• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /*
2  * Redistribution and use in source and binary forms, with or without
3  * modification, are permitted provided that: (1) source code
4  * distributions retain the above copyright notice and this paragraph
5  * in its entirety, and (2) distributions including binary code include
6  * the above copyright notice and this paragraph in its entirety in
7  * the documentation or other materials provided with the distribution.
8  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND
9  * WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, WITHOUT
10  * LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
11  * FOR A PARTICULAR PURPOSE.
12  *
13  * Original code by Hannes Gredler (hannes@juniper.net)
14  */
15 
16 #ifndef lint
17 static const char rcsid[] _U_ =
18     "@(#) $Header: /tcpdump/master/tcpdump/print-juniper.c,v 1.8.2.22 2006/05/10 22:42:46 guy Exp $ (LBL)";
19 #endif
20 
21 #ifdef HAVE_CONFIG_H
22 #include "config.h"
23 #endif
24 
25 #include <tcpdump-stdinc.h>
26 
27 #include <pcap.h>
28 #include <stdio.h>
29 
30 #include "interface.h"
31 #include "addrtoname.h"
32 #include "extract.h"
33 #include "ppp.h"
34 #include "llc.h"
35 #include "nlpid.h"
36 #include "ethertype.h"
37 #include "atm.h"
38 
39 #define JUNIPER_BPF_OUT           0       /* Outgoing packet */
40 #define JUNIPER_BPF_IN            1       /* Incoming packet */
41 #define JUNIPER_BPF_PKT_IN        0x1     /* Incoming packet */
42 #define JUNIPER_BPF_NO_L2         0x2     /* L2 header stripped */
43 #define JUNIPER_BPF_EXT           0x80    /* extensions present */
44 #define JUNIPER_MGC_NUMBER        0x4d4743 /* = "MGC" */
45 
46 #define JUNIPER_LSQ_COOKIE_RE         (1 << 3)
47 #define JUNIPER_LSQ_COOKIE_DIR        (1 << 2)
48 #define JUNIPER_LSQ_L3_PROTO_SHIFT     4
49 #define JUNIPER_LSQ_L3_PROTO_MASK     (0x17 << JUNIPER_LSQ_L3_PROTO_SHIFT)
50 #define JUNIPER_LSQ_L3_PROTO_IPV4     (0 << JUNIPER_LSQ_L3_PROTO_SHIFT)
51 #define JUNIPER_LSQ_L3_PROTO_IPV6     (1 << JUNIPER_LSQ_L3_PROTO_SHIFT)
52 #define JUNIPER_LSQ_L3_PROTO_MPLS     (2 << JUNIPER_LSQ_L3_PROTO_SHIFT)
53 #define JUNIPER_LSQ_L3_PROTO_ISO      (3 << JUNIPER_LSQ_L3_PROTO_SHIFT)
54 #define AS_PIC_COOKIE_LEN 8
55 
56 #define JUNIPER_IPSEC_O_ESP_ENCRYPT_ESP_AUTHEN_TYPE 1
57 #define JUNIPER_IPSEC_O_ESP_ENCRYPT_AH_AUTHEN_TYPE 2
58 #define JUNIPER_IPSEC_O_ESP_AUTHENTICATION_TYPE 3
59 #define JUNIPER_IPSEC_O_AH_AUTHENTICATION_TYPE 4
60 #define JUNIPER_IPSEC_O_ESP_ENCRYPTION_TYPE 5
61 
62 static struct tok juniper_ipsec_type_values[] = {
63     { JUNIPER_IPSEC_O_ESP_ENCRYPT_ESP_AUTHEN_TYPE, "ESP ENCR-AUTH" },
64     { JUNIPER_IPSEC_O_ESP_ENCRYPT_AH_AUTHEN_TYPE, "ESP ENCR-AH AUTH" },
65     { JUNIPER_IPSEC_O_ESP_AUTHENTICATION_TYPE, "ESP AUTH" },
66     { JUNIPER_IPSEC_O_AH_AUTHENTICATION_TYPE, "AH AUTH" },
67     { JUNIPER_IPSEC_O_ESP_ENCRYPTION_TYPE, "ESP ENCR" },
68     { 0, NULL}
69 };
70 
71 static struct tok juniper_direction_values[] = {
72     { JUNIPER_BPF_IN,  "In"},
73     { JUNIPER_BPF_OUT, "Out"},
74     { 0, NULL}
75 };
76 
77 struct juniper_cookie_table_t {
78     u_int32_t pictype;		/* pic type */
79     u_int8_t  cookie_len;       /* cookie len */
80     const char *s;		/* pic name */
81 };
82 
83 static struct juniper_cookie_table_t juniper_cookie_table[] = {
84 #ifdef DLT_JUNIPER_ATM1
85     { DLT_JUNIPER_ATM1,  4, "ATM1"},
86 #endif
87 #ifdef DLT_JUNIPER_ATM2
88     { DLT_JUNIPER_ATM2,  8, "ATM2"},
89 #endif
90 #ifdef DLT_JUNIPER_MLPPP
91     { DLT_JUNIPER_MLPPP, 2, "MLPPP"},
92 #endif
93 #ifdef DLT_JUNIPER_MLFR
94     { DLT_JUNIPER_MLFR,  2, "MLFR"},
95 #endif
96 #ifdef DLT_JUNIPER_MFR
97     { DLT_JUNIPER_MFR,   4, "MFR"},
98 #endif
99 #ifdef DLT_JUNIPER_PPPOE
100     { DLT_JUNIPER_PPPOE, 0, "PPPoE"},
101 #endif
102 #ifdef DLT_JUNIPER_PPPOE_ATM
103     { DLT_JUNIPER_PPPOE_ATM, 0, "PPPoE ATM"},
104 #endif
105 #ifdef DLT_JUNIPER_GGSN
106     { DLT_JUNIPER_GGSN, 8, "GGSN"},
107 #endif
108 #ifdef DLT_JUNIPER_MONITOR
109     { DLT_JUNIPER_MONITOR, 8, "MONITOR"},
110 #endif
111 #ifdef DLT_JUNIPER_SERVICES
112     { DLT_JUNIPER_SERVICES, 8, "AS"},
113 #endif
114 #ifdef DLT_JUNIPER_ES
115     { DLT_JUNIPER_ES, 0, "ES"},
116 #endif
117     { 0, 0, NULL }
118 };
119 
120 struct juniper_l2info_t {
121     u_int32_t length;
122     u_int32_t caplen;
123     u_int32_t pictype;
124     u_int8_t direction;
125     u_int8_t header_len;
126     u_int8_t cookie_len;
127     u_int8_t cookie_type;
128     u_int8_t cookie[8];
