1/*
2 * Copyright (c) 1992, 1993, 1994, 1995, 1996, 1997
3 *	The Regents of the University of California.  All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
16 * written permission.
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
20 *
21 * Code by Gert Doering, SpaceNet GmbH, gert@space.net
22 *
23 * Reference documentation:
24 *    http://www.cisco.com/univercd/cc/td/doc/product/lan/trsrb/frames.htm
25 */
26
27/* \summary: Cisco Discovery Protocol (CDP) printer */
28
29#ifdef HAVE_CONFIG_H
30#include "config.h"
31#endif
32
33#include <netdissect-stdinc.h>
34
35#include <string.h>
36
37#include "netdissect.h"
38#include "addrtoname.h"
39#include "extract.h"
40#include "nlpid.h"
41
42static const char tstr[] = "[|cdp]";
43
44#define CDP_HEADER_LEN             4
45#define CDP_HEADER_VERSION_OFFSET  0
46#define CDP_HEADER_TTL_OFFSET      1
47#define CDP_HEADER_CHECKSUM_OFFSET 2
48
49#define CDP_TLV_HEADER_LEN  4
50#define CDP_TLV_TYPE_OFFSET 0
51#define CDP_TLV_LEN_OFFSET  2
52
53static const struct tok cdp_tlv_values[] = {
54    { 0x01,             "Device-ID"},
55    { 0x02,             "Address"},
56    { 0x03,             "Port-ID"},
57    { 0x04,             "Capability"},
58    { 0x05,             "Version String"},
59    { 0x06,             "Platform"},
60    { 0x07,             "Prefixes"},
61    { 0x08,             "Protocol-Hello option"},
62    { 0x09,             "VTP Management Domain"},
63    { 0x0a,             "Native VLAN ID"},
64    { 0x0b,             "Duplex"},
65    { 0x0e,             "ATA-186 VoIP VLAN request"},
66    { 0x0f,             "ATA-186 VoIP VLAN assignment"},
67    { 0x10,             "power consumption"},
68    { 0x11,             "MTU"},
69    { 0x12,             "AVVID trust bitmap"},
70    { 0x13,             "AVVID untrusted ports CoS"},
71    { 0x14,             "System Name"},
72    { 0x15,             "System Object ID (not decoded)"},
73    { 0x16,             "Management Addresses"},
74    { 0x17,             "Physical Location"},
75    { 0, NULL}
76};
77
78static const struct tok cdp_capability_values[] = {
79    { 0x01,             "Router" },
80    { 0x02,             "Transparent Bridge" },
81    { 0x04,             "Source Route Bridge" },
82    { 0x08,             "L2 Switch" },
83    { 0x10,             "L3 capable" },
84    { 0x20,             "IGMP snooping" },
85    { 0x40,             "L1 capable" },
86    { 0, NULL }
87};
88
89static int cdp_print_addr(netdissect_options *, const u_char *, int);
90static int cdp_print_prefixes(netdissect_options *, const u_char *, int);
91static unsigned long cdp_get_number(const u_char *, int);
92
93void
94cdp_print(netdissect_options *ndo,
95          const u_char *pptr, u_int length, u_int caplen)
96{
97	int type, len, i, j;
98	const u_char *tptr;
99
100	if (caplen < CDP_HEADER_LEN) {
101		ND_PRINT((ndo, "%s", tstr));
102		return;
103	}
104
105	tptr = pptr; /* temporary pointer */
106
107	ND_TCHECK2(*tptr, CDP_HEADER_LEN);
108	ND_PRINT((ndo, "CDPv%u, ttl: %us", *(tptr + CDP_HEADER_VERSION_OFFSET),
109					   *(tptr + CDP_HEADER_TTL_OFFSET)));
110	if (ndo->ndo_vflag)
111		ND_PRINT((ndo, ", checksum: 0x%04x (unverified), length %u", EXTRACT_16BITS(tptr+CDP_HEADER_CHECKSUM_OFFSET), length));
112	tptr += CDP_HEADER_LEN;
113
114	while (tptr < (pptr+length)) {
115		ND_TCHECK2(*tptr, CDP_TLV_HEADER_LEN); /* read out Type and Length */
116		type = EXTRACT_16BITS(tptr+CDP_TLV_TYPE_OFFSET);
117		len  = EXTRACT_16BITS(tptr+CDP_TLV_LEN_OFFSET); /* object length includes the 4 bytes header length */
118		if (len < CDP_TLV_HEADER_LEN) {
119		    if (ndo->ndo_vflag)
120			ND_PRINT((ndo, "\n\t%s (0x%02x), TLV length: %u byte%s (too short)",
121			       tok2str(cdp_tlv_values,"unknown field type", type),
122			       type,
123			       len,
124			       PLURAL_SUFFIX(len))); /* plural */
125		    else
126			ND_PRINT((ndo, ", %s TLV length %u too short",
127			       tok2str(cdp_tlv_values,"unknown field type", type),
128			       len));
129		    break;
130		}
131		tptr += CDP_TLV_HEADER_LEN;
132		len -= CDP_TLV_HEADER_LEN;
133
134		ND_TCHECK2(*tptr, len);
135
