_snmp.c

This directory contains source code for tcpdump, a tool for network monitoring and data acquisition

  if ((count = asn1_parse (np, length, &elem)) < 0)
     return;

  if (elem.type != BE_UNS)
  {                                /* XXX */
    PUTS ("[time-stamp!=TIMETICKS]");
    asn1_print (&elem);
    return;
  }
  asn1_print (&elem);
  length -= count;
  np += count;

  varbind_print (TRAP, np, length);
}

/*
 * Decode arbitrary SNMP PDUs.
 */
static void pdu_print (const u_char * np, u_int length, int version)
{
  struct be pdu;
  int count = 0;

  /* PDU (Context) */
  if ((count = asn1_parse (np, length, &pdu)) < 0)
     return;

  if (pdu.type != BE_PDU)
  {
    PUTS ("[no PDU]");
    return;
  }

  if (count < length)
     PRINTF ("[%d extra after PDU]", length - count);
  asn1_print (&pdu);

  /* descend into PDU */
  length = pdu.asnlen;
  np = (u_char *) pdu.data.raw;

  if (version == SNMP_VERSION_1 &&
      (pdu.id == GETBULKREQ || pdu.id == INFORMREQ ||
       pdu.id == V2TRAP || pdu.id == REPORT))
  {
    PRINTF ("[v2 PDU in v1 message]");
    return;
  }

  if (version == SNMP_VERSION_2 && pdu.id == TRAP)
  {
    PRINTF ("[v1 PDU in v2 message]");
    return;
  }

  switch (pdu.id)
  {
    case TRAP:
         trappdu_print (np, length);
         break;
    case GETREQ:
    case GETNEXTREQ:
    case GETRESP:
    case SETREQ:
    case GETBULKREQ:
    case INFORMREQ:
    case V2TRAP:
    case REPORT:
         snmppdu_print (pdu.id, np, length);
         break;
  }
}

/*
 * Decode a scoped SNMP PDU.
 */
static void scopedpdu_print (const u_char * np, u_int length, int version)
{
  struct be elem;
  int i, count = 0;

  /* Sequence */
  if ((count = asn1_parse (np, length, &elem)) < 0)
     return;

  if (elem.type != BE_SEQ)
  {
    PUTS ("[!scoped PDU]");
    asn1_print (&elem);
    return;
  }
  length = elem.asnlen;
  np = (u_char *) elem.data.raw;

  /* contextEngineID (OCTET STRING) */
  if ((count = asn1_parse (np, length, &elem)) < 0)
     return;

  if (elem.type != BE_STR)
  {
    PUTS ("[contextEngineID!=STR]");
    asn1_print (&elem);
    return;
  }
  length -= count;
  np += count;

  PUTS ("E= ");
  for (i = 0; i < (int) elem.asnlen; i++)
      PRINTF ("0x%02X", elem.data.str[i]);

  PUTCHAR (' ');

  /* contextName (OCTET STRING) */
  if ((count = asn1_parse (np, length, &elem)) < 0)
     return;

  if (elem.type != BE_STR)
  {
    PUTS ("[contextName!=STR]");
    asn1_print (&elem);
    return;
  }
  length -= count;
  np += count;

  PRINTF ("C=%.*s ", (int) elem.asnlen, elem.data.str);

  pdu_print (np, length, version);
}

/*
 * Decode SNMP Community Header (SNMPv1 and SNMPv2c)
 */
static void community_print (const u_char * np, u_int length, int version)
{
  struct be elem;
  int count = 0;

  /* Community (String) */
  if ((count = asn1_parse (np, length, &elem)) < 0)
     return;

  if (elem.type != BE_STR)
  {
    PUTS ("[comm!=STR]");
    asn1_print (&elem);
    return;
  }