129     u_int8_t bundle;
130     u_int16_t proto;
131 };
132 
133 #define LS_COOKIE_ID            0x54
134 #define AS_COOKIE_ID            0x47
135 #define LS_MLFR_COOKIE_LEN	4
136 #define ML_MLFR_COOKIE_LEN	2
137 #define LS_MFR_COOKIE_LEN	6
138 #define ATM1_COOKIE_LEN         4
139 #define ATM2_COOKIE_LEN         8
140 
141 #define ATM2_PKT_TYPE_MASK  0x70
142 #define ATM2_GAP_COUNT_MASK 0x3F
143 
144 #define JUNIPER_PROTO_NULL          1
145 #define JUNIPER_PROTO_IPV4          2
146 #define JUNIPER_PROTO_IPV6          6
147 
148 #define MFR_BE_MASK 0xc0
149 
150 static struct tok juniper_protocol_values[] = {
151     { JUNIPER_PROTO_NULL, "Null" },
152     { JUNIPER_PROTO_IPV4, "IPv4" },
153     { JUNIPER_PROTO_IPV6, "IPv6" },
154     { 0, NULL}
155 };
156 
157 int ip_heuristic_guess(register const u_char *, u_int);
158 int juniper_ppp_heuristic_guess(register const u_char *, u_int);
159 static int juniper_parse_header (const u_char *, const struct pcap_pkthdr *, struct juniper_l2info_t *);
160 
161 #ifdef DLT_JUNIPER_GGSN
162 u_int
juniper_ggsn_print(const struct pcap_pkthdr * h,register const u_char * p)163 juniper_ggsn_print(const struct pcap_pkthdr *h, register const u_char *p)
164 {
165         struct juniper_l2info_t l2info;
166         struct juniper_ggsn_header {
167             u_int8_t svc_id;
168             u_int8_t flags_len;
169             u_int8_t proto;
170             u_int8_t flags;
171             u_int8_t vlan_id[2];
172             u_int8_t res[2];
173         };
174         const struct juniper_ggsn_header *gh;
175 
176         l2info.pictype = DLT_JUNIPER_GGSN;
177         if(juniper_parse_header(p, h, &l2info) == 0)
178             return l2info.header_len;
179 
180         p+=l2info.header_len;
181         gh = (struct juniper_ggsn_header *)p;
182 
183         if (eflag)
184             printf("proto %s (%u), vlan %u: ",
185                    tok2str(juniper_protocol_values,"Unknown",gh->proto),
186                    gh->proto,
187                    EXTRACT_16BITS(&gh->vlan_id[0]));
188 
189         switch (gh->proto) {
190         case JUNIPER_PROTO_IPV4:
191             ip_print(gndo, p, l2info.length);
192             break;
193 #ifdef INET6
194         case JUNIPER_PROTO_IPV6:
195             ip6_print(p, l2info.length);
196             break;
197 #endif /* INET6 */
198         default:
199             if (!eflag)
200                 printf("unknown GGSN proto (%u)", gh->proto);
201         }
202 
203         return l2info.header_len;
204 }
205 #endif
206 
207 #ifdef DLT_JUNIPER_ES
208 u_int
juniper_es_print(const struct pcap_pkthdr * h,register const u_char * p)209 juniper_es_print(const struct pcap_pkthdr *h, register const u_char *p)
210 {
211         struct juniper_l2info_t l2info;
212         struct juniper_ipsec_header {
213             u_int8_t sa_index[2];
214             u_int8_t ttl;
215             u_int8_t type;
216             u_int8_t spi[4];
217             u_int8_t src_ip[4];
218             u_int8_t dst_ip[4];
219         };
220         u_int rewrite_len,es_type_bundle;
221         const struct juniper_ipsec_header *ih;
222 
223         l2info.pictype = DLT_JUNIPER_ES;
224         if(juniper_parse_header(p, h, &l2info) == 0)
225             return l2info.header_len;
226 
227         p+=l2info.header_len;
228         ih = (struct juniper_ipsec_header *)p;
229 
230         switch (ih->type) {
231         case JUNIPER_IPSEC_O_ESP_ENCRYPT_ESP_AUTHEN_TYPE:
232         case JUNIPER_IPSEC_O_ESP_ENCRYPT_AH_AUTHEN_TYPE:
233             rewrite_len = 0;
234             es_type_bundle = 1;
235             break;
236         case JUNIPER_IPSEC_O_ESP_AUTHENTICATION_TYPE:
237         case JUNIPER_IPSEC_O_AH_AUTHENTICATION_TYPE:
238         case JUNIPER_IPSEC_O_ESP_ENCRYPTION_TYPE:
239             rewrite_len = 16;
240             es_type_bundle = 0;
241         default:
242             printf("ES Invalid type %u, length %u",
243                    ih->type,
244                    l2info.length);
245             return l2info.header_len;
246         }
247 
248         l2info.length-=rewrite_len;
249         p+=rewrite_len;
250 
251         if (eflag) {
252             if (!es_type_bundle) {
253                 printf("ES SA, index %u, ttl %u type %s (%u), spi %u, Tunnel %s > %s, length %u\n",
254                        EXTRACT_16BITS(&ih->sa_index),
255                        ih->ttl,
256                        tok2str(juniper_ipsec_type_values,"Unknown",ih->type),
257                        ih->type,
