1 /*
2 * Copyright (c) 1992, 1993, 1994, 1995, 1996, 1997
3 * The Regents of the University of California. All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
16 * written permission.
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
20 *
21 * Code by Gert Doering, SpaceNet GmbH, gert@space.net
22 *
23 * Reference documentation:
24 * https://web.archive.org/web/20000914194913/http://www.cisco.com/univercd/cc/td/doc/product/lan/trsrb/frames.pdf
25 */
26
27 #include <sys/cdefs.h>
28 #ifndef lint
29 __RCSID("$NetBSD: print-cdp.c,v 1.10 2024/09/02 16:15:30 christos Exp $");
30 #endif
31
32 /* \summary: Cisco Discovery Protocol (CDP) printer */
33
34 #include <config.h>
35
36 #include "netdissect-stdinc.h"
37
38 #include <string.h>
39
40 #define ND_LONGJMP_FROM_TCHECK
41 #include "netdissect.h"
42 #include "addrtoname.h"
43 #include "extract.h"
44 #include "nlpid.h"
45
46
47 #define CDP_HEADER_LEN 4
48 #define CDP_HEADER_VERSION_OFFSET 0
49 #define CDP_HEADER_TTL_OFFSET 1
50 #define CDP_HEADER_CHECKSUM_OFFSET 2
51
52 #define CDP_TLV_HEADER_LEN 4
53 #define CDP_TLV_TYPE_OFFSET 0
54 #define CDP_TLV_LEN_OFFSET 2
55
56 static const struct tok cdp_capability_values[] = {
57 { 0x01, "Router" },
58 { 0x02, "Transparent Bridge" },
59 { 0x04, "Source Route Bridge" },
60 { 0x08, "L2 Switch" },
61 { 0x10, "L3 capable" },
62 { 0x20, "IGMP snooping" },
63 { 0x40, "L1 capable" },
64 { 0, NULL }
65 };
66
67 static void cdp_print_addr(netdissect_options *, const u_char *, u_int);
68 static void cdp_print_prefixes(netdissect_options *, const u_char *, u_int);
69
70 static void
cdp_print_string(netdissect_options * ndo,const u_char * cp,const u_int len)71 cdp_print_string(netdissect_options *ndo,
72 const u_char *cp, const u_int len)
73 {
74 ND_PRINT("'");
75 (void)nd_printn(ndo, cp, len, NULL);
76 ND_PRINT("'");
77 }
78
79 static void
cdp_print_power(netdissect_options * ndo,const u_char * cp,const u_int len)80 cdp_print_power(netdissect_options *ndo,
81 const u_char *cp, const u_int len)
82 {
83 u_int val = 0;
84
85 switch (len) {
86 case 1:
87 val = GET_U_1(cp);
88 break;
89 case 2:
90 val = GET_BE_U_2(cp);
91 break;
92 case 3:
93 val = GET_BE_U_3(cp);
94 break;
95 }
96 ND_PRINT("%1.2fW", val / 1000.0);
97 }
98
99 static void
cdp_print_capability(netdissect_options * ndo,const u_char * cp,const u_int len _U_)100 cdp_print_capability(netdissect_options *ndo,
101 const u_char *cp, const u_int len _U_)
102 {
103 uint32_t val = GET_BE_U_4(cp);
104
105 ND_PRINT("(0x%08x): %s", val,
106 bittok2str(cdp_capability_values, "none", val));
107 }
108
109 /* Rework the version string to get a nice indentation. */
110 static void
cdp_print_version(netdissect_options * ndo,const u_char * cp,const u_int len)111 cdp_print_version(netdissect_options *ndo,
112 const u_char *cp, const u_int len)
113 {
114 unsigned i;
115
116 ND_PRINT("\n\t ");
117 for (i = 0; i < len; i++) {
118 u_char c = GET_U_1(cp + i);
119
120 if (c == '\n')
121 ND_PRINT("\n\t ");
122 else
123 fn_print_char(ndo, c);
124 }
125 }
126
127 static void
cdp_print_uint16(netdissect_options * ndo,const u_char * cp,const u_int len _U_)128 cdp_print_uint16(netdissect_options *ndo,
129 const u_char *cp, const u_int len _U_)
130 {
131 ND_PRINT("%u", GET_BE_U_2(cp));
132 }
133
134 static void
cdp_print_duplex(netdissect_options * ndo,const u_char * cp,const u_int len _U_)135 cdp_print_duplex(netdissect_options *ndo,
136 const u_char *cp, const u_int len _U_)
137 {
138 ND_PRINT("%s", GET_U_1(cp) ? "full": "half");
139 }
140
141 /* https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cata/186/2_12_m/english/release/notes/186rn21m.html
142 * plus more details from other sources
143 *
144 * There are apparently versions of the request with both
145 * 2 bytes and 3 bytes of value. The 3 bytes of value
146 * appear to be a 1-byte application type followed by a
147 * 2-byte VLAN ID; the 2 bytes of value are unknown
148 * (they're 0x20 0x00 in some captures I've seen; that
149 * is not a valid VLAN ID, as VLAN IDs are 12 bits).
