2 * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997
3 * The Regents of the University of California. All rights reserved.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
22 /* \summary: AppleTalk printer */
28 #include <netdissect-stdinc.h>
33 #include "netdissect.h"
34 #include "addrtoname.h"
35 #include "ethertype.h"
37 #include "appletalk.h"
39 static const char tstr[] = "[|atalk]";
41 static const struct tok type2str[] = {
43 { ddpRTMPrequest, "rtmpReq" },
52 uint16_t htype, ptype;
61 static void atp_print(netdissect_options *, const struct atATP *, u_int);
62 static void atp_bitmap_print(netdissect_options *, u_char);
63 static void nbp_print(netdissect_options *, const struct atNBP *, u_int, u_short, u_char, u_char);
64 static const struct atNBPtuple *nbp_tuple_print(netdissect_options *ndo, const struct atNBPtuple *,
66 u_short, u_char, u_char);
67 static const struct atNBPtuple *nbp_name_print(netdissect_options *, const struct atNBPtuple *,
69 static const char *ataddr_string(netdissect_options *, u_short, u_char);
70 static void ddp_print(netdissect_options *, const u_char *, u_int, int, u_short, u_char, u_char);
71 static const char *ddpskt_string(netdissect_options *, int);
74 * Print LLAP packets received on a physical LocalTalk interface.
77 ltalk_if_print(netdissect_options *ndo,
78 const struct pcap_pkthdr *h, const u_char *p)
82 hdrlen = llap_print(ndo, p, h->len);
84 /* Cut short by the snapshot length. */
91 * Print AppleTalk LLAP packets.
94 llap_print(netdissect_options *ndo,
95 register const u_char *bp, u_int length)
97 register const struct LAP *lp;
98 register const struct atDDP *dp;
99 register const struct atShortDDP *sdp;
103 if (length < sizeof(*lp)) {
104 ND_PRINT((ndo, " [|llap %u]", length));
107 if (!ND_TTEST2(*bp, sizeof(*lp))) {
108 ND_PRINT((ndo, " [|llap]"));
109 return (0); /* cut short by the snapshot length */
111 lp = (const struct LAP *)bp;
113 length -= sizeof(*lp);
114 hdrlen = sizeof(*lp);
118 if (length < ddpSSize) {
119 ND_PRINT((ndo, " [|sddp %u]", length));
122 if (!ND_TTEST2(*bp, ddpSSize)) {
123 ND_PRINT((ndo, " [|sddp]"));
124 return (0); /* cut short by the snapshot length */
126 sdp = (const struct atShortDDP *)bp;
127 ND_PRINT((ndo, "%s.%s",
128 ataddr_string(ndo, 0, lp->src), ddpskt_string(ndo, sdp->srcSkt)));
129 ND_PRINT((ndo, " > %s.%s:",
130 ataddr_string(ndo, 0, lp->dst), ddpskt_string(ndo, sdp->dstSkt)));
134 ddp_print(ndo, bp, length, sdp->type, 0, lp->src, sdp->srcSkt);
138 if (length < ddpSize) {
139 ND_PRINT((ndo, " [|ddp %u]", length));
142 if (!ND_TTEST2(*bp, ddpSize)) {
143 ND_PRINT((ndo, " [|ddp]"));
144 return (0); /* cut short by the snapshot length */
146 dp = (const struct atDDP *)bp;
147 snet = EXTRACT_16BITS(&dp->srcNet);
148 ND_PRINT((ndo, "%s.%s", ataddr_string(ndo, snet, dp->srcNode),
149 ddpskt_string(ndo, dp->srcSkt)));
150 ND_PRINT((ndo, " > %s.%s:",
151 ataddr_string(ndo, EXTRACT_16BITS(&dp->dstNet), dp->dstNode),
152 ddpskt_string(ndo, dp->dstSkt)));
156 ddp_print(ndo, bp, length, dp->type, snet, dp->srcNode, dp->srcSkt);
161 klap_print(bp, length);
166 ND_PRINT((ndo, "%d > %d at-lap#%d %u",
167 lp->src, lp->dst, lp->type, length));
174 * Print EtherTalk/TokenTalk packets (or FDDITalk, or whatever it's called
175 * when it runs over FDDI; yes, I've seen FDDI captures with AppleTalk
179 atalk_print(netdissect_options *ndo,
180 register const u_char *bp, u_int length)
182 register const struct atDDP *dp;
186 ND_PRINT((ndo, "AT "));
188 if (length < ddpSize) {
189 ND_PRINT((ndo, " [|ddp %u]", length));
192 if (!ND_TTEST2(*bp, ddpSize)) {
193 ND_PRINT((ndo, " [|ddp]"));
196 dp = (const struct atDDP *)bp;
197 snet = EXTRACT_16BITS(&dp->srcNet);
198 ND_PRINT((ndo, "%s.%s", ataddr_string(ndo, snet, dp->srcNode),