258                        EXTRACT_32BITS(&ih->spi),
259                        ipaddr_string(EXTRACT_32BITS(&ih->src_ip)),
260                        ipaddr_string(EXTRACT_32BITS(&ih->dst_ip)),
261                        l2info.length);
262             } else {
263                 printf("ES SA, index %u, ttl %u type %s (%u), length %u\n",
264                        EXTRACT_16BITS(&ih->sa_index),
265                        ih->ttl,
266                        tok2str(juniper_ipsec_type_values,"Unknown",ih->type),
267                        ih->type,
268                        l2info.length);
269             }
270         }
271 
272         ip_print(gndo, p, l2info.length);
273         return l2info.header_len;
274 }
275 #endif
276 
277 #ifdef DLT_JUNIPER_MONITOR
278 u_int
juniper_monitor_print(const struct pcap_pkthdr * h,register const u_char * p)279 juniper_monitor_print(const struct pcap_pkthdr *h, register const u_char *p)
280 {
281         struct juniper_l2info_t l2info;
282         struct juniper_monitor_header {
283             u_int8_t pkt_type;
284             u_int8_t padding;
285             u_int8_t iif[2];
286             u_int8_t service_id[4];
287         };
288         const struct juniper_monitor_header *mh;
289 
290         l2info.pictype = DLT_JUNIPER_MONITOR;
291         if(juniper_parse_header(p, h, &l2info) == 0)
292             return l2info.header_len;
293 
294         p+=l2info.header_len;
295         mh = (struct juniper_monitor_header *)p;
296 
297         if (eflag)
298             printf("service-id %u, iif %u, pkt-type %u: ",
299                    EXTRACT_32BITS(&mh->service_id),
300                    EXTRACT_16BITS(&mh->iif),
301                    mh->pkt_type);
302 
303         /* no proto field - lets guess by first byte of IP header*/
304         ip_heuristic_guess(p, l2info.length);
305 
306         return l2info.header_len;
307 }
308 #endif
309 
310 #ifdef DLT_JUNIPER_SERVICES
311 u_int
juniper_services_print(const struct pcap_pkthdr * h,register const u_char * p)312 juniper_services_print(const struct pcap_pkthdr *h, register const u_char *p)
313 {
314         struct juniper_l2info_t l2info;
315         struct juniper_services_header {
316             u_int8_t svc_id;
317             u_int8_t flags_len;
318             u_int8_t svc_set_id[2];
319             u_int8_t dir_iif[4];
320         };
321         const struct juniper_services_header *sh;
322 
323         l2info.pictype = DLT_JUNIPER_SERVICES;
324         if(juniper_parse_header(p, h, &l2info) == 0)
325             return l2info.header_len;
326 
327         p+=l2info.header_len;
328         sh = (struct juniper_services_header *)p;
329 
330         if (eflag)
331             printf("service-id %u flags 0x%02x service-set-id 0x%04x iif %u: ",
332                    sh->svc_id,
333                    sh->flags_len,
334                    EXTRACT_16BITS(&sh->svc_set_id),
335                    EXTRACT_24BITS(&sh->dir_iif[1]));
336 
337         /* no proto field - lets guess by first byte of IP header*/
338         ip_heuristic_guess(p, l2info.length);
339 
340         return l2info.header_len;
341 }
342 #endif
343 
344 #ifdef DLT_JUNIPER_PPPOE
345 u_int
juniper_pppoe_print(const struct pcap_pkthdr * h,register const u_char * p)346 juniper_pppoe_print(const struct pcap_pkthdr *h, register const u_char *p)
347 {
348         struct juniper_l2info_t l2info;
349 
350         l2info.pictype = DLT_JUNIPER_PPPOE;
351         if(juniper_parse_header(p, h, &l2info) == 0)
352             return l2info.header_len;
353 
354         p+=l2info.header_len;
355         /* this DLT contains nothing but raw ethernet frames */
356         ether_print(p, l2info.length, l2info.caplen);
357         return l2info.header_len;
358 }
359 #endif
360 
361 #ifdef DLT_JUNIPER_ETHER
362 u_int
juniper_ether_print(const struct pcap_pkthdr * h,register const u_char * p)363 juniper_ether_print(const struct pcap_pkthdr *h, register const u_char *p)
364 {
365         struct juniper_l2info_t l2info;
366 
367         l2info.pictype = DLT_JUNIPER_ETHER;
368         if(juniper_parse_header(p, h, &l2info) == 0)
369             return l2info.header_len;
370 
371         p+=l2info.header_len;
372         /* this DLT contains nothing but raw Ethernet frames */
373         ether_print(p, l2info.length, l2info.caplen);
374         return l2info.header_len;
375 }
376 #endif
377 
378 #ifdef DLT_JUNIPER_PPP
379 u_int
