_ppp.c

This directory contains source code for tcpdump, a tool for network monitoring and data acquisition

/*
 * This file has been slightly modified by NRL for use with IPv6+IPsec.
 * Search for USE_INET6 and/or IPSEC to see the blocks where this happened.
 * See the NRL Copyright notice for conditions on the modifications.
 */
/*
 * Copyright (c) 1990, 1991, 1993, 1994, 1995, 1996
 *      The Regents of the University of California.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that: (1) source code distributions
 * retain the above copyright notice and this paragraph in its entirety, (2)
 * distributions including binary code include the above copyright notice and
 * this paragraph in its entirety in the documentation or other materials
 * provided with the distribution, and (3) all advertising materials mentioning
 * features or use of this software display the following acknowledgement:
 * ``This product includes software developed by the University of California,
 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
 * the University nor the names of its contributors may be used to endorse
 * or promote products derived from this software without specific prior
 * written permission.
 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
 */

#include <stdio.h>
#include <ctype.h>
#include <time.h>
#include <sys/param.h>
#include <sys/socket.h>
#include <net/ppp_defs.h>

#include "ethertyp.h"
#include "interfac.h"
#include "a2name.h"
#include "ip.h"
#include "ppp.h"

#define PPP_BSDI_HDRLEN 24

/*
 * Protocol type to string mapping
 */
struct tok ppptype2str[] = {
       { PPP_IP,      "IP" },
       { PPP_OSI,     "OSI" },
       { PPP_NS,      "NS" },
       { PPP_DECNET,  "DECNET" },
       { PPP_APPLE,   "APPLE" },
       { PPP_IPX,     "IPX" },
       { PPP_VJC,     "VJC" },
       { PPP_VJNC,    "VJNC" },
       { PPP_BRPDU,   "BRPDU" },
       { PPP_STII,    "STII" },
       { PPP_VINES,   "VINES" },

       { PPP_HELLO,   "HELLO" },
       { PPP_LUXCOM,  "LUXCOM" },
       { PPP_SNS,     "SNS" },
       { PPP_IPCP,    "IPCP" },
       { PPP_OSICP,   "OSICP" },
       { PPP_NSCP,    "NSCP" },
       { PPP_DECNETCP,"DECNETCP" },
       { PPP_APPLECP, "APPLECP" },
       { PPP_IPXCP,   "IPXCP" },
       { PPP_STIICP,  "STIICP" },
       { PPP_VINESCP, "VINESCP" },

       { PPP_LCP,     "LCP" },
       { PPP_PAP,     "PAP" },
       { PPP_LQM,     "LQM" },
       { PPP_CHAP,    "CHAP" },
       { 0,           NULL    }
     };

struct protonames {
       u_short protocol;
       char   *name;
     };

/*
 * Protocol field values
 */
static struct protonames protonames[] = {
     { PPP_IP,         "IP"         },  /* Internet Protocol */
// !!{ PPP_XNS,        "XNS"        },  /* Xerox NS */
     { PPP_IPX,        "IPX"        },  /* IPX Datagram (RFC1552) */
     { PPP_VJC_COMP,   "VJC_UNCOMP" },  /* VJ compressed TCP */
     { PPP_VJC_UNCOMP, "VJC_UNCOMP" },  /* VJ uncompressed TCP */
     { PPP_COMP,       "COMP"       },  /* compressed packet */
     { PPP_IPCP,       "IPCP"       },  /* IP Control Protocol */
     { PPP_IPXCP,      "IPXCP"      },  /* IPX Control Protocol (RFC1552) */
     { PPP_CCP,        "CCP"        },  /* Compression Control Protocol */
     { PPP_LCP,        "LCP"        },  /* Link Control Protocol */
     { PPP_PAP,        "PAP"        },  /* Password Authentication Protocol */
     { PPP_LQR,        "LQR"        },  /* Link Quality Report protocol */
     { PPP_CHAP,       "CHAP"       }   /* Cryptographic Handshake Auth. Proto */
   };

void ppp_hdlc_print (const u_char * p, int length)
{
  int proto = PPP_PROTOCOL (p);
  int i;

