print-juniper.c

TCPDUMP的C语言源代码,是在数据链路层的应用

};

struct juniper_cookie_table_t {
    u_int32_t pictype;		/* pic type */
    u_int8_t  cookie_len;       /* cookie len */
    const char *s;		/* pic name */
};

static struct juniper_cookie_table_t juniper_cookie_table[] = {
#ifdef DLT_JUNIPER_ATM1
    { DLT_JUNIPER_ATM1,  4, "ATM1"},
#endif
#ifdef DLT_JUNIPER_ATM2
    { DLT_JUNIPER_ATM2,  8, "ATM2"},
#endif
#ifdef DLT_JUNIPER_MLPPP
    { DLT_JUNIPER_MLPPP, 2, "MLPPP"},
#endif
#ifdef DLT_JUNIPER_MLFR
    { DLT_JUNIPER_MLFR,  2, "MLFR"},
#endif
#ifdef DLT_JUNIPER_MFR
    { DLT_JUNIPER_MFR,   4, "MFR"},
#endif
#ifdef DLT_JUNIPER_PPPOE
    { DLT_JUNIPER_PPPOE, 0, "PPPoE"},
#endif
#ifdef DLT_JUNIPER_PPPOE_ATM
    { DLT_JUNIPER_PPPOE_ATM, 0, "PPPoE ATM"},
#endif
#ifdef DLT_JUNIPER_GGSN
    { DLT_JUNIPER_GGSN, 8, "GGSN"},
#endif
#ifdef DLT_JUNIPER_MONITOR
    { DLT_JUNIPER_MONITOR, 8, "MONITOR"},
#endif
#ifdef DLT_JUNIPER_SERVICES
    { DLT_JUNIPER_SERVICES, 8, "AS"},
#endif
#ifdef DLT_JUNIPER_ES
    { DLT_JUNIPER_ES, 0, "ES"},
#endif
    { 0, 0, NULL }
};

struct juniper_l2info_t {
    u_int32_t length;
    u_int32_t caplen;
    u_int32_t pictype;
    u_int8_t direction;
    u_int8_t header_len;
    u_int8_t cookie_len;
    u_int8_t cookie_type;
    u_int8_t cookie[8];
    u_int8_t bundle;
    u_int16_t proto;
    u_int8_t flags;
};

#define LS_COOKIE_ID            0x54
#define AS_COOKIE_ID            0x47
#define LS_MLFR_COOKIE_LEN	4
#define ML_MLFR_COOKIE_LEN	2
#define LS_MFR_COOKIE_LEN	6
#define ATM1_COOKIE_LEN         4
#define ATM2_COOKIE_LEN         8

#define ATM2_PKT_TYPE_MASK  0x70
#define ATM2_GAP_COUNT_MASK 0x3F

#define JUNIPER_PROTO_NULL          1
#define JUNIPER_PROTO_IPV4          2
#define JUNIPER_PROTO_IPV6          6

#define MFR_BE_MASK 0xc0

static struct tok juniper_protocol_values[] = {
    { JUNIPER_PROTO_NULL, "Null" },
    { JUNIPER_PROTO_IPV4, "IPv4" },
    { JUNIPER_PROTO_IPV6, "IPv6" },
    { 0, NULL}
};

int ip_heuristic_guess(register const u_char *, u_int);
int juniper_ppp_heuristic_guess(register const u_char *, u_int);
int juniper_read_tlv_value(const u_char *, u_int, u_int);
static int juniper_parse_header (const u_char *, const struct pcap_pkthdr *, struct juniper_l2info_t *);

#ifdef DLT_JUNIPER_GGSN
u_int
juniper_ggsn_print(const struct pcap_pkthdr *h, register const u_char *p)
{
        struct juniper_l2info_t l2info;
        struct juniper_ggsn_header {
            u_int8_t svc_id;
            u_int8_t flags_len;
            u_int8_t proto;
            u_int8_t flags;
            u_int8_t vlan_id[2];
            u_int8_t res[2];
        };
        const struct juniper_ggsn_header *gh;

        l2info.pictype = DLT_JUNIPER_GGSN;
        if(juniper_parse_header(p, h, &l2info) == 0)
            return l2info.header_len;

        p+=l2info.header_len;
        gh = (struct juniper_ggsn_header *)&l2info.cookie;