juniper_ppp_print(const struct pcap_pkthdr * h,register const u_char * p)380 juniper_ppp_print(const struct pcap_pkthdr *h, register const u_char *p)
381 {
382         struct juniper_l2info_t l2info;
383 
384         l2info.pictype = DLT_JUNIPER_PPP;
385         if(juniper_parse_header(p, h, &l2info) == 0)
386             return l2info.header_len;
387 
388         p+=l2info.header_len;
389         /* this DLT contains nothing but raw ppp frames */
390         ppp_print(p, l2info.length);
391         return l2info.header_len;
392 }
393 #endif
394 
395 #ifdef DLT_JUNIPER_FRELAY
396 u_int
juniper_frelay_print(const struct pcap_pkthdr * h,register const u_char * p)397 juniper_frelay_print(const struct pcap_pkthdr *h, register const u_char *p)
398 {
399         struct juniper_l2info_t l2info;
400 
401         l2info.pictype = DLT_JUNIPER_FRELAY;
402         if(juniper_parse_header(p, h, &l2info) == 0)
403             return l2info.header_len;
404 
405         p+=l2info.header_len;
406         /* this DLT contains nothing but raw frame-relay frames */
407         fr_print(p, l2info.length);
408         return l2info.header_len;
409 }
410 #endif
411 
412 #ifdef DLT_JUNIPER_CHDLC
413 u_int
juniper_chdlc_print(const struct pcap_pkthdr * h,register const u_char * p)414 juniper_chdlc_print(const struct pcap_pkthdr *h, register const u_char *p)
415 {
416         struct juniper_l2info_t l2info;
417 
418         l2info.pictype = DLT_JUNIPER_CHDLC;
419         if(juniper_parse_header(p, h, &l2info) == 0)
420             return l2info.header_len;
421 
422         p+=l2info.header_len;
423         /* this DLT contains nothing but raw c-hdlc frames */
424         chdlc_print(p, l2info.length);
425         return l2info.header_len;
426 }
427 #endif
428 
429 #ifdef DLT_JUNIPER_PPPOE_ATM
430 u_int
juniper_pppoe_atm_print(const struct pcap_pkthdr * h,register const u_char * p)431 juniper_pppoe_atm_print(const struct pcap_pkthdr *h, register const u_char *p)
432 {
433         struct juniper_l2info_t l2info;
434 	u_int16_t extracted_ethertype;
435 
436         l2info.pictype = DLT_JUNIPER_PPPOE_ATM;
437         if(juniper_parse_header(p, h, &l2info) == 0)
438             return l2info.header_len;
439 
440         p+=l2info.header_len;
441 
442         extracted_ethertype = EXTRACT_16BITS(p);
443         /* this DLT contains nothing but raw PPPoE frames,
444          * prepended with a type field*/
445         if (ether_encap_print(extracted_ethertype,
446                               p+ETHERTYPE_LEN,
447                               l2info.length-ETHERTYPE_LEN,
448                               l2info.caplen-ETHERTYPE_LEN,
449                               &extracted_ethertype) == 0)
450             /* ether_type not known, probably it wasn't one */
451             printf("unknown ethertype 0x%04x", extracted_ethertype);
452 
453         return l2info.header_len;
454 }
455 #endif
456 
457 #ifdef DLT_JUNIPER_MLPPP
458 u_int
juniper_mlppp_print(const struct pcap_pkthdr * h,register const u_char * p)459 juniper_mlppp_print(const struct pcap_pkthdr *h, register const u_char *p)
460 {
461         struct juniper_l2info_t l2info;
462 
463         l2info.pictype = DLT_JUNIPER_MLPPP;
464         if(juniper_parse_header(p, h, &l2info) == 0)
465             return l2info.header_len;
466 
467         /* suppress Bundle-ID if frame was captured on a child-link
468          * best indicator if the cookie looks like a proto */
469         if (eflag &&
470             EXTRACT_16BITS(&l2info.cookie) != PPP_OSI &&
471             EXTRACT_16BITS(&l2info.cookie) !=  (PPP_ADDRESS << 8 | PPP_CONTROL))
472             printf("Bundle-ID %u: ",l2info.bundle);
473 
474         p+=l2info.header_len;
475 
476         /* first try the LSQ protos */
477         switch(l2info.proto) {
478         case JUNIPER_LSQ_L3_PROTO_IPV4:
479             /* IP traffic going to the RE would not have a cookie
480              * -> this must be incoming IS-IS over PPP
481              */
482             if (l2info.cookie[4] == (JUNIPER_LSQ_COOKIE_RE|JUNIPER_LSQ_COOKIE_DIR))
483                 ppp_print(p, l2info.length);
484             else
485                 ip_print(gndo, p, l2info.length);
486             return l2info.header_len;
487 #ifdef INET6
488         case JUNIPER_LSQ_L3_PROTO_IPV6:
489             ip6_print(p,l2info.length);
490             return l2info.header_len;
491 #endif
492         case JUNIPER_LSQ_L3_PROTO_MPLS:
493             mpls_print(p,l2info.length);
494             return l2info.header_len;
495         case JUNIPER_LSQ_L3_PROTO_ISO:
496             isoclns_print(p,l2info.length,l2info.caplen);
497             return l2info.header_len;
498         default:
499             break;
500         }
501 
502         /* zero length cookie ? */
503         switch (EXTRACT_16BITS(&l2info.cookie)) {
504         case PPP_OSI:
505             ppp_print(p-2,l2info.length+2);
506             break;
507         case (PPP_ADDRESS << 8 | PPP_CONTROL): /* fall through */
508         default:
509             ppp_print(p,l2info.length);
510             break;
511         }
512 
513         return l2info.header_len;
514 }
515 #endif
516 
517 
518 #ifdef DLT_JUNIPER_MFR
519 u_int
juniper_mfr_print(const struct pcap_pkthdr * h,register const u_char * p)520 juniper_mfr_print(const struct pcap_pkthdr *h, register const u_char *p)
521 {
522         struct juniper_l2info_t l2info;
523 
524         l2info.pictype = DLT_JUNIPER_MFR;
525         if(juniper_parse_header(p, h, &l2info) == 0)
526             return l2info.header_len;
527 
528         p+=l2info.header_len;
529 
530         /* child-link ? */
531         if (l2info.cookie_len == 0) {
532             mfr_print(p,l2info.length);
533             return l2info.header_len;
534         }
535 
536         /* first try the LSQ protos */
537         if (l2info.cookie_len == AS_PIC_COOKIE_LEN) {
538             switch(l2info.proto) {
539             case JUNIPER_LSQ_L3_PROTO_IPV4:
540                 ip_print(gndo, p, l2info.length);
541                 return l2info.header_len;
542 #ifdef INET6
543             case JUNIPER_LSQ_L3_PROTO_IPV6:
544                 ip6_print(p,l2info.length);
545                 return l2info.header_len;
546 #endif
547             case JUNIPER_LSQ_L3_PROTO_MPLS:
548                 mpls_print(p,l2info.length);
549                 return l2info.header_len;
550             case JUNIPER_LSQ_L3_PROTO_ISO:
551                 isoclns_print(p,l2info.length,l2info.caplen);
552                 return l2info.header_len;
553             default:
554                 break;
555             }
556             return l2info.header_len;
557         }
558 
559         /* suppress Bundle-ID if frame was captured on a child-link */
560         if (eflag && EXTRACT_32BITS(l2info.cookie) != 1) printf("Bundle-ID %u, ",l2info.bundle);
561         switch (l2info.proto) {
562         case (LLCSAP_ISONS<<8 | LLCSAP_ISONS):
563             isoclns_print(p+1, l2info.length-1, l2info.caplen-1);
564             break;
565         case (LLC_UI<<8 | NLPID_Q933):
566         case (LLC_UI<<8 | NLPID_IP):
567         case (LLC_UI<<8 | NLPID_IP6):
568             /* pass IP{4,6} to the OSI layer for proper link-layer printing */
569             isoclns_print(p-1, l2info.length+1, l2info.caplen+1);
570             break;
571         default:
572             printf("unknown protocol 0x%04x, length %u",l2info.proto, l2info.length);
573         }
574 
575         return l2info.header_len;
576 }
577 #endif
578 
579 #ifdef DLT_JUNIPER_MLFR
580 u_int
juniper_mlfr_print(const struct pcap_pkthdr * h,register const u_char * p)581 juniper_mlfr_print(const struct pcap_pkthdr *h, register const u_char *p)
582 {
583         struct juniper_l2info_t l2info;
584 
585         l2info.pictype = DLT_JUNIPER_MLFR;
586         if(juniper_parse_header(p, h, &l2info) == 0)
587             return l2info.header_len;
588 
589         p+=l2info.header_len;
590 
591         /* suppress Bundle-ID if frame was captured on a child-link */
592         if (eflag && EXTRACT_32BITS(l2info.cookie) != 1) printf("Bundle-ID %u, ",l2info.bundle);
593         switch (l2info.proto) {
594         case (LLC_UI):
595         case (LLC_UI<<8):
596             isoclns_print(p, l2info.length, l2info.caplen);
597             break;
598         case (LLC_UI<<8 | NLPID_Q933):
599         case (LLC_UI<<8 | NLPID_IP):
600         case (LLC_UI<<8 | NLPID_IP6):
601             /* pass IP{4,6} to the OSI layer for proper link-layer printing */
602             isoclns_print(p-1, l2info.length+1, l2info.caplen+1);
603             break;
604         default:
605             printf("unknown protocol 0x%04x, length %u",l2info.proto, l2info.length);
606         }
607 
608         return l2info.header_len;
609 }
610 #endif
611 
612 /*
613  *     ATM1 PIC cookie format
614  *
615  *     +-----+-------------------------+-------------------------------+
616  *     |fmtid|     vc index            |  channel  ID                  |
617  *     +-----+-------------------------+-------------------------------+
