mirrors/tcpdump
0
0
Fork 0
mirror of https://github.com/the-tcpdump-group/tcpdump.git synced 2024-11-24 02:23:27 +08:00
Code Issues Packages Projects Releases Wiki Activity
e91ca695c3
tcpdump/print-loopback.c

136 lines
3.5 KiB
C
Raw Normal View History

add a decoder for Loopback/CTP tcpdump used to print an empty line for a Loopback (CTP) packet, which many Cisco switches send by default every 10 seconds. This commit adds a decoder for the protocol and a test case, which uses the sample capture from Wireshark wiki (configuration_test_protocol_aka_loop.pcap).
2014-01-09 20:54:47 +08:00
/*
* Copyright (c) 2014 The TCPDUMP project
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
* FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
* COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
* BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
* CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
* ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*/
Add a summary comment in all other printers Moreover: Remove some redundant comments Update some summary comments Update the specification URL for ATA over Ethernet (AoE) protocol
2016-08-15 21:27:28 +08:00
/* \summary: Loopback Protocol printer */
/*
* originally defined as the Ethernet Configuration Testing Protocol.
Use more HTTPS in URLs [skip ci]
2019-08-05 21:11:50 +08:00
* specification: https://www.mit.edu/people/jhawk/ctp.pdf
Add a summary comment in all other printers Moreover: Remove some redundant comments Update some summary comments Update the specification URL for ATA over Ethernet (AoE) protocol
2016-08-15 21:27:28 +08:00
*/
add a decoder for Loopback/CTP tcpdump used to print an empty line for a Loopback (CTP) packet, which many Cisco switches send by default every 10 seconds. This commit adds a decoder for the protocol and a test case, which uses the sample capture from Wireshark wiki (configuration_test_protocol_aka_loop.pcap).
2014-01-09 20:54:47 +08:00
#ifdef HAVE_CONFIG_H
Always include <config.h> rather than "config.h". This can prevent bizarre failures if, for example, you've done a configuration in the top-level source directory, leaving behind one config.h file, and then do an out-of-tree build in another directory, with different configuration options. This way, we always pick up the same config.h, in the build directory.
2018-01-22 04:27:08 +08:00
#include <config.h>
add a decoder for Loopback/CTP tcpdump used to print an empty line for a Loopback (CTP) packet, which many Cisco switches send by default every 10 seconds. This commit adds a decoder for the protocol and a test case, which uses the sample capture from Wireshark wiki (configuration_test_protocol_aka_loop.pcap).
2014-01-09 20:54:47 +08:00
#endif
Use quoted include netdissect-stdinc.h instead of angle-bracketed one
2018-01-20 22:59:49 +08:00
#include "netdissect-stdinc.h"
add a decoder for Loopback/CTP tcpdump used to print an empty line for a Loopback (CTP) packet, which many Cisco switches send by default every 10 seconds. This commit adds a decoder for the protocol and a test case, which uses the sample capture from Wireshark wiki (configuration_test_protocol_aka_loop.pcap).
2014-01-09 20:54:47 +08:00
Introduce and use ND_LONGJMP_FROM_TCHECK. Apply this to the 4 the recently converted protocols. HOW TO USE: Define this in a print-*.c file before including netdissect.h to make all its ND_TCHECK*() instances longjmp(). Only do this after verifying that every ND_TCHECK*() in the file is correct and that in every possible case it is safe to call longjmp() without incurring resource leaks or any other problems. If it is not safe or feasible to convert whole file, consider converting one function at a time.
2020-09-28 04:43:16 +08:00
#define ND_LONGJMP_FROM_TCHECK
Printers must include 'netdissect.h', not 'interface.h'
2015-09-06 05:35:58 +08:00
#include "netdissect.h"
add a decoder for Loopback/CTP tcpdump used to print an empty line for a Loopback (CTP) packet, which many Cisco switches send by default every 10 seconds. This commit adds a decoder for the protocol and a test case, which uses the sample capture from Wireshark wiki (configuration_test_protocol_aka_loop.pcap).