150 *
151 * The replies all appear to be 3 bytes long.
152 */
153 static void
cdp_print_ata186(netdissect_options * ndo,const u_char * cp,const u_int len)154 cdp_print_ata186(netdissect_options *ndo,
155 const u_char *cp, const u_int len)
156 {
157 if (len == 2)
158 ND_PRINT("unknown 0x%04x", GET_BE_U_2(cp));
159 else
160 ND_PRINT("app %u, vlan %u", GET_U_1(cp), GET_BE_U_2(cp + 1));
161 }
162
163 static void
cdp_print_mtu(netdissect_options * ndo,const u_char * cp,const u_int len _U_)164 cdp_print_mtu(netdissect_options *ndo,
165 const u_char *cp, const u_int len _U_)
166 {
167 ND_PRINT("%u bytes", GET_BE_U_4(cp));
168 }
169
170 static void
cdp_print_uint8x(netdissect_options * ndo,const u_char * cp,const u_int len _U_)171 cdp_print_uint8x(netdissect_options *ndo,
172 const u_char *cp, const u_int len _U_)
173 {
174 ND_PRINT("0x%02x", GET_U_1(cp));
175 }
176
177 static void
cdp_print_phys_loc(netdissect_options * ndo,const u_char * cp,const u_int len)178 cdp_print_phys_loc(netdissect_options *ndo,
179 const u_char *cp, const u_int len)
180 {
181 ND_PRINT("0x%02x", GET_U_1(cp));
182 if (len > 1) {
183 ND_PRINT("/");
184 (void)nd_printn(ndo, cp + 1, len - 1, NULL);
185 }
186 }
187
188 struct cdp_tlvinfo {
189 const char *name;
190 void (*printer)(netdissect_options *ndo, const u_char *, u_int);
191 int min_len, max_len;
192 };
193
194 #define T_DEV_ID 0x01
195 #define T_MAX 0x17
196 static const struct cdp_tlvinfo cdptlvs[T_MAX + 1] = {
197 /* 0x00 */
198 [ T_DEV_ID ] = { "Device-ID", cdp_print_string, -1, -1 },
199 [ 0x02 ] = { "Address", cdp_print_addr, -1, -1 },
200 [ 0x03 ] = { "Port-ID", cdp_print_string, -1, -1 },
201 [ 0x04 ] = { "Capability", cdp_print_capability, 4, 4 },
202 [ 0x05 ] = { "Version String", cdp_print_version, -1, -1 },
203 [ 0x06 ] = { "Platform", cdp_print_string, -1, -1 },
204 [ 0x07 ] = { "Prefixes", cdp_print_prefixes, -1, -1 },
205 /* not documented */
206 [ 0x08 ] = { "Protocol-Hello option", NULL, -1, -1 },
207 /* CDPv2 */
208 [ 0x09 ] = { "VTP Management Domain", cdp_print_string, -1, -1 },
209 /* CDPv2 */
210 [ 0x0a ] = { "Native VLAN ID", cdp_print_uint16, 2, 2 },
211 /* CDPv2 */
212 [ 0x0b ] = { "Duplex", cdp_print_duplex, 1, 1 },
213 /* 0x0c */
214 /* 0x0d */
215 /* incomplete doc. */
216 [ 0x0e ] = { "ATA-186 VoIP VLAN assignment", cdp_print_ata186, 3, 3 },
217 /* incomplete doc. */
218 [ 0x0f ] = { "ATA-186 VoIP VLAN request", cdp_print_ata186, 2, 3 },
219 /* not documented */
220 [ 0x10 ] = { "power consumption", cdp_print_power, 1, 3 },
221 /* not documented */
222 [ 0x11 ] = { "MTU", cdp_print_mtu, 4, 4 },
223 /* not documented */
224 [ 0x12 ] = { "AVVID trust bitmap", cdp_print_uint8x, 1, 1 },
225 /* not documented */
226 [ 0x13 ] = { "AVVID untrusted ports CoS", cdp_print_uint8x, 1, 1 },
227 /* not documented */
228 [ 0x14 ] = { "System Name", cdp_print_string, -1, -1 },
229 /* not documented */
230 [ 0x15 ] = { "System Object ID (not decoded)", NULL, -1, -1 },
231 [ 0x16 ] = { "Management Addresses", cdp_print_addr, 4, -1 },
232 /* not documented */
233 [ 0x17 ] = { "Physical Location", cdp_print_phys_loc, 1, -1 },