  PRINTF ("%4d %02x ", length, *(p+1));  /* length, control */

  for (i = DIM(protonames)-1; i >= 0; --i)
  {
    if (proto == protonames[i].protocol)
    {
      PRINTF ("%s: ", protonames[i].name);
      break;
    }
  }
  if (i < 0)
     PRINTF ("%04x: ", proto);
}

void ppp_if_print (u_char * user, const struct pcap_pkthdr *h, const u_char * p)
{
  static u_int32_t num_pkt = 0;
  struct ip *ip;
  u_int  length = h->len;
  u_int  caplen = h->caplen;

  user = user;
  ts_print (&h->ts);

  if (caplen < PPP_HDRLEN)
  {
    PUTS ("[|ppp]");
    goto out;
  }

  /*
   * Some printers want to get back at the link level addresses,
   * and/or check that they're not walking off the end of the packet.
   * Rather than pass them all the way down, we set these globals.
   */
  packetp = p;
  snapend = p + caplen;

  if (eflag)
    ppp_hdlc_print (p, length);

  length -= PPP_HDRLEN;
  ip = (struct ip*)(p + PPP_HDRLEN);

  switch (PPP_PROTOCOL (p))
  {
    case PPP_IPV6:
    case PPP_IP:
    case ETHERTYPE_IP:
         ip = (struct ip*)(p + PPP_HDRLEN);
#ifdef USE_INET6
         if (IP_V(ip) == 4)
              ip_print ((const u_char*)ip, length);
         else ip6_print ((const u_char*)ip, length);
#else
         ip_print((const u_char*)ip, length);
#endif
         break;

    case PPP_IPX:
    case ETHERTYPE_IPX:
         ipx_print ((const u_char*)(p + PPP_HDRLEN), length);
         break;

    default:
         if (!eflag)
            ppp_hdlc_print (p, length);
         if (!xflag)
            default_print ((const u_char*)(p + PPP_HDRLEN),
                           caplen - PPP_HDRLEN);
  }

  if (xflag)
     default_print ((const u_char*)(p + PPP_HDRLEN),
                    caplen - PPP_HDRLEN);
  if (aflag)
     ascii_print((const u_char*)ip, caplen - PPP_HDRLEN);

out:
  PUTS ("\n");
  status_write ("PPP: %lu (%lu)", ++num_pkt, pcap_mac_packets());
}

/*
 * BSD/OS specific PPP printer
 */
void ppp_bs_if_print (u_char *user, const struct pcap_pkthdr *h, const u_char *p)
{
  static  u_int32_t num_pkt = 0;
  u_int   length = h->len;
  u_int   caplen = h->caplen;
  int     hdrlength;
  u_short ptype;

  ts_print (&h->ts);

  if (caplen < PPP_BSDI_HDRLEN)
  {
    PUTS ("[|ppp]");
    goto out;
  }

  /*
   * Some printers want to get back at the link level addresses,
   * and/or check that they're not walking off the end of the packet.
   * Rather than pass them all the way down, we set these globals.
   */
  packetp   = p;
  snapend   = p + caplen;
  hdrlength = 0;

  if (p[0] == PPP_ADDRESS && p[1] == PPP_CONTROL)
  {
    if (eflag)
       PRINTF ("%02x %02x ", p[0], p[1]);
    p += 2;
    hdrlength = 2;
  }

  if (eflag)
     PRINTF ("%d ", length);

  /* Retrieve the protocol type */
  if (*p & 1)
  {
    /* Compressed protocol field */
    ptype = *p;
    if (eflag)
       PRINTF ("%02x ", ptype);
    p++;
    hdrlength += 1;
  }
  else
  {
    /* Un-compressed protocol field */
    ptype = ntohs (*(u_short*)p);
    if (eflag)
       PRINTF ("%04x ", ptype);
    p += 2;
    hdrlength += 2;
  }

  length -= hdrlength;

  if (ptype == PPP_IP)
       ip_print (p, length);
  else if (ptype == PPP_LCP)
       lcp_print(p, length, 0);  /* caplen isn't used in lcp_print */
  else PRINTF ("%s ", tok2str (ppptype2str, "proto-#%d", ptype));

  if (xflag)
     default_print ((const u_char*)p, caplen - hdrlength);

out:
  PUTS ("\n");
  status_write ("PPP: %lu (%lu)", ++num_pkt, pcap_mac_packets());
}