2014-01-09 20:54:47 +08:00
#include "extract.h"
#include "addrtoname.h"
#define LOOPBACK_REPLY 1
#define LOOPBACK_FWDDATA 2
static const struct tok fcode_str[] = {
{ LOOPBACK_REPLY, "Reply" },
{ LOOPBACK_FWDDATA, "Forward Data" },
{ 0, NULL }
};
static void
Loopback/CTP: Modernize packet parsing style. The change made in commit bdd97f54 was safe, but was slightly incorrect. Before the change the decoder used the _declared_ end of packet (the initial "cp" + the initial "len") as the target of how much data to try to decode, and whilst trying to do that it could cross the _captured_ end of packet (ndo_snapend) and give up complaining, so the output would correctly indicate there was supposed to be more data beyond the unexpected snapshot end. After the change the decoder started to use the captured end of packet to tell where the packet ends, so it would never cross ndo_snapend, but it would interpret the packet data as if the missing part was never supposed to be there and would thus decode truncated packets incorrectly. In order to eliminate this space for misinterpretation, remove the "ep" pointer and change the code both to advance "cp" and to decrease "len" as it is going through the protocol structures, so the part of the packet that is supposed to be present but has not been decoded yet can be addressed by just "cp" and "len" (like it is done in many functions elsewhere). Let the GET_ macros guard the snapshot end and use nd_trunc() to handle the remaining ND_TCHECK_LEN() instances. Articulate the part of the message sized by skipCount.
2020-09-18 09:27:43 +08:00
loopback_message_print(netdissect_options *ndo,
const u_char *cp, u_int len)
add a decoder for Loopback/CTP tcpdump used to print an empty line for a Loopback (CTP) packet, which many Cisco switches send by default every 10 seconds. This commit adds a decoder for the protocol and a test case, which uses the sample capture from Wireshark wiki (configuration_test_protocol_aka_loop.pcap).
2014-01-09 20:54:47 +08:00
{
uint16_t function;
if (len < 2)
Use the word 'invalid' for 'malformed' or 'corrupted' packets An invalid packet could be: 1) built malformed originally by the sender or a fuzz tester, 2) became corrupted in transit.
2015-09-06 19:34:05 +08:00
goto invalid;
add a decoder for Loopback/CTP tcpdump used to print an empty line for a Loopback (CTP) packet, which many Cisco switches send by default every 10 seconds. This commit adds a decoder for the protocol and a test case, which uses the sample capture from Wireshark wiki (configuration_test_protocol_aka_loop.pcap).
2014-01-09 20:54:47 +08:00
/* function */
Use the new GET_ macros instead of the EXTRACT_ ones The exceptions are currently: Some EXTRACT_ in print-juniper.c, not used on packet buffer pointer. An EXTRACT_BE_U_3 in addrtoname.c, not always used on packet buffer pointer.
2018-06-16 23:23:21 +08:00
function = GET_LE_U_2(cp);
add a decoder for Loopback/CTP tcpdump used to print an empty line for a Loopback (CTP) packet, which many Cisco switches send by default every 10 seconds. This commit adds a decoder for the protocol and a test case, which uses the sample capture from Wireshark wiki (configuration_test_protocol_aka_loop.pcap).
2014-01-09 20:54:47 +08:00
cp += 2;
Loopback/CTP: Modernize packet parsing style. The change made in commit bdd97f54 was safe, but was slightly incorrect. Before the change the decoder used the _declared_ end of packet (the initial "cp" + the initial "len") as the target of how much data to try to decode, and whilst trying to do that it could cross the _captured_ end of packet (ndo_snapend) and give up complaining, so the output would correctly indicate there was supposed to be more data beyond the unexpected snapshot end. After the change the decoder started to use the captured end of packet to tell where the packet ends, so it would never cross ndo_snapend, but it would interpret the packet data as if the missing part was never supposed to be there and would thus decode truncated packets incorrectly. In order to eliminate this space for misinterpretation, remove the "ep" pointer and change the code both to advance "cp" and to decrease "len" as it is going through the protocol structures, so the part of the packet that is supposed to be present but has not been decoded yet can be addressed by just "cp" and "len" (like it is done in many functions elsewhere). Let the GET_ macros guard the snapshot end and use nd_trunc() to handle the remaining ND_TCHECK_LEN() instances. Articulate the part of the message sized by skipCount.