234 };
235
236 void
cdp_print(netdissect_options * ndo,const u_char * tptr,u_int length)237 cdp_print(netdissect_options *ndo,
238 const u_char *tptr, u_int length)
239 {
240 u_int orig_length = length;
241 uint16_t checksum;
242
243 ndo->ndo_protocol = "cdp";
244
245 if (length < CDP_HEADER_LEN) {
246 ND_PRINT(" (packet length %u < %u)", length, CDP_HEADER_LEN);
247 goto invalid;
248 }
249 ND_PRINT("CDPv%u, ttl: %us",
250 GET_U_1(tptr + CDP_HEADER_VERSION_OFFSET),
251 GET_U_1(tptr + CDP_HEADER_TTL_OFFSET));
252 checksum = GET_BE_U_2(tptr + CDP_HEADER_CHECKSUM_OFFSET);
253 if (ndo->ndo_vflag)
254 ND_PRINT(", checksum: 0x%04x (unverified), length %u",
255 checksum, orig_length);
256 tptr += CDP_HEADER_LEN;
257 length -= CDP_HEADER_LEN;
258
259 while (length) {
260 u_int type, len;
261 const struct cdp_tlvinfo *info;
262 const char *name;
263 u_char covered = 0;
264
265 if (length < CDP_TLV_HEADER_LEN) {
266 ND_PRINT(" (remaining packet length %u < %u)",
267 length, CDP_TLV_HEADER_LEN);
268 goto invalid;
269 }
270 type = GET_BE_U_2(tptr + CDP_TLV_TYPE_OFFSET);
271 len = GET_BE_U_2(tptr + CDP_TLV_LEN_OFFSET); /* object length includes the 4 bytes header length */
272 info = type <= T_MAX ? &cdptlvs[type] : NULL;
273 name = (info && info->name) ? info->name : "unknown field type";
274 if (len < CDP_TLV_HEADER_LEN) {
275 if (ndo->ndo_vflag)
276 ND_PRINT("\n\t%s (0x%02x), TLV length: %u byte%s (too short)",
277 name, type, len, PLURAL_SUFFIX(len));
278 else
279 ND_PRINT(", %s TLV length %u too short",
280 name, len);
281 goto invalid;
282 }
283 if (len > length) {
284 ND_PRINT(" (TLV length %u > %u)", len, length);
285 goto invalid;
286 }
287 tptr += CDP_TLV_HEADER_LEN;
288 length -= CDP_TLV_HEADER_LEN;
289 len -= CDP_TLV_HEADER_LEN;
290
291 /* In non-verbose mode just print Device-ID. */
292 if (!ndo->ndo_vflag && type == T_DEV_ID)
293 ND_PRINT(", Device-ID ");
294 else if (ndo->ndo_vflag)
295 ND_PRINT("\n\t%s (0x%02x), value length: %u byte%s: ",
296 name, type, len, PLURAL_SUFFIX(len));
297
298 if (info) {
299 if ((info->min_len > 0 && len < (unsigned)info->min_len) ||
300 (info->max_len > 0 && len > (unsigned)info->max_len))
301 ND_PRINT(" (malformed TLV)");
302 else if (ndo->ndo_vflag || type == T_DEV_ID) {
303 if (info->printer)
304 info->printer(ndo, tptr, len);
305 else
306 ND_TCHECK_LEN(tptr, len);
307 /*
308 * When the type is defined without a printer,
309 * do not print the hex dump.
310 */
311 covered = 1;
312 }
313 }
314
315 if (ndo->ndo_vflag && !covered) {
316 ND_TCHECK_LEN(tptr, len);
317 print_unknown_data(ndo, tptr, "\n\t ", len);
318 }
319 tptr += len;
320 length -= len;
321 }
322 if (ndo->ndo_vflag < 1)
323 ND_PRINT(", length %u", orig_length);
324
325 return;
326 invalid:
327 nd_print_invalid(ndo);
328 ND_TCHECK_LEN(tptr, length);
329 }
330
331 /*
332 * Protocol type values.
333 *
334 * PT_NLPID means that the protocol type field contains an OSI NLPID.
335 *
336 * PT_IEEE_802_2 means that the protocol type field contains an IEEE 802.2
337 * LLC header that specifies that the payload is for that protocol.