618  */
619 
620 #ifdef DLT_JUNIPER_ATM1
621 u_int
juniper_atm1_print(const struct pcap_pkthdr * h,register const u_char * p)622 juniper_atm1_print(const struct pcap_pkthdr *h, register const u_char *p)
623 {
624         u_int16_t extracted_ethertype;
625 
626         struct juniper_l2info_t l2info;
627 
628         l2info.pictype = DLT_JUNIPER_ATM1;
629         if(juniper_parse_header(p, h, &l2info) == 0)
630             return l2info.header_len;
631 
632         p+=l2info.header_len;
633 
634         if (l2info.cookie[0] == 0x80) { /* OAM cell ? */
635             oam_print(p,l2info.length,ATM_OAM_NOHEC);
636             return l2info.header_len;
637         }
638 
639         if (EXTRACT_24BITS(p) == 0xfefe03 || /* NLPID encaps ? */
640             EXTRACT_24BITS(p) == 0xaaaa03) { /* SNAP encaps ? */
641 
642             if (llc_print(p, l2info.length, l2info.caplen, NULL, NULL,
643                           &extracted_ethertype) != 0)
644                 return l2info.header_len;
645         }
646 
647         if (p[0] == 0x03) { /* Cisco style NLPID encaps ? */
648             isoclns_print(p + 1, l2info.length - 1, l2info.caplen - 1);
649             /* FIXME check if frame was recognized */
650             return l2info.header_len;
651         }
652 
653         if(ip_heuristic_guess(p, l2info.length) != 0) /* last try - vcmux encaps ? */
654             return l2info.header_len;
655 
656 	return l2info.header_len;
657 }
658 #endif
659 
660 /*
661  *     ATM2 PIC cookie format
662  *
663  *     +-------------------------------+---------+---+-----+-----------+
664  *     |     channel ID                |  reserv |AAL| CCRQ| gap cnt   |
665  *     +-------------------------------+---------+---+-----+-----------+
666  */
667 
668 #ifdef DLT_JUNIPER_ATM2
669 u_int
juniper_atm2_print(const struct pcap_pkthdr * h,register const u_char * p)670 juniper_atm2_print(const struct pcap_pkthdr *h, register const u_char *p)
671 {
672         u_int16_t extracted_ethertype;
673 
674         struct juniper_l2info_t l2info;
675 
676         l2info.pictype = DLT_JUNIPER_ATM2;
677         if(juniper_parse_header(p, h, &l2info) == 0)
678             return l2info.header_len;
679 
680         p+=l2info.header_len;
681 
682         if (l2info.cookie[7] & ATM2_PKT_TYPE_MASK) { /* OAM cell ? */
683             oam_print(p,l2info.length,ATM_OAM_NOHEC);
684             return l2info.header_len;
685         }
686 
687         if (EXTRACT_24BITS(p) == 0xfefe03 || /* NLPID encaps ? */
688             EXTRACT_24BITS(p) == 0xaaaa03) { /* SNAP encaps ? */
689 
690             if (llc_print(p, l2info.length, l2info.caplen, NULL, NULL,
691                           &extracted_ethertype) != 0)
692                 return l2info.header_len;
693         }
694 
695         if (l2info.direction != JUNIPER_BPF_PKT_IN && /* ether-over-1483 encaps ? */
696             (EXTRACT_32BITS(l2info.cookie) & ATM2_GAP_COUNT_MASK)) {
697             ether_print(p, l2info.length, l2info.caplen);
698             return l2info.header_len;
699         }
700 
701         if (p[0] == 0x03) { /* Cisco style NLPID encaps ? */
702             isoclns_print(p + 1, l2info.length - 1, l2info.caplen - 1);
703             /* FIXME check if frame was recognized */
704             return l2info.header_len;
705         }
706 
707         if(juniper_ppp_heuristic_guess(p, l2info.length) != 0) /* PPPoA vcmux encaps ? */
708             return l2info.header_len;
709 
710         if(ip_heuristic_guess(p, l2info.length) != 0) /* last try - vcmux encaps ? */
711             return l2info.header_len;
712 
713 	return l2info.header_len;
714 }
715 #endif
716 
717 
718 /* try to guess, based on all PPP protos that are supported in
719  * a juniper router if the payload data is encapsulated using PPP */
720 int
juniper_ppp_heuristic_guess(register const u_char * p,u_int length)721 juniper_ppp_heuristic_guess(register const u_char *p, u_int length) {
722 
723     switch(EXTRACT_16BITS(p)) {
724     case PPP_IP :
725     case PPP_OSI :
726     case PPP_MPLS_UCAST :
727     case PPP_MPLS_MCAST :
728     case PPP_IPCP :
729     case PPP_OSICP :
730     case PPP_MPLSCP :
731     case PPP_LCP :
732     case PPP_PAP :
733     case PPP_CHAP :
734     case PPP_ML :
735 #ifdef INET6
736     case PPP_IPV6 :
737     case PPP_IPV6CP :
738 #endif
739         ppp_print(p, length);
740         break;
741 
742     default:
743         return 0; /* did not find a ppp header */
744         break;
745     }