2020-09-18 09:27:43 +08:00
len -= 2;
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ND_PRINT(", %s", tok2str(fcode_str, " invalid (%u)", function));
add a decoder for Loopback/CTP tcpdump used to print an empty line for a Loopback (CTP) packet, which many Cisco switches send by default every 10 seconds. This commit adds a decoder for the protocol and a test case, which uses the sample capture from Wireshark wiki (configuration_test_protocol_aka_loop.pcap).
2014-01-09 20:54:47 +08:00
switch (function) {
case LOOPBACK_REPLY:
Loopback/CTP: Modernize packet parsing style. The change made in commit bdd97f54 was safe, but was slightly incorrect. Before the change the decoder used the _declared_ end of packet (the initial "cp" + the initial "len") as the target of how much data to try to decode, and whilst trying to do that it could cross the _captured_ end of packet (ndo_snapend) and give up complaining, so the output would correctly indicate there was supposed to be more data beyond the unexpected snapshot end. After the change the decoder started to use the captured end of packet to tell where the packet ends, so it would never cross ndo_snapend, but it would interpret the packet data as if the missing part was never supposed to be there and would thus decode truncated packets incorrectly. In order to eliminate this space for misinterpretation, remove the "ep" pointer and change the code both to advance "cp" and to decrease "len" as it is going through the protocol structures, so the part of the packet that is supposed to be present but has not been decoded yet can be addressed by just "cp" and "len" (like it is done in many functions elsewhere). Let the GET_ macros guard the snapshot end and use nd_trunc() to handle the remaining ND_TCHECK_LEN() instances. Articulate the part of the message sized by skipCount.
2020-09-18 09:27:43 +08:00
if (len < 2)
Use the word 'invalid' for 'malformed' or 'corrupted' packets An invalid packet could be: 1) built malformed originally by the sender or a fuzz tester, 2) became corrupted in transit.
2015-09-06 19:34:05 +08:00
goto invalid;
add a decoder for Loopback/CTP tcpdump used to print an empty line for a Loopback (CTP) packet, which many Cisco switches send by default every 10 seconds. This commit adds a decoder for the protocol and a test case, which uses the sample capture from Wireshark wiki (configuration_test_protocol_aka_loop.pcap).
2014-01-09 20:54:47 +08:00
/* receipt number */
Use the new GET_ macros instead of the EXTRACT_ ones The exceptions are currently: Some EXTRACT_ in print-juniper.c, not used on packet buffer pointer. An EXTRACT_BE_U_3 in addrtoname.c, not always used on packet buffer pointer.
2018-06-16 23:23:21 +08:00
ND_PRINT(", receipt number %u", GET_LE_U_2(cp));
add a decoder for Loopback/CTP tcpdump used to print an empty line for a Loopback (CTP) packet, which many Cisco switches send by default every 10 seconds. This commit adds a decoder for the protocol and a test case, which uses the sample capture from Wireshark wiki (configuration_test_protocol_aka_loop.pcap).