        if (eflag) {
            printf("proto %s (%u), vlan %u: ",
                   tok2str(juniper_protocol_values,"Unknown",gh->proto),
                   gh->proto,
                   EXTRACT_16BITS(&gh->vlan_id[0]));
        }

        switch (gh->proto) {
        case JUNIPER_PROTO_IPV4:
            ip_print(gndo, p, l2info.length);
            break;
#ifdef INET6
        case JUNIPER_PROTO_IPV6:
            ip6_print(p, l2info.length);
            break;
#endif /* INET6 */
        default:
            if (!eflag)
                printf("unknown GGSN proto (%u)", gh->proto);
        }

        return l2info.header_len;
}
#endif

#ifdef DLT_JUNIPER_ES
u_int
juniper_es_print(const struct pcap_pkthdr *h, register const u_char *p)
{
        struct juniper_l2info_t l2info;
        struct juniper_ipsec_header {
            u_int8_t sa_index[2];
            u_int8_t ttl;
            u_int8_t type;
            u_int8_t spi[4];
            u_int8_t src_ip[4];
            u_int8_t dst_ip[4];
        };
        u_int rewrite_len,es_type_bundle;
        const struct juniper_ipsec_header *ih;

        l2info.pictype = DLT_JUNIPER_ES;
        if(juniper_parse_header(p, h, &l2info) == 0)
            return l2info.header_len;

        p+=l2info.header_len;
        ih = (struct juniper_ipsec_header *)p;

        switch (ih->type) {
        case JUNIPER_IPSEC_O_ESP_ENCRYPT_ESP_AUTHEN_TYPE:
        case JUNIPER_IPSEC_O_ESP_ENCRYPT_AH_AUTHEN_TYPE:
            rewrite_len = 0;
            es_type_bundle = 1;
            break;
        case JUNIPER_IPSEC_O_ESP_AUTHENTICATION_TYPE:
        case JUNIPER_IPSEC_O_AH_AUTHENTICATION_TYPE:
        case JUNIPER_IPSEC_O_ESP_ENCRYPTION_TYPE:
            rewrite_len = 16;
            es_type_bundle = 0;
        default:
            printf("ES Invalid type %u, length %u",
                   ih->type,
                   l2info.length);
            return l2info.header_len;
        }

        l2info.length-=rewrite_len;
        p+=rewrite_len;

        if (eflag) {
            if (!es_type_bundle) {
                printf("ES SA, index %u, ttl %u type %s (%u), spi %u, Tunnel %s > %s, length %u\n", 
                       EXTRACT_16BITS(&ih->sa_index),
                       ih->ttl, 
                       tok2str(juniper_ipsec_type_values,"Unknown",ih->type),
                       ih->type,
                       EXTRACT_32BITS(&ih->spi),
                       ipaddr_string(&ih->src_ip),
                       ipaddr_string(&ih->dst_ip),
                       l2info.length);
            } else {
                printf("ES SA, index %u, ttl %u type %s (%u), length %u\n", 
                       EXTRACT_16BITS(&ih->sa_index),
                       ih->ttl, 
                       tok2str(juniper_ipsec_type_values,"Unknown",ih->type),
                       ih->type,
                       l2info.length);
            }
        }

        ip_print(gndo, p, l2info.length);
        return l2info.header_len;
}
#endif

#ifdef DLT_JUNIPER_MONITOR
u_int
juniper_monitor_print(const struct pcap_pkthdr *h, register const u_char *p)
{
        struct juniper_l2info_t l2info;
        struct juniper_monitor_header {
            u_int8_t pkt_type;
            u_int8_t padding;
            u_int8_t iif[2];
            u_int8_t service_id[4];
        };
        const struct juniper_monitor_header *mh;

        l2info.pictype = DLT_JUNIPER_MONITOR;
        if(juniper_parse_header(p, h, &l2info) == 0)
            return l2info.header_len;

        p+=l2info.header_len;
        mh = (struct juniper_monitor_header *)p;

        if (eflag)
            printf("service-id %u, iif %u, pkt-type %u: ",
                   EXTRACT_32BITS(&mh->service_id),
                   EXTRACT_16BITS(&mh->iif),
                   mh->pkt_type);