  /* default community */
  if (strncmp ((char*)elem.data.str, DEF_COMMUNITY, sizeof(DEF_COMMUNITY)-1))
    /* ! "public" */
    PRINTF ("C=%.*s ", (int) elem.asnlen, elem.data.str);

  length -= count;
  np += count;

  pdu_print (np, length, version);
}

/*
 * Decode SNMPv3 User-based Security Message Header (SNMPv3)
 */
static void usm_print (const u_char * np, u_int length)
{
  struct be elem;
  int count = 0;

  /* Sequence */
  if ((count = asn1_parse (np, length, &elem)) < 0)
     return;

  if (elem.type != BE_SEQ)
  {
    PUTS ("[!usm]");
    asn1_print (&elem);
    return;
  }
  length = elem.asnlen;
  np = (u_char *) elem.data.raw;

  /* msgAuthoritativeEngineID (OCTET STRING) */
  if ((count = asn1_parse (np, length, &elem)) < 0)
     return;

  if (elem.type != BE_STR)
  {
    PUTS ("[msgAuthoritativeEngineID!=STR]");
    asn1_print (&elem);
    return;
  }
  length -= count;
  np += count;

  /* msgAuthoritativeEngineBoots (INTEGER) */
  if ((count = asn1_parse (np, length, &elem)) < 0)
     return;

  if (elem.type != BE_INT)
  {
    PUTS ("[msgAuthoritativeEngineBoots!=INT]");
    asn1_print (&elem);
    return;
  }
  if (vflag)
     PRINTF ("B=%d ", elem.data.integer);
  length -= count;
  np += count;

  /* msgAuthoritativeEngineTime (INTEGER) */
  if ((count = asn1_parse (np, length, &elem)) < 0)
     return;

  if (elem.type != BE_INT)
  {
    PUTS ("[msgAuthoritativeEngineTime!=INT]");
    asn1_print (&elem);
    return;
  }
  if (vflag)
     PRINTF ("T=%d ", elem.data.integer);

  length -= count;
  np += count;

  /* msgUserName (OCTET STRING) */
  if ((count = asn1_parse (np, length, &elem)) < 0)
     return;

  if (elem.type != BE_STR)
  {
    PUTS ("[msgUserName!=STR]");
    asn1_print (&elem);
    return;
  }
  length -= count;
  np += count;

  PRINTF ("U=%.*s ", (int) elem.asnlen, elem.data.str);

  /* msgAuthenticationParameters (OCTET STRING) */
  if ((count = asn1_parse (np, length, &elem)) < 0)
     return;

  if (elem.type != BE_STR)
  {
    PUTS ("[msgAuthenticationParameters!=STR]");
    asn1_print (&elem);
    return;
  }
  length -= count;
  np += count;

  /* msgPrivacyParameters (OCTET STRING) */
  if ((count = asn1_parse (np, length, &elem)) < 0)
     return;

  if (elem.type != BE_STR)
  {
    PUTS ("[msgPrivacyParameters!=STR]");
    asn1_print (&elem);
    return;
  }
  length -= count;
  np += count;

  if (count < length)
    PRINTF ("[%d extra after usm SEQ]", length - count);
}

/*
 * Decode SNMPv3 Message Header (SNMPv3)
 */
static void v3msg_print (const u_char * np, u_int length)
{
  struct be elem;
  int count = 0;
  u_char flags;
  int model;
  const u_char *xnp = np;
  int xlength = length;

  /* Sequence */
  if ((count = asn1_parse (np, length, &elem)) < 0)
     return;

  if (elem.type != BE_SEQ)
  {
    PUTS ("[!message]");
    asn1_print (&elem);
    return;
  }
  length = elem.asnlen;
  np = (u_char *) elem.data.raw;

  /* msgID (INTEGER) */
  if ((count = asn1_parse (np, length, &elem)) < 0)
     return;

  if (elem.type != BE_INT)
  {
    PUTS ("[msgID!=INT]");
    asn1_print (&elem);
    return;
  }
  length -= count;
  np += count;

  /* msgMaxSize (INTEGER) */
  if ((count = asn1_parse (np, length, &elem)) < 0)
     return;

  if (elem.type != BE_INT)
  {
    PUTS ("[msgMaxSize!=INT]");
    asn1_print (&elem);
    return;
  }
  length -= count;
  np += count;