2014-01-09 20:54:47 +08:00
cp += 2;
Loopback/CTP: Modernize packet parsing style. The change made in commit bdd97f54 was safe, but was slightly incorrect. Before the change the decoder used the _declared_ end of packet (the initial "cp" + the initial "len") as the target of how much data to try to decode, and whilst trying to do that it could cross the _captured_ end of packet (ndo_snapend) and give up complaining, so the output would correctly indicate there was supposed to be more data beyond the unexpected snapshot end. After the change the decoder started to use the captured end of packet to tell where the packet ends, so it would never cross ndo_snapend, but it would interpret the packet data as if the missing part was never supposed to be there and would thus decode truncated packets incorrectly. In order to eliminate this space for misinterpretation, remove the "ep" pointer and change the code both to advance "cp" and to decrease "len" as it is going through the protocol structures, so the part of the packet that is supposed to be present but has not been decoded yet can be addressed by just "cp" and "len" (like it is done in many functions elsewhere). Let the GET_ macros guard the snapshot end and use nd_trunc() to handle the remaining ND_TCHECK_LEN() instances. Articulate the part of the message sized by skipCount.
2020-09-18 09:27:43 +08:00
len -= 2;
add a decoder for Loopback/CTP tcpdump used to print an empty line for a Loopback (CTP) packet, which many Cisco switches send by default every 10 seconds. This commit adds a decoder for the protocol and a test case, which uses the sample capture from Wireshark wiki (configuration_test_protocol_aka_loop.pcap).
2014-01-09 20:54:47 +08:00
/* data */
Loopback/CTP: Modernize packet parsing style. The change made in commit bdd97f54 was safe, but was slightly incorrect. Before the change the decoder used the _declared_ end of packet (the initial "cp" + the initial "len") as the target of how much data to try to decode, and whilst trying to do that it could cross the _captured_ end of packet (ndo_snapend) and give up complaining, so the output would correctly indicate there was supposed to be more data beyond the unexpected snapshot end. After the change the decoder started to use the captured end of packet to tell where the packet ends, so it would never cross ndo_snapend, but it would interpret the packet data as if the missing part was never supposed to be there and would thus decode truncated packets incorrectly. In order to eliminate this space for misinterpretation, remove the "ep" pointer and change the code both to advance "cp" and to decrease "len" as it is going through the protocol structures, so the part of the packet that is supposed to be present but has not been decoded yet can be addressed by just "cp" and "len" (like it is done in many functions elsewhere). Let the GET_ macros guard the snapshot end and use nd_trunc() to handle the remaining ND_TCHECK_LEN() instances. Articulate the part of the message sized by skipCount.
2020-09-18 09:27:43 +08:00
ND_PRINT(", data (%u octets)", len);
ND_TCHECK_LEN(cp, len);
add a decoder for Loopback/CTP tcpdump used to print an empty line for a Loopback (CTP) packet, which many Cisco switches send by default every 10 seconds. This commit adds a decoder for the protocol and a test case, which uses the sample capture from Wireshark wiki (configuration_test_protocol_aka_loop.pcap).
2014-01-09 20:54:47 +08:00
break;
case LOOPBACK_FWDDATA:
Loopback/CTP: Modernize packet parsing style. The change made in commit bdd97f54 was safe, but was slightly incorrect. Before the change the decoder used the _declared_ end of packet (the initial "cp" + the initial "len") as the target of how much data to try to decode, and whilst trying to do that it could cross the _captured_ end of packet (ndo_snapend) and give up complaining, so the output would correctly indicate there was supposed to be more data beyond the unexpected snapshot end. After the change the decoder started to use the captured end of packet to tell where the packet ends, so it would never cross ndo_snapend, but it would interpret the packet data as if the missing part was never supposed to be there and would thus decode truncated packets incorrectly. In order to eliminate this space for misinterpretation, remove the "ep" pointer and change the code both to advance "cp" and to decrease "len" as it is going through the protocol structures, so the part of the packet that is supposed to be present but has not been decoded yet can be addressed by just "cp" and "len" (like it is done in many functions elsewhere). Let the GET_ macros guard the snapshot end and use nd_trunc() to handle the remaining ND_TCHECK_LEN() instances. Articulate the part of the message sized by skipCount.
2020-09-18 09:27:43 +08:00
if (len < MAC_ADDR_LEN)
Use the word 'invalid' for 'malformed' or 'corrupted' packets An invalid packet could be: 1) built malformed originally by the sender or a fuzz tester, 2) became corrupted in transit.