        /* no proto field - lets guess by first byte of IP header*/
        ip_heuristic_guess(p, l2info.length);

        return l2info.header_len;
}
#endif

#ifdef DLT_JUNIPER_SERVICES
u_int
juniper_services_print(const struct pcap_pkthdr *h, register const u_char *p)
{
        struct juniper_l2info_t l2info;
        struct juniper_services_header {
            u_int8_t svc_id;
            u_int8_t flags_len;
            u_int8_t svc_set_id[2];
            u_int8_t dir_iif[4];
        };
        const struct juniper_services_header *sh;

        l2info.pictype = DLT_JUNIPER_SERVICES;
        if(juniper_parse_header(p, h, &l2info) == 0)
            return l2info.header_len;

        p+=l2info.header_len;
        sh = (struct juniper_services_header *)p;

        if (eflag)
            printf("service-id %u flags 0x%02x service-set-id 0x%04x iif %u: ",
                   sh->svc_id,
                   sh->flags_len,
                   EXTRACT_16BITS(&sh->svc_set_id),
                   EXTRACT_24BITS(&sh->dir_iif[1]));

        /* no proto field - lets guess by first byte of IP header*/
        ip_heuristic_guess(p, l2info.length);

        return l2info.header_len;
}
#endif

#ifdef DLT_JUNIPER_PPPOE
u_int
juniper_pppoe_print(const struct pcap_pkthdr *h, register const u_char *p)
{
        struct juniper_l2info_t l2info;

        l2info.pictype = DLT_JUNIPER_PPPOE;
        if(juniper_parse_header(p, h, &l2info) == 0)
            return l2info.header_len;

        p+=l2info.header_len;
        /* this DLT contains nothing but raw ethernet frames */
        ether_print(p, l2info.length, l2info.caplen);
        return l2info.header_len;
}
#endif

#ifdef DLT_JUNIPER_ETHER
u_int
juniper_ether_print(const struct pcap_pkthdr *h, register const u_char *p)
{
        struct juniper_l2info_t l2info;

        l2info.pictype = DLT_JUNIPER_ETHER;
        if(juniper_parse_header(p, h, &l2info) == 0)
            return l2info.header_len;

        p+=l2info.header_len;
        /* this DLT contains nothing but raw Ethernet frames */
        ether_print(p, l2info.length, l2info.caplen);
        return l2info.header_len;
}
#endif

#ifdef DLT_JUNIPER_PPP
u_int
juniper_ppp_print(const struct pcap_pkthdr *h, register const u_char *p)
{
        struct juniper_l2info_t l2info;

        l2info.pictype = DLT_JUNIPER_PPP;
        if(juniper_parse_header(p, h, &l2info) == 0)
            return l2info.header_len;

        p+=l2info.header_len;
        /* this DLT contains nothing but raw ppp frames */
        ppp_print(p, l2info.length);
        return l2info.header_len;
}
#endif

#ifdef DLT_JUNIPER_FRELAY
u_int
juniper_frelay_print(const struct pcap_pkthdr *h, register const u_char *p)
{
        struct juniper_l2info_t l2info;

        l2info.pictype = DLT_JUNIPER_FRELAY;
        if(juniper_parse_header(p, h, &l2info) == 0)
            return l2info.header_len;

        p+=l2info.header_len;
        /* this DLT contains nothing but raw frame-relay frames */
        fr_print(p, l2info.length);
        return l2info.header_len;
}
#endif

#ifdef DLT_JUNIPER_CHDLC
u_int
juniper_chdlc_print(const struct pcap_pkthdr *h, register const u_char *p)
{
        struct juniper_l2info_t l2info;

        l2info.pictype = DLT_JUNIPER_CHDLC;
        if(juniper_parse_header(p, h, &l2info) == 0)
            return l2info.header_len;

        p+=l2info.header_len;
        /* this DLT contains nothing but raw c-hdlc frames */
        chdlc_print(p, l2info.length);
        return l2info.header_len;
}
#endif

#ifdef DLT_JUNIPER_PPPOE_ATM
u_int
juniper_pppoe_atm_print(const struct pcap_pkthdr *h, register const u_char *p)
{
        struct juniper_l2info_t l2info;
	u_int16_t extracted_ethertype;

        l2info.pictype = DLT_JUNIPER_PPPOE_ATM;