1 /*
2 * Copyright (c) 1990, 1991, 1993, 1994, 1995, 1996, 1997
3 * The Regents of the University of California. All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
16 * written permission.
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
20 */
21
22 #include <sys/cdefs.h>
23 #ifndef lint
24 __RCSID("$NetBSD: print-vjc.c,v 1.8 2024/09/02 16:15:33 christos Exp $");
25 #endif
26
27 /* \summary: PPP Van Jacobson compression printer */
28
29 /* specification: RFC 1144 */
30
31 #include <config.h>
32
33 #include "netdissect-stdinc.h"
34
35 #include "netdissect.h"
36 #include "extract.h"
37 #include "slcompress.h"
38 #include "ppp.h"
39
40 /*
41 * XXX - for BSD/OS PPP, what packets get supplied with a PPP header type
42 * of PPP_VJC and what packets get supplied with a PPP header type of
43 * PPP_VJNC? PPP_VJNC is for "UNCOMPRESSED_TCP" packets, and PPP_VJC
44 * is for COMPRESSED_TCP packets (PPP_IP is used for TYPE_IP packets).
45 *
46 * RFC 1144 implies that, on the wire, the packet type is *not* needed
47 * for PPP, as different PPP protocol types can be used; it only needs
48 * to be put on the wire for SLIP.
49 *
50 * It also indicates that, for compressed SLIP:
51 *
52 * If the COMPRESSED_TCP bit is set in the first byte, it's
53 * a COMPRESSED_TCP packet; that byte is the change byte, and
54 * the COMPRESSED_TCP bit, 0x80, isn't used in the change byte.
55 *
56 * If the upper 4 bits of the first byte are 7, it's an
57 * UNCOMPRESSED_TCP packet; that byte is the first byte of
58 * the UNCOMPRESSED_TCP modified IP header, with a connection
59 * number in the protocol field, and with the version field
60 * being 7, not 4.
61 *
62 * Otherwise, the packet is an IPv4 packet (where the upper 4 bits
63 * of the packet are 4).
64 *
65 * So this routine looks as if it's sort-of intended to handle
66 * compressed SLIP, although it doesn't handle UNCOMPRESSED_TCP
67 * correctly for that (it doesn't fix the version number and doesn't
68 * do anything to the protocol field), and doesn't check for COMPRESSED_TCP
69 * packets correctly for that (you only check the first bit - see
70 * B.1 in RFC 1144).
71 *
72 * But it's called for BSD/OS PPP, not SLIP - perhaps BSD/OS does weird
73 * things with the headers?
74 *
75 * Without a BSD/OS VJC-compressed PPP trace, or knowledge of what the
76 * BSD/OS VJC code does, we can't say what's the case.
77 *
78 * We therefore leave "proto" - which is the PPP protocol type - in place,
79 * *not* marked as unused, for now, so that GCC warnings about the
80 * unused argument remind us that we should fix this some day.
81 *
82 * XXX - also, it fetches the TCP checksum field in COMPRESSED_TCP
83 * packets with GET_HE_U_2, rather than with GET_BE_U_2(); RFC 1144 says
84 * it's "the unmodified TCP checksum", which would imply that it's
85 * big-endian, but perhaps, on the platform where this was developed,
86 * the packets were munged by the networking stack before being handed
87 * to the packet capture mechanism.
88 */
89 int
vjc_print(netdissect_options * ndo,const u_char * bp,u_short proto _U_)90 vjc_print(netdissect_options *ndo, const u_char *bp, u_short proto _U_)
91 {
92 int i;
93
94 ndo->ndo_protocol = "vjc";
95 switch (GET_U_1(bp) & 0xf0) {
96 case TYPE_IP:
97 if (ndo->ndo_eflag)
98 ND_PRINT("(vjc type=IP) ");
99 return PPP_IP;
100 case TYPE_UNCOMPRESSED_TCP:
101 if (ndo->ndo_eflag)
102 ND_PRINT("(vjc type=raw TCP) ");
103 return PPP_IP;
104 case TYPE_COMPRESSED_TCP:
105 if (ndo->ndo_eflag)
106 ND_PRINT("(vjc type=compressed TCP) ");
107 for (i = 0; i < 8; i++) {
108 if (GET_U_1(bp + 1) & (0x80 >> i))
109 ND_PRINT("%c", "?CI?SAWU"[i]);
110 }
111 if (GET_U_1(bp + 1))
112 ND_PRINT(" ");
113 ND_PRINT("C=0x%02x ", GET_U_1(bp + 2));
114 ND_PRINT("sum=0x%04x ", GET_HE_U_2(bp + 3));
115 return -1;
116 case TYPE_ERROR:
117 if (ndo->ndo_eflag)
118 ND_PRINT("(vjc type=error) ");
119 return -1;
120 default:
121 if (ndo->ndo_eflag)
122 ND_PRINT("(vjc type=0x%02x) ", GET_U_1(bp) & 0xf0);
123 return -1;
124 }
125 }
126