2015-09-06 19:34:05 +08:00
goto invalid;
add a decoder for Loopback/CTP tcpdump used to print an empty line for a Loopback (CTP) packet, which many Cisco switches send by default every 10 seconds. This commit adds a decoder for the protocol and a test case, which uses the sample capture from Wireshark wiki (configuration_test_protocol_aka_loop.pcap).
2014-01-09 20:54:47 +08:00
/* forwarding address */
More bounds checking when fetching addresses and converting to strings. Replace more calls to ipaddr_string()/ip6addr_string() with calls to GET_IPADDR_STRING()/GET_IP6ADDR_STRING() macros performing bounds checking. Add similar bounds-checking inline functions and macros to wrap linkaddr_string(), etheraddr_string(), and isonsap_string() and convert calls to them to use the macros as well. Shuffle the inline functions in addrtoname.h around a bit, so that the inline functions, external declarations, and macros are all in the same order.
2020-01-20 11:55:38 +08:00
ND_PRINT(", forwarding address %s", GET_ETHERADDR_STRING(cp));
Use nd_ types in 802.x and FDDI headers. Use EXTRACT_U_1() as required by those changes. Remove no-longer-necessary & operators from other EXTRACT_ calls. While we're at it, add MAC_ADDR_LEN to netdissect.h, and use it instead of ETHER_ADDR_LEN; eliminate ETHER_ADDR_LEN. Move the maximum Ethernet length field value to ethertype.h, under the name MAX_ETHERNET_LENGTH_VAL. Move the Ethernet header structure, and the #define for the Ethernet header length, to print-ether.c; in non-Ethernet dissectors that were using the Ethernet header structure, just declare two nd_mac_addr variables for the source and destination MAC addresses and use them instead of the Ethernet header (we don't need the type field there). These changes leave nothing in ether.h, so eliminate it.
2017-12-13 02:36:21 +08:00
cp += MAC_ADDR_LEN;
Loopback/CTP: Modernize packet parsing style. The change made in commit bdd97f54 was safe, but was slightly incorrect. Before the change the decoder used the _declared_ end of packet (the initial "cp" + the initial "len") as the target of how much data to try to decode, and whilst trying to do that it could cross the _captured_ end of packet (ndo_snapend) and give up complaining, so the output would correctly indicate there was supposed to be more data beyond the unexpected snapshot end. After the change the decoder started to use the captured end of packet to tell where the packet ends, so it would never cross ndo_snapend, but it would interpret the packet data as if the missing part was never supposed to be there and would thus decode truncated packets incorrectly. In order to eliminate this space for misinterpretation, remove the "ep" pointer and change the code both to advance "cp" and to decrease "len" as it is going through the protocol structures, so the part of the packet that is supposed to be present but has not been decoded yet can be addressed by just "cp" and "len" (like it is done in many functions elsewhere). Let the GET_ macros guard the snapshot end and use nd_trunc() to handle the remaining ND_TCHECK_LEN() instances. Articulate the part of the message sized by skipCount.
2020-09-18 09:27:43 +08:00
len -= MAC_ADDR_LEN;
add a decoder for Loopback/CTP tcpdump used to print an empty line for a Loopback (CTP) packet, which many Cisco switches send by default every 10 seconds. This commit adds a decoder for the protocol and a test case, which uses the sample capture from Wireshark wiki (configuration_test_protocol_aka_loop.pcap).
2014-01-09 20:54:47 +08:00
/* data */
Loopback/CTP: Modernize packet parsing style. The change made in commit bdd97f54 was safe, but was slightly incorrect. Before the change the decoder used the _declared_ end of packet (the initial "cp" + the initial "len") as the target of how much data to try to decode, and whilst trying to do that it could cross the _captured_ end of packet (ndo_snapend) and give up complaining, so the output would correctly indicate there was supposed to be more data beyond the unexpected snapshot end. After the change the decoder started to use the captured end of packet to tell where the packet ends, so it would never cross ndo_snapend, but it would interpret the packet data as if the missing part was never supposed to be there and would thus decode truncated packets incorrectly. In order to eliminate this space for misinterpretation, remove the "ep" pointer and change the code both to advance "cp" and to decrease "len" as it is going through the protocol structures, so the part of the packet that is supposed to be present but has not been decoded yet can be addressed by just "cp" and "len" (like it is done in many functions elsewhere). Let the GET_ macros guard the snapshot end and use nd_trunc() to handle the remaining ND_TCHECK_LEN() instances. Articulate the part of the message sized by skipCount.