136		if (ndo->ndo_vflag || type == 1) { /* in non-verbose mode just print Device-ID */
137
138		    if (ndo->ndo_vflag)
139			ND_PRINT((ndo, "\n\t%s (0x%02x), value length: %u byte%s: ",
140			       tok2str(cdp_tlv_values,"unknown field type", type),
141			       type,
142			       len,
143			       PLURAL_SUFFIX(len))); /* plural */
144
145		    switch (type) {
146
147		    case 0x01: /* Device-ID */
148			if (!ndo->ndo_vflag)
149			    ND_PRINT((ndo, ", Device-ID "));
150			ND_PRINT((ndo, "'"));
151			(void)fn_printn(ndo, tptr, len, NULL);
152			ND_PRINT((ndo, "'"));
153			break;
154		    case 0x02: /* Address */
155			if (cdp_print_addr(ndo, tptr, len) < 0)
156			    goto trunc;
157			break;
158		    case 0x03: /* Port-ID */
159			ND_PRINT((ndo, "'"));
160			(void)fn_printn(ndo, tptr, len, NULL);
161			ND_PRINT((ndo, "'"));
162			break;
163		    case 0x04: /* Capabilities */
164			if (len < 4)
165			    goto trunc;
166			ND_PRINT((ndo, "(0x%08x): %s",
167			       EXTRACT_32BITS(tptr),
168			       bittok2str(cdp_capability_values, "none", EXTRACT_32BITS(tptr))));
169			break;
170		    case 0x05: /* Version */
171			ND_PRINT((ndo, "\n\t  "));
172			for (i=0;i<len;i++) {
173			    j = *(tptr+i);
174			    if (j == '\n') /* lets rework the version string to
175					      get a nice indentation */
176				ND_PRINT((ndo, "\n\t  "));
177			    else
178				fn_print_char(ndo, j);
179			}
180			break;
181		    case 0x06: /* Platform */
182			ND_PRINT((ndo, "'"));
183			(void)fn_printn(ndo, tptr, len, NULL);
184			ND_PRINT((ndo, "'"));
185			break;
186		    case 0x07: /* Prefixes */
187			if (cdp_print_prefixes(ndo, tptr, len) < 0)
188			    goto trunc;
189			break;
190		    case 0x08: /* Protocol Hello Option - not documented */
191			break;
192		    case 0x09: /* VTP Mgmt Domain  - CDPv2 */
193			ND_PRINT((ndo, "'"));
194			(void)fn_printn(ndo, tptr, len, NULL);
195			ND_PRINT((ndo, "'"));
196			break;
197		    case 0x0a: /* Native VLAN ID - CDPv2 */
198			if (len < 2)
199			    goto trunc;
200			ND_PRINT((ndo, "%d", EXTRACT_16BITS(tptr)));
201			break;
202		    case 0x0b: /* Duplex - CDPv2 */
203			if (len < 1)
204			    goto trunc;
205			ND_PRINT((ndo, "%s", *(tptr) ? "full": "half"));
206			break;
207
208		    /* http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cata/186/2_12_m/english/release/notes/186rn21m.html
209		     * plus more details from other sources
210		     */
211		    case 0x0e: /* ATA-186 VoIP VLAN request - incomplete doc. */
212			if (len < 3)
213			    goto trunc;
214			ND_PRINT((ndo, "app %d, vlan %d", *(tptr), EXTRACT_16BITS(tptr + 1)));
215			break;
216		    case 0x10: /* ATA-186 VoIP VLAN assignment - incomplete doc. */
217			ND_PRINT((ndo, "%1.2fW", cdp_get_number(tptr, len) / 1000.0));
218			break;
219		    case 0x11: /* MTU - not documented */
220			if (len < 4)
221			    goto trunc;
222			ND_PRINT((ndo, "%u bytes", EXTRACT_32BITS(tptr)));
223			break;
224		    case 0x12: /* AVVID trust bitmap - not documented */
225			if (len < 1)
226			    goto trunc;
227			ND_PRINT((ndo, "0x%02x", *(tptr)));
228			break;
229		    case 0x13: /* AVVID untrusted port CoS - not documented */
230			if (len < 1)
231			    goto trunc;
232			ND_PRINT((ndo, "0x%02x", *(tptr)));
233			break;
234		    case 0x14: /* System Name - not documented */
235			ND_PRINT((ndo, "'"));
236			(void)fn_printn(ndo, tptr, len, NULL);
237			ND_PRINT((ndo, "'"));
238			break;
239		    case 0x16: /* System Object ID - not documented */
240			if (cdp_print_addr(ndo, tptr, len) < 0)
241				goto trunc;
242			break;
243		    case 0x17: /* Physical Location - not documented */
244			if (len < 1)
245			    goto trunc;
246			ND_PRINT((ndo, "0x%02x", *(tptr)));
247			if (len > 1) {
248				ND_PRINT((ndo, "/"));
249				(void)fn_printn(ndo, tptr + 1, len - 1, NULL);
250			}
251			break;
252		    default:
253			print_unknown_data(ndo, tptr, "\n\t  ", len);
254			break;
255		    }
256		}
257		tptr = tptr+len;
258	}
259	if (ndo->ndo_vflag < 1)
260	    ND_PRINT((ndo, ", length %u", caplen));
261
262	return;
263trunc:
264	ND_PRINT((ndo, "%s", tstr));
265}
266
267/*
268 * Protocol type values.