746     return 1; /* we printed a ppp packet */
747 }
748 
749 int
ip_heuristic_guess(register const u_char * p,u_int length)750 ip_heuristic_guess(register const u_char *p, u_int length) {
751 
752     switch(p[0]) {
753     case 0x45:
754     case 0x46:
755     case 0x47:
756     case 0x48:
757     case 0x49:
758     case 0x4a:
759     case 0x4b:
760     case 0x4c:
761     case 0x4d:
762     case 0x4e:
763     case 0x4f:
764 	    ip_print(gndo, p, length);
765 	    break;
766 #ifdef INET6
767     case 0x60:
768     case 0x61:
769     case 0x62:
770     case 0x63:
771     case 0x64:
772     case 0x65:
773     case 0x66:
774     case 0x67:
775     case 0x68:
776     case 0x69:
777     case 0x6a:
778     case 0x6b:
779     case 0x6c:
780     case 0x6d:
781     case 0x6e:
782     case 0x6f:
783         ip6_print(p, length);
784         break;
785 #endif
786     default:
787         return 0; /* did not find a ip header */
788         break;
789     }
790     return 1; /* we printed an v4/v6 packet */
791 }
792 
793 static int
juniper_parse_header(const u_char * p,const struct pcap_pkthdr * h,struct juniper_l2info_t * l2info)794 juniper_parse_header (const u_char *p, const struct pcap_pkthdr *h, struct juniper_l2info_t *l2info) {
795 
796     struct juniper_cookie_table_t *lp = juniper_cookie_table;
797     u_int idx, offset;
798 #ifdef DLT_JUNIPER_ATM2
799     u_int32_t control_word;
800 #endif
801 
802     l2info->header_len = 0;
803     l2info->cookie_len = 0;
804     l2info->proto = 0;
805 
806 
807     l2info->length = h->len;
808     l2info->caplen = h->caplen;
809     l2info->direction = p[3]&JUNIPER_BPF_PKT_IN;
810 
811     TCHECK2(p[0],4);
812     if (EXTRACT_24BITS(p) != JUNIPER_MGC_NUMBER) { /* magic number found ? */
813         printf("no magic-number found!");
814         return 0;
815     }
816 
817     if (eflag) /* print direction */
818         printf("%3s ",tok2str(juniper_direction_values,"---",l2info->direction));
819 
820     /* extensions present ?  - calculate how much bytes to skip */
821     if ((p[3] & JUNIPER_BPF_EXT ) == JUNIPER_BPF_EXT ) {
822         offset = 6 + EXTRACT_16BITS(p+4);
823         if (eflag>1)
824             printf("ext-len %u, ",EXTRACT_16BITS(p+4));
825     } else
826         offset = 4;
827 
828     if ((p[3] & JUNIPER_BPF_NO_L2 ) == JUNIPER_BPF_NO_L2 ) {
829         if (eflag)
830             printf("no-L2-hdr, ");
831 
832         /* there is no link-layer present -
833          * perform the v4/v6 heuristics
834          * to figure out what it is
835          */
836         TCHECK2(p[offset+4],1);
837         if(ip_heuristic_guess(p+offset+4,l2info->length-(offset+4)) == 0)
838             printf("no IP-hdr found!");
839 
840         l2info->header_len=offset+4;
841         return 0; /* stop parsing the output further */
842 
843     }
844     l2info->header_len = offset;
845     p+=l2info->header_len;
846     l2info->length -= l2info->header_len;
847     l2info->caplen -= l2info->header_len;
848 
849     /* search through the cookie table and copy values matching for our PIC type */
850     while (lp->s != NULL) {
851         if (lp->pictype == l2info->pictype) {
852 
853             l2info->cookie_len += lp->cookie_len;
854 
855             switch (p[0]) {
856             case LS_COOKIE_ID:
857                 l2info->cookie_type = LS_COOKIE_ID;
858                 l2info->cookie_len += 2;
859                 break;
860             case AS_COOKIE_ID:
861                 l2info->cookie_type = AS_COOKIE_ID;
862                 l2info->cookie_len = 8;
863                 break;
864 
865             default:
866                 l2info->bundle = l2info->cookie[0];
867                 break;
868             }
869 
870 
871 #ifdef DLT_JUNIPER_MFR
872             /* MFR child links don't carry cookies */
873             if (l2info->pictype == DLT_JUNIPER_MFR &&
874                 (p[0] & MFR_BE_MASK) == MFR_BE_MASK) {
875                 l2info->cookie_len = 0;
876             }
877 #endif
878 
879             l2info->header_len += l2info->cookie_len;
880             l2info->length -= l2info->cookie_len;
881             l2info->caplen -= l2info->cookie_len;
882 
883             if (eflag)
884                 printf("%s-PIC, cookie-len %u",
885                        lp->s,
886                        l2info->cookie_len);
887 
888             if (l2info->cookie_len > 0) {
889                 TCHECK2(p[0],l2info->cookie_len);
890                 if (eflag)
891                     printf(", cookie 0x");