2020-09-18 09:27:43 +08:00
ND_PRINT(", data (%u octets)", len);
ND_TCHECK_LEN(cp, len);
add a decoder for Loopback/CTP tcpdump used to print an empty line for a Loopback (CTP) packet, which many Cisco switches send by default every 10 seconds. This commit adds a decoder for the protocol and a test case, which uses the sample capture from Wireshark wiki (configuration_test_protocol_aka_loop.pcap).
2014-01-09 20:54:47 +08:00
break;
default:
Loopback/CTP: Modernize packet parsing style. The change made in commit bdd97f54 was safe, but was slightly incorrect. Before the change the decoder used the _declared_ end of packet (the initial "cp" + the initial "len") as the target of how much data to try to decode, and whilst trying to do that it could cross the _captured_ end of packet (ndo_snapend) and give up complaining, so the output would correctly indicate there was supposed to be more data beyond the unexpected snapshot end. After the change the decoder started to use the captured end of packet to tell where the packet ends, so it would never cross ndo_snapend, but it would interpret the packet data as if the missing part was never supposed to be there and would thus decode truncated packets incorrectly. In order to eliminate this space for misinterpretation, remove the "ep" pointer and change the code both to advance "cp" and to decrease "len" as it is going through the protocol structures, so the part of the packet that is supposed to be present but has not been decoded yet can be addressed by just "cp" and "len" (like it is done in many functions elsewhere). Let the GET_ macros guard the snapshot end and use nd_trunc() to handle the remaining ND_TCHECK_LEN() instances. Articulate the part of the message sized by skipCount.
2020-09-18 09:27:43 +08:00
ND_TCHECK_LEN(cp, len);
add a decoder for Loopback/CTP tcpdump used to print an empty line for a Loopback (CTP) packet, which many Cisco switches send by default every 10 seconds. This commit adds a decoder for the protocol and a test case, which uses the sample capture from Wireshark wiki (configuration_test_protocol_aka_loop.pcap).
2014-01-09 20:54:47 +08:00
break;
}
return;
Use the word 'invalid' for 'malformed' or 'corrupted' packets An invalid packet could be: 1) built malformed originally by the sender or a fuzz tester, 2) became corrupted in transit.
2015-09-06 19:34:05 +08:00
invalid:
Add the nd_print_invalid() function It prints " (invalid)", used for malformed or corrupted packets. Moreover: Update CONTRIBUTING.
2018-09-11 18:27:55 +08:00
nd_print_invalid(ndo);
Loopback/CTP: Modernize packet parsing style. The change made in commit bdd97f54 was safe, but was slightly incorrect. Before the change the decoder used the _declared_ end of packet (the initial "cp" + the initial "len") as the target of how much data to try to decode, and whilst trying to do that it could cross the _captured_ end of packet (ndo_snapend) and give up complaining, so the output would correctly indicate there was supposed to be more data beyond the unexpected snapshot end. After the change the decoder started to use the captured end of packet to tell where the packet ends, so it would never cross ndo_snapend, but it would interpret the packet data as if the missing part was never supposed to be there and would thus decode truncated packets incorrectly. In order to eliminate this space for misinterpretation, remove the "ep" pointer and change the code both to advance "cp" and to decrease "len" as it is going through the protocol structures, so the part of the packet that is supposed to be present but has not been decoded yet can be addressed by just "cp" and "len" (like it is done in many functions elsewhere). Let the GET_ macros guard the snapshot end and use nd_trunc() to handle the remaining ND_TCHECK_LEN() instances. Articulate the part of the message sized by skipCount.