  /* msgFlags (OCTET STRING) */
  if ((count = asn1_parse (np, length, &elem)) < 0)
     return;

  if (elem.type != BE_STR)
  {
    PUTS ("[msgFlags!=STR]");
    asn1_print (&elem);
    return;
  }
  if (elem.asnlen != 1)
  {
    PRINTF ("[msgFlags size %d]", elem.asnlen);
    return;
  }
  flags = elem.data.str[0];
  if (flags != 0x00 && flags != 0x01 && flags != 0x03 &&
      flags != 0x04 && flags != 0x05 && flags != 0x07)
  {
    PRINTF ("[msgFlags=0x%02X]", flags);
    return;
  }
  length -= count;
  np += count;

  PUTS ("F=");
  if (flags & 0x01)
     PUTCHAR ('a');
  if (flags & 0x02)
     PUTCHAR ('p');
  if (flags & 0x04)
     PUTCHAR ('r');
  PUTCHAR (' ');

  /* msgSecurityModel (INTEGER) */
  if ((count = asn1_parse (np, length, &elem)) < 0)
     return;

  if (elem.type != BE_INT)
  {
    PUTS ("[msgSecurityModel!=INT]");
    asn1_print (&elem);
    return;
  }
  model = elem.data.integer;
  length -= count;
  np += count;

  if (count < length)
    PRINTF ("[%d extra after message SEQ]", length - count);

  if (model == 3)
  {
    if (vflag)
       PUTS ("USM ");
  }
  else
  {
    PRINTF ("[security model %d]", model);
    return;
  }

  np = xnp + (np - xnp);
  length = xlength - (np - xnp);

  /* msgSecurityParameters (OCTET STRING) */
  if ((count = asn1_parse (np, length, &elem)) < 0)
     return;

  if (elem.type != BE_STR)
  {
    PUTS ("[msgSecurityParameters!=STR]");
    asn1_print (&elem);
    return;
  }
  length -= count;
  np += count;

  if (model == 3)
     usm_print (elem.data.str, elem.asnlen);

  if (vflag)
     PUTS ("ScopedPDU ");

  scopedpdu_print (np, length, 3);
}

/*
 * Decode SNMP header and pass on to PDU printing routines
 */
void snmp_print (const u_char * np, u_int length)
{
  struct be elem;
  int count = 0;
  int version = 0;

  truncated = 0;

  /* truncated packet? */
  if (np + length > snapend)
  {
    truncated = 1;
    length = snapend - np;
  }

  PUTCHAR (' ');

  /* initial Sequence */
  if ((count = asn1_parse (np, length, &elem)) < 0)
     return;

  if (elem.type != BE_SEQ)
  {
    PUTS ("[!init SEQ]");
    asn1_print (&elem);
    return;
  }
  if (count < length)
     PRINTF ("[%d extra after iSEQ]", length - count);

  /* descend */
  length = elem.asnlen;
  np = (u_char *) elem.data.raw;

  /* Version (INTEGER) */
  if ((count = asn1_parse (np, length, &elem)) < 0)
     return;

  if (elem.type != BE_INT)
  {
    PUTS ("[version!=INT]");
    asn1_print (&elem);
    return;
  }

  switch (elem.data.integer)
  {
    case SNMP_VERSION_1:
    case SNMP_VERSION_2:
    case SNMP_VERSION_3:
         if (vflag)
           PRINTF ("%s ", SnmpVersion[elem.data.integer]);
         break;
    default:
         PRINTF ("[version = %d]", elem.data.integer);
         return;
  }

  version = elem.data.integer;
  length -= count;
  np += count;

  switch (version)
  {
    case SNMP_VERSION_1:
    case SNMP_VERSION_2:
         community_print (np, length, version);
         break;
    case SNMP_VERSION_3:
         v3msg_print (np, length);
         break;
    default:
         PRINTF ("[version = %d]", elem.data.integer);
         break;
  }
}