199 ddpskt_string(ndo, dp->srcSkt)));
200 ND_PRINT((ndo, " > %s.%s: ",
201 ataddr_string(ndo, EXTRACT_16BITS(&dp->dstNet), dp->dstNode),
202 ddpskt_string(ndo, dp->dstSkt)));
205 ddp_print(ndo, bp, length, dp->type, snet, dp->srcNode, dp->srcSkt);
208 /* XXX should probably pass in the snap header and do checks like arp_print() */
210 aarp_print(netdissect_options *ndo,
211 register const u_char *bp, u_int length)
213 register const struct aarp *ap;
215 #define AT(member) ataddr_string(ndo, (ap->member[1]<<8)|ap->member[2],ap->member[3])
217 ND_PRINT((ndo, "aarp "));
218 ap = (const struct aarp *)bp;
219 if (!ND_TTEST(*ap)) {
220 /* Just bail if we don't have the whole chunk. */
221 ND_PRINT((ndo, " [|aarp]"));
224 if (length < sizeof(*ap)) {
225 ND_PRINT((ndo, " [|aarp %u]", length));
228 if (EXTRACT_16BITS(&ap->htype) == 1 &&
229 EXTRACT_16BITS(&ap->ptype) == ETHERTYPE_ATALK &&
230 ap->halen == 6 && ap->palen == 4 )
231 switch (EXTRACT_16BITS(&ap->op)) {
233 case 1: /* request */
234 ND_PRINT((ndo, "who-has %s tell %s", AT(pdaddr), AT(psaddr)));
237 case 2: /* response */
238 ND_PRINT((ndo, "reply %s is-at %s", AT(psaddr), etheraddr_string(ndo, ap->hsaddr)));
241 case 3: /* probe (oy!) */
242 ND_PRINT((ndo, "probe %s tell %s", AT(pdaddr), AT(psaddr)));
245 ND_PRINT((ndo, "len %u op %u htype %u ptype %#x halen %u palen %u",
246 length, EXTRACT_16BITS(&ap->op), EXTRACT_16BITS(&ap->htype),
247 EXTRACT_16BITS(&ap->ptype), ap->halen, ap->palen));
251 * Print AppleTalk Datagram Delivery Protocol packets.
254 ddp_print(netdissect_options *ndo,
255 register const u_char *bp, register u_int length, register int t,
256 register u_short snet, register u_char snode, u_char skt)
262 nbp_print(ndo, (const struct atNBP *)bp, length, snet, snode, skt);
266 atp_print(ndo, (const struct atATP *)bp, length);
270 eigrp_print(ndo, bp, length);
274 ND_PRINT((ndo, " at-%s %d", tok2str(type2str, NULL, t), length));
280 atp_print(netdissect_options *ndo,
281 register const struct atATP *ap, u_int length)
286 if ((const u_char *)(ap + 1) > ndo->ndo_snapend) {
287 /* Just bail if we don't have the whole chunk. */
288 ND_PRINT((ndo, "%s", tstr));
291 if (length < sizeof(*ap)) {
292 ND_PRINT((ndo, " [|atp %u]", length));
295 length -= sizeof(*ap);
296 switch (ap->control & 0xc0) {
299 ND_PRINT((ndo, " atp-req%s %d",
300 ap->control & atpXO? " " : "*",
301 EXTRACT_16BITS(&ap->transID)));
303 atp_bitmap_print(ndo, ap->bitmap);
306 ND_PRINT((ndo, " [len=%u]", length));
308 switch (ap->control & (atpEOM|atpSTS)) {
310 ND_PRINT((ndo, " [EOM]"));
313 ND_PRINT((ndo, " [STS]"));
316 ND_PRINT((ndo, " [EOM,STS]"));
322 ND_PRINT((ndo, " atp-resp%s%d:%d (%u)",
323 ap->control & atpEOM? "*" : " ",
324 EXTRACT_16BITS(&ap->transID), ap->bitmap, length));
325 switch (ap->control & (atpXO|atpSTS)) {
327 ND_PRINT((ndo, " [XO]"));
330 ND_PRINT((ndo, " [STS]"));
333 ND_PRINT((ndo, " [XO,STS]"));
339 ND_PRINT((ndo, " atp-rel %d", EXTRACT_16BITS(&ap->transID)));
341 atp_bitmap_print(ndo, ap->bitmap);
343 /* length should be zero */
345 ND_PRINT((ndo, " [len=%u]", length));
347 /* there shouldn't be any control flags */
348 if (ap->control & (atpXO|atpEOM|atpSTS)) {
350 if (ap->control & atpXO) {
351 ND_PRINT((ndo, "%cXO", c));
354 if (ap->control & atpEOM) {
355 ND_PRINT((ndo, "%cEOM", c));
358 if (ap->control & atpSTS) {
359 ND_PRINT((ndo, "%cSTS", c));
362 ND_PRINT((ndo, "]"));
367 ND_PRINT((ndo, " atp-0x%x %d (%u)", ap->control,
368 EXTRACT_16BITS(&ap->transID), length));
371 data = EXTRACT_32BITS(&ap->userData);
373 ND_PRINT((ndo, " 0x%x", data));
377 atp_bitmap_print(netdissect_options *ndo,
384 * The '& 0xff' below is needed for compilers that want to sign
385 * extend a u_char, which is the case with the Ultrix compiler.