2020-09-18 09:27:43 +08:00
ND_TCHECK_LEN(cp, len);
add a decoder for Loopback/CTP tcpdump used to print an empty line for a Loopback (CTP) packet, which many Cisco switches send by default every 10 seconds. This commit adds a decoder for the protocol and a test case, which uses the sample capture from Wireshark wiki (configuration_test_protocol_aka_loop.pcap).
2014-01-09 20:54:47 +08:00
}
void
Loopback/CTP: Modernize packet parsing style. The change made in commit bdd97f54 was safe, but was slightly incorrect. Before the change the decoder used the _declared_ end of packet (the initial "cp" + the initial "len") as the target of how much data to try to decode, and whilst trying to do that it could cross the _captured_ end of packet (ndo_snapend) and give up complaining, so the output would correctly indicate there was supposed to be more data beyond the unexpected snapshot end. After the change the decoder started to use the captured end of packet to tell where the packet ends, so it would never cross ndo_snapend, but it would interpret the packet data as if the missing part was never supposed to be there and would thus decode truncated packets incorrectly. In order to eliminate this space for misinterpretation, remove the "ep" pointer and change the code both to advance "cp" and to decrease "len" as it is going through the protocol structures, so the part of the packet that is supposed to be present but has not been decoded yet can be addressed by just "cp" and "len" (like it is done in many functions elsewhere). Let the GET_ macros guard the snapshot end and use nd_trunc() to handle the remaining ND_TCHECK_LEN() instances. Articulate the part of the message sized by skipCount.
2020-09-18 09:27:43 +08:00
loopback_print(netdissect_options *ndo,
const u_char *cp, u_int len)
add a decoder for Loopback/CTP tcpdump used to print an empty line for a Loopback (CTP) packet, which many Cisco switches send by default every 10 seconds. This commit adds a decoder for the protocol and a test case, which uses the sample capture from Wireshark wiki (configuration_test_protocol_aka_loop.pcap).
2014-01-09 20:54:47 +08:00
{
uint16_t skipCount;
Add the ndo_protocol field in the netdissect_options structure Update this field in printer entry functions. It will be used for some printings.
2018-03-14 23:54:17 +08:00
ndo->ndo_protocol = "loopback";
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ND_PRINT("Loopback");
add a decoder for Loopback/CTP tcpdump used to print an empty line for a Loopback (CTP) packet, which many Cisco switches send by default every 10 seconds. This commit adds a decoder for the protocol and a test case, which uses the sample capture from Wireshark wiki (configuration_test_protocol_aka_loop.pcap).
2014-01-09 20:54:47 +08:00
if (len < 2)
Use the word 'invalid' for 'malformed' or 'corrupted' packets An invalid packet could be: 1) built malformed originally by the sender or a fuzz tester, 2) became corrupted in transit.
2015-09-06 19:34:05 +08:00
goto invalid;
add a decoder for Loopback/CTP tcpdump used to print an empty line for a Loopback (CTP) packet, which many Cisco switches send by default every 10 seconds. This commit adds a decoder for the protocol and a test case, which uses the sample capture from Wireshark wiki (configuration_test_protocol_aka_loop.pcap).
2014-01-09 20:54:47 +08:00
/* skipCount */
Use the new GET_ macros instead of the EXTRACT_ ones The exceptions are currently: Some EXTRACT_ in print-juniper.c, not used on packet buffer pointer. An EXTRACT_BE_U_3 in addrtoname.c, not always used on packet buffer pointer.
2018-06-16 23:23:21 +08:00
skipCount = GET_LE_U_2(cp);
add a decoder for Loopback/CTP tcpdump used to print an empty line for a Loopback (CTP) packet, which many Cisco switches send by default every 10 seconds. This commit adds a decoder for the protocol and a test case, which uses the sample capture from Wireshark wiki (configuration_test_protocol_aka_loop.pcap).