338 */
339 #define PT_NLPID 1 /* OSI NLPID */
340 #define PT_IEEE_802_2 2 /* IEEE 802.2 LLC header */
341
342 static void
cdp_print_addr(netdissect_options * ndo,const u_char * p,u_int l)343 cdp_print_addr(netdissect_options *ndo,
344 const u_char * p, u_int l)
345 {
346 u_int num;
347 static const u_char prot_ipv6[] = {
348 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00, 0x86, 0xdd
349 };
350
351 if (l < 4) {
352 ND_PRINT(" (not enough space for num)");
353 goto invalid;
354 }
355 num = GET_BE_U_4(p);
356 p += 4;
357 l -= 4;
358
359 while (num) {
360 u_int pt, pl, al;
361
362 if (l < 2) {
363 ND_PRINT(" (not enough space for PT+PL)");
364 goto invalid;
365 }
366 pt = GET_U_1(p); /* type of "protocol" field */
367 pl = GET_U_1(p + 1); /* length of "protocol" field */
368 p += 2;
369 l -= 2;
370
371 if (l < pl + 2) {
372 ND_PRINT(" (not enough space for P+AL)");
373 goto invalid;
374 }
375 /* Skip the protocol for now. */
376 al = GET_BE_U_2(p + pl); /* address length */
377
378 if (pt == PT_NLPID && pl == 1 && GET_U_1(p) == NLPID_IP &&
379 al == 4) {
380 /*
381 * IPv4: protocol type = NLPID, protocol length = 1
382 * (1-byte NLPID), protocol = 0xcc (NLPID for IPv4),
383 * address length = 4
384 */
385 p += pl + 2;
386 l -= pl + 2;
387 /* p is just beyond al now. */
388 if (l < al) {
389 ND_PRINT(" (not enough space for A)");
390 goto invalid;
391 }
392 ND_PRINT("IPv4 (%u) %s", num, GET_IPADDR_STRING(p));
393 p += al;
394 l -= al;
395 } else if (pt == PT_IEEE_802_2 && pl == 8 &&
396 memcmp(p, prot_ipv6, 8) == 0 && al == 16) {
397 /*
398 * IPv6: protocol type = IEEE 802.2 header,
399 * protocol length = 8 (size of LLC+SNAP header),
400 * protocol = LLC+SNAP header with the IPv6
401 * Ethertype, address length = 16
402 */
403 p += pl + 2;
404 l -= pl + 2;
405 /* p is just beyond al now. */
406 if (l < al) {
407 ND_PRINT(" (not enough space for A)");
408 goto invalid;
409 }
410 ND_PRINT("IPv6 (%u) %s", num, GET_IP6ADDR_STRING(p));
411 p += al;
412 l -= al;
413 } else {
414 /*
415 * Generic case: just print raw data
416 */
417 ND_PRINT("pt=0x%02x, pl=%u, pb=", pt, pl);
418 while (pl != 0) {
419 ND_PRINT(" %02x", GET_U_1(p));
420 p++;
421 l--;
422 pl--;
423 }
424 ND_PRINT(", al=%u, a=", al);
425 p += 2;
426 l -= 2;
427 /* p is just beyond al now. */
428 if (l < al) {
429 ND_PRINT(" (not enough space for A)");
430 goto invalid;
431 }
432 while (al != 0) {
433 ND_PRINT(" %02x", GET_U_1(p));
434 p++;
435 l--;
436 al--;
437 }
438 }
439 num--;
440 if (num)
441 ND_PRINT(" ");
442 }
443 if (l)
444 ND_PRINT(" (%u bytes of stray data)", l);
445 return;
446
447 invalid:
448 ND_TCHECK_LEN(p, l);
449 }
450
451 static void
cdp_print_prefixes(netdissect_options * ndo,const u_char * p,u_int l)452 cdp_print_prefixes(netdissect_options *ndo,
453 const u_char * p, u_int l)
454 {
455 if (l % 5) {
456 ND_PRINT(" [length %u is not a multiple of 5]", l);
457 goto invalid;
458 }
459
460 ND_PRINT(" IPv4 Prefixes (%u):", l / 5);
461
462 while (l > 0) {
463 ND_PRINT(" %u.%u.%u.%u/%u",
464 GET_U_1(p), GET_U_1(p + 1), GET_U_1(p + 2),
465 GET_U_1(p + 3), GET_U_1(p + 4));
466 l -= 5;
467 p += 5;
468 }
469 return;
470
471 invalid:
472 ND_TCHECK_LEN(p, l);
473 }
474