269 *
270 * PT_NLPID means that the protocol type field contains an OSI NLPID.
271 *
272 * PT_IEEE_802_2 means that the protocol type field contains an IEEE 802.2
273 * LLC header that specifies that the payload is for that protocol.
274 */
275#define PT_NLPID		1	/* OSI NLPID */
276#define PT_IEEE_802_2		2	/* IEEE 802.2 LLC header */
277
278static int
279cdp_print_addr(netdissect_options *ndo,
280	       const u_char * p, int l)
281{
282	int pt, pl, al, num;
283	const u_char *endp = p + l;
284	static const u_char prot_ipv6[] = {
285		0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00, 0x86, 0xdd
286	};
287
288	ND_TCHECK2(*p, 4);
289	if (p + 4 > endp)
290		goto trunc;
291	num = EXTRACT_32BITS(p);
292	p += 4;
293
294	while (p < endp && num >= 0) {
295		ND_TCHECK2(*p, 2);
296		if (p + 2 > endp)
297			goto trunc;
298		pt = p[0];		/* type of "protocol" field */
299		pl = p[1];		/* length of "protocol" field */
300		p += 2;
301
302		ND_TCHECK2(p[pl], 2);
303		if (p + pl + 2 > endp)
304			goto trunc;
305		al = EXTRACT_16BITS(&p[pl]);	/* address length */
306
307		if (pt == PT_NLPID && pl == 1 && *p == NLPID_IP && al == 4) {
308			/*
309			 * IPv4: protocol type = NLPID, protocol length = 1
310			 * (1-byte NLPID), protocol = 0xcc (NLPID for IPv4),
311			 * address length = 4
312			 */
313			p += 3;
314
315			ND_TCHECK2(*p, 4);
316			if (p + 4 > endp)
317				goto trunc;
318			ND_PRINT((ndo, "IPv4 (%u) %s", num, ipaddr_string(ndo, p)));
319			p += 4;
320		}
321		else if (pt == PT_IEEE_802_2 && pl == 8 &&
322		    memcmp(p, prot_ipv6, 8) == 0 && al == 16) {
323			/*
324			 * IPv6: protocol type = IEEE 802.2 header,
325			 * protocol length = 8 (size of LLC+SNAP header),
326			 * protocol = LLC+SNAP header with the IPv6
327			 * Ethertype, address length = 16
328			 */
329			p += 10;
330			ND_TCHECK2(*p, al);
331			if (p + al > endp)
332				goto trunc;
333
334			ND_PRINT((ndo, "IPv6 (%u) %s", num, ip6addr_string(ndo, p)));
335			p += al;
336		}
337		else {
338			/*
339			 * Generic case: just print raw data
340			 */
341			ND_TCHECK2(*p, pl);
342			if (p + pl > endp)
343				goto trunc;
344			ND_PRINT((ndo, "pt=0x%02x, pl=%d, pb=", *(p - 2), pl));
345			while (pl-- > 0)
346				ND_PRINT((ndo, " %02x", *p++));
347			ND_TCHECK2(*p, 2);
348			if (p + 2 > endp)
349				goto trunc;
350			al = (*p << 8) + *(p + 1);
351			ND_PRINT((ndo, ", al=%d, a=", al));
352			p += 2;
353			ND_TCHECK2(*p, al);
354			if (p + al > endp)
355				goto trunc;
356			while (al-- > 0)
357				ND_PRINT((ndo, " %02x", *p++));
358		}
359		num--;
360		if (num)
361			ND_PRINT((ndo, " "));
362	}
363
364	return 0;
365
366trunc:
367	return -1;
368}
369
370
371static int
372cdp_print_prefixes(netdissect_options *ndo,
373		   const u_char * p, int l)
374{
375	if (l % 5)
376		goto trunc;
377
378	ND_PRINT((ndo, " IPv4 Prefixes (%d):", l / 5));
379
380	while (l > 0) {
381		ND_PRINT((ndo, " %u.%u.%u.%u/%u", p[0], p[1], p[2], p[3], p[4]));
382		l -= 5;
383		p += 5;
384	}
385
386	return 0;
387
388trunc:
389	return -1;
390}
391
392/* read in a <n>-byte number, MSB first
393 * (of course this can handle max sizeof(long))
394 */
395static unsigned long cdp_get_number(const u_char * p, int l)
396{
397    unsigned long res=0;
398    while( l>0 )
399    {
400	res = (res<<8) + *p;
401	p++; l--;
402    }
403    return res;
404}
405