386 * (gcc is smart enough to eliminate it, at least on the Sparc).
388 if ((bm + 1) & (bm & 0xff)) {
390 for (i = 0; bm; ++i) {
392 ND_PRINT((ndo, "%c%d", c, i));
397 ND_PRINT((ndo, ">"));
402 ND_PRINT((ndo, "<0-%d>", i - 1));
404 ND_PRINT((ndo, "<0>"));
409 nbp_print(netdissect_options *ndo,
410 register const struct atNBP *np, u_int length, register u_short snet,
411 register u_char snode, register u_char skt)
413 register const struct atNBPtuple *tp =
414 (const struct atNBPtuple *)((const u_char *)np + nbpHeaderSize);
418 if (length < nbpHeaderSize) {
419 ND_PRINT((ndo, " truncated-nbp %u", length));
423 length -= nbpHeaderSize;
425 /* must be room for at least one tuple */
426 ND_PRINT((ndo, " truncated-nbp %u", length + nbpHeaderSize));
429 /* ep points to end of available data */
430 ep = ndo->ndo_snapend;
431 if ((const u_char *)tp > ep) {
432 ND_PRINT((ndo, "%s", tstr));
435 switch (i = np->control & 0xf0) {
439 ND_PRINT((ndo, i == nbpLkUp? " nbp-lkup %d:":" nbp-brRq %d:", np->id));
440 if ((const u_char *)(tp + 1) > ep) {
441 ND_PRINT((ndo, "%s", tstr));
444 (void)nbp_name_print(ndo, tp, ep);
446 * look for anomalies: the spec says there can only
447 * be one tuple, the address must match the source
448 * address and the enumerator should be zero.
450 if ((np->control & 0xf) != 1)
451 ND_PRINT((ndo, " [ntup=%d]", np->control & 0xf));
453 ND_PRINT((ndo, " [enum=%d]", tp->enumerator));
454 if (EXTRACT_16BITS(&tp->net) != snet ||
455 tp->node != snode || tp->skt != skt)
456 ND_PRINT((ndo, " [addr=%s.%d]",
457 ataddr_string(ndo, EXTRACT_16BITS(&tp->net),
458 tp->node), tp->skt));
462 ND_PRINT((ndo, " nbp-reply %d:", np->id));
464 /* print each of the tuples in the reply */
465 for (i = np->control & 0xf; --i >= 0 && tp; )
466 tp = nbp_tuple_print(ndo, tp, ep, snet, snode, skt);
470 ND_PRINT((ndo, " nbp-0x%x %d (%u)", np->control, np->id, length));
475 /* print a counted string */
477 print_cstring(netdissect_options *ndo,
478 register const char *cp, register const u_char *ep)
480 register u_int length;
482 if (cp >= (const char *)ep) {
483 ND_PRINT((ndo, "%s", tstr));
488 /* Spec says string can be at most 32 bytes long */
490 ND_PRINT((ndo, "[len=%u]", length));
493 while ((int)--length >= 0) {
494 if (cp >= (const char *)ep) {
495 ND_PRINT((ndo, "%s", tstr));
498 ND_PRINT((ndo, "%c", *cp++));
503 static const struct atNBPtuple *
504 nbp_tuple_print(netdissect_options *ndo,
505 register const struct atNBPtuple *tp, register const u_char *ep,
506 register u_short snet, register u_char snode, register u_char skt)
508 register const struct atNBPtuple *tpn;
510 if ((const u_char *)(tp + 1) > ep) {
511 ND_PRINT((ndo, "%s", tstr));
514 tpn = nbp_name_print(ndo, tp, ep);
516 /* if the enumerator isn't 1, print it */
517 if (tp->enumerator != 1)
518 ND_PRINT((ndo, "(%d)", tp->enumerator));
520 /* if the socket doesn't match the src socket, print it */
522 ND_PRINT((ndo, " %d", tp->skt));
