strdup(nambuf)", __func__);
668 tp->addr = (atnet << 8) | athost;
669 tp->nxt = newhnamemem(ndo);
671 (void)snprintf(nambuf, sizeof(nambuf), "%u.%u", atnet, athost);
673 (void)snprintf(nambuf, sizeof(nambuf), "%u", atnet);
674 tp->name = strdup(nambuf);
675 if (tp->name == NULL)
676 (*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
677 "%s: strdup(nambuf)", __func__);
682 static const struct tok skt2str[] = {
683 { rtmpSkt, "rtmp" }, /* routing table maintenance */
684 { nbpSkt, "nis" }, /* name info socket */
685 { echoSkt, "echo" }, /* AppleTalk echo protocol */
686 { zipSkt, "zip" }, /* zone info protocol */
691 ddpskt_string(netdissect_options *ndo,
696 if (ndo->ndo_nflag) {
697 (void)snprintf(buf, sizeof(buf), "%u", skt);
700 return (tok2str(skt2str, "%u", skt));