892                 for (idx = 0; idx < l2info->cookie_len; idx++) {
893                     l2info->cookie[idx] = p[idx]; /* copy cookie data */
894                     if (eflag) printf("%02x",p[idx]);
895                 }
896             }
897 
898             if (eflag) printf(": "); /* print demarc b/w L2/L3*/
899 
900 
901             l2info->proto = EXTRACT_16BITS(p+l2info->cookie_len);
902             break;
903         }
904         ++lp;
905     }
906     p+=l2info->cookie_len;
907 
908     /* DLT_ specific parsing */
909     switch(l2info->pictype) {
910 #ifdef DLT_JUNIPER_MLPPP
911     case DLT_JUNIPER_MLPPP:
912         switch (l2info->cookie_type) {
913         case LS_COOKIE_ID:
914             l2info->bundle = l2info->cookie[1];
915             break;
916         case AS_COOKIE_ID:
917             l2info->bundle = (EXTRACT_16BITS(&l2info->cookie[6])>>3)&0xfff;
918             l2info->proto = (l2info->cookie[5])&JUNIPER_LSQ_L3_PROTO_MASK;
919             break;
920         default:
921             l2info->bundle = l2info->cookie[0];
922             break;
923         }
924         break;
925 #endif
926 #ifdef DLT_JUNIPER_MLFR
927     case DLT_JUNIPER_MLFR:
928         switch (l2info->cookie_type) {
929         case LS_COOKIE_ID:
930             l2info->bundle = l2info->cookie[1];
931             l2info->proto = EXTRACT_16BITS(p);
932             l2info->header_len += 2;
933             l2info->length -= 2;
934             l2info->caplen -= 2;
935             break;
936         case AS_COOKIE_ID:
937             l2info->bundle = (EXTRACT_16BITS(&l2info->cookie[6])>>3)&0xfff;
938             l2info->proto = (l2info->cookie[5])&JUNIPER_LSQ_L3_PROTO_MASK;
939             break;
940         default:
941             l2info->bundle = l2info->cookie[0];
942             l2info->header_len += 2;
943             l2info->length -= 2;
944             l2info->caplen -= 2;
945             break;
946         }
947         break;
948 #endif
949 #ifdef DLT_JUNIPER_MFR
950     case DLT_JUNIPER_MFR:
951         switch (l2info->cookie_type) {
952         case LS_COOKIE_ID:
953             l2info->bundle = l2info->cookie[1];
954             l2info->proto = EXTRACT_16BITS(p);
955             l2info->header_len += 2;
956             l2info->length -= 2;
957             l2info->caplen -= 2;
958             break;
959         case AS_COOKIE_ID:
960             l2info->bundle = (EXTRACT_16BITS(&l2info->cookie[6])>>3)&0xfff;
961             l2info->proto = (l2info->cookie[5])&JUNIPER_LSQ_L3_PROTO_MASK;
962             break;
963         default:
964             l2info->bundle = l2info->cookie[0];
965             break;
966         }
967         break;
968 #endif
969 #ifdef DLT_JUNIPER_ATM2
970     case DLT_JUNIPER_ATM2:
971         TCHECK2(p[0],4);
972         /* ATM cell relay control word present ? */
973         if (l2info->cookie[7] & ATM2_PKT_TYPE_MASK) {
974             control_word = EXTRACT_32BITS(p);
975             /* some control word heuristics */
976             switch(control_word) {
977             case 0: /* zero control word */
978             case 0x08000000: /* < JUNOS 7.4 control-word */
979             case 0x08380000: /* cntl word plus cell length (56) >= JUNOS 7.4*/
980                 l2info->header_len += 4;
981                 break;
982             default:
983                 break;
984             }
985 
986             if (eflag)
987                 printf("control-word 0x%08x ", control_word);
988         }
989         break;
990 #endif
991 #ifdef DLT_JUNIPER_ATM1
992     case DLT_JUNIPER_ATM1:
993         break;
994 #endif
995 #ifdef DLT_JUNIPER_PPP
996     case DLT_JUNIPER_PPP:
997         break;
998 #endif
999 #ifdef DLT_JUNIPER_CHDLC
1000     case DLT_JUNIPER_CHDLC:
1001         break;
1002 #endif
1003 #ifdef DLT_JUNIPER_ETHER
1004     case DLT_JUNIPER_ETHER:
1005         break;
1006 #endif
1007 #ifdef DLT_JUNIPER_FRELAY
1008     case DLT_JUNIPER_FRELAY:
1009         break;
1010 #endif
1011 
1012     default:
1013         printf("Unknown Juniper DLT_ type %u: ", l2info->pictype);
1014         break;
1015     }
1016 
1017     if (eflag > 1)
1018         printf("hlen %u, proto 0x%04x, ",l2info->header_len,l2info->proto);
1019 
1020     return 1; /* everything went ok so far. continue parsing */
1021  trunc:
1022     printf("[|juniper_hdr], length %u",h->len);
1023     return 0;
1024 }
1025 
1026 
1027 /*
1028  * Local Variables:
1029  * c-style: whitesmith
1030  * c-basic-offset: 4
1031  * End:
1032  */
1033