524 /* if the address doesn't match the src address, it's an anomaly */
525 if (EXTRACT_16BITS(&tp->net) != snet || tp->node != snode)
526 ND_PRINT((ndo, " [addr=%s]",
527 ataddr_string(ndo, EXTRACT_16BITS(&tp->net), tp->node)));
532 static const struct atNBPtuple *
533 nbp_name_print(netdissect_options *ndo,
534 const struct atNBPtuple *tp, register const u_char *ep)
536 register const char *cp = (const char *)tp + nbpTupleSize;
538 ND_PRINT((ndo, " "));
541 ND_PRINT((ndo, "\""));
542 if ((cp = print_cstring(ndo, cp, ep)) != NULL) {
544 ND_PRINT((ndo, ":"));
545 if ((cp = print_cstring(ndo, cp, ep)) != NULL) {
547 ND_PRINT((ndo, "@"));
548 if ((cp = print_cstring(ndo, cp, ep)) != NULL)
549 ND_PRINT((ndo, "\""));
552 return ((const struct atNBPtuple *)cp);
556 #define HASHNAMESIZE 4096
561 struct hnamemem *nxt;
564 static struct hnamemem hnametable[HASHNAMESIZE];
567 ataddr_string(netdissect_options *ndo,
568 u_short atnet, u_char athost)
570 register struct hnamemem *tp, *tp2;
571 register int i = (atnet << 8) | athost;
573 static int first = 1;
577 * if this is the first call, see if there's an AppleTalk
578 * number to name map file.
580 if (first && (first = 0, !ndo->ndo_nflag)
581 && (fp = fopen("/etc/atalk.names", "r"))) {
585 while (fgets(line, sizeof(line), fp)) {
586 if (line[0] == '\n' || line[0] == 0 || line[0] == '#')
588 if (sscanf(line, "%d.%d %256s", &i1, &i2, nambuf) == 3)
589 /* got a hostname. */
591 else if (sscanf(line, "%d %256s", &i1, nambuf) == 2)
593 i2 = (i1 << 8) | 255;
597 for (tp = &hnametable[i2 & (HASHNAMESIZE-1)];
598 tp->nxt; tp = tp->nxt)
601 tp->nxt = newhnamemem(ndo);
602 tp->name = strdup(nambuf);
603 if (tp->name == NULL)
604 (*ndo->ndo_error)(ndo,
605 "ataddr_string: strdup(nambuf)");
610 for (tp = &hnametable[i & (HASHNAMESIZE-1)]; tp->nxt; tp = tp->nxt)
614 /* didn't have the node name -- see if we've got the net name */
616 for (tp2 = &hnametable[i & (HASHNAMESIZE-1)]; tp2->nxt; tp2 = tp2->nxt)
617 if (tp2->addr == i) {
618 tp->addr = (atnet << 8) | athost;
619 tp->nxt = newhnamemem(ndo);
620 (void)snprintf(nambuf, sizeof(nambuf), "%s.%d",
622 tp->name = strdup(nambuf);
623 if (tp->name == NULL)
624 (*ndo->ndo_error)(ndo,
625 "ataddr_string: strdup(nambuf)");
629 tp->addr = (atnet << 8) | athost;
630 tp->nxt = newhnamemem(ndo);
632 (void)snprintf(nambuf, sizeof(nambuf), "%d.%d", atnet, athost);
634 (void)snprintf(nambuf, sizeof(nambuf), "%d", atnet);
635 tp->name = strdup(nambuf);
636 if (tp->name == NULL)
637 (*ndo->ndo_error)(ndo, "ataddr_string: strdup(nambuf)");
642 static const struct tok skt2str[] = {
643 { rtmpSkt, "rtmp" }, /* routing table maintenance */
644 { nbpSkt, "nis" }, /* name info socket */
645 { echoSkt, "echo" }, /* AppleTalk echo protocol */
646 { zipSkt, "zip" }, /* zone info protocol */
651 ddpskt_string(netdissect_options *ndo,
656 if (ndo->ndo_nflag) {
657 (void)snprintf(buf, sizeof(buf), "%d", skt);
660 return (tok2str(skt2str, "%d", skt));