2014-01-09 20:54:47 +08:00
cp += 2;
Loopback/CTP: Modernize packet parsing style. The change made in commit bdd97f54 was safe, but was slightly incorrect. Before the change the decoder used the _declared_ end of packet (the initial "cp" + the initial "len") as the target of how much data to try to decode, and whilst trying to do that it could cross the _captured_ end of packet (ndo_snapend) and give up complaining, so the output would correctly indicate there was supposed to be more data beyond the unexpected snapshot end. After the change the decoder started to use the captured end of packet to tell where the packet ends, so it would never cross ndo_snapend, but it would interpret the packet data as if the missing part was never supposed to be there and would thus decode truncated packets incorrectly. In order to eliminate this space for misinterpretation, remove the "ep" pointer and change the code both to advance "cp" and to decrease "len" as it is going through the protocol structures, so the part of the packet that is supposed to be present but has not been decoded yet can be addressed by just "cp" and "len" (like it is done in many functions elsewhere). Let the GET_ macros guard the snapshot end and use nd_trunc() to handle the remaining ND_TCHECK_LEN() instances. Articulate the part of the message sized by skipCount.
2020-09-18 09:27:43 +08:00
len -= 2;
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ND_PRINT(", skipCount %u", skipCount);
add a decoder for Loopback/CTP tcpdump used to print an empty line for a Loopback (CTP) packet, which many Cisco switches send by default every 10 seconds. This commit adds a decoder for the protocol and a test case, which uses the sample capture from Wireshark wiki (configuration_test_protocol_aka_loop.pcap).
2014-01-09 20:54:47 +08:00
if (skipCount % 8)
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ND_PRINT(" (bogus)");
Loopback/CTP: Modernize packet parsing style. The change made in commit bdd97f54 was safe, but was slightly incorrect. Before the change the decoder used the _declared_ end of packet (the initial "cp" + the initial "len") as the target of how much data to try to decode, and whilst trying to do that it could cross the _captured_ end of packet (ndo_snapend) and give up complaining, so the output would correctly indicate there was supposed to be more data beyond the unexpected snapshot end. After the change the decoder started to use the captured end of packet to tell where the packet ends, so it would never cross ndo_snapend, but it would interpret the packet data as if the missing part was never supposed to be there and would thus decode truncated packets incorrectly. In order to eliminate this space for misinterpretation, remove the "ep" pointer and change the code both to advance "cp" and to decrease "len" as it is going through the protocol structures, so the part of the packet that is supposed to be present but has not been decoded yet can be addressed by just "cp" and "len" (like it is done in many functions elsewhere). Let the GET_ macros guard the snapshot end and use nd_trunc() to handle the remaining ND_TCHECK_LEN() instances. Articulate the part of the message sized by skipCount.
2020-09-18 09:27:43 +08:00
if (skipCount > len)
Use the word 'invalid' for 'malformed' or 'corrupted' packets An invalid packet could be: 1) built malformed originally by the sender or a fuzz tester, 2) became corrupted in transit.
2015-09-06 19:34:05 +08:00
goto invalid;
Loopback/CTP: Modernize packet parsing style. The change made in commit bdd97f54 was safe, but was slightly incorrect. Before the change the decoder used the _declared_ end of packet (the initial "cp" + the initial "len") as the target of how much data to try to decode, and whilst trying to do that it could cross the _captured_ end of packet (ndo_snapend) and give up complaining, so the output would correctly indicate there was supposed to be more data beyond the unexpected snapshot end. After the change the decoder started to use the captured end of packet to tell where the packet ends, so it would never cross ndo_snapend, but it would interpret the packet data as if the missing part was never supposed to be there and would thus decode truncated packets incorrectly. In order to eliminate this space for misinterpretation, remove the "ep" pointer and change the code both to advance "cp" and to decrease "len" as it is going through the protocol structures, so the part of the packet that is supposed to be present but has not been decoded yet can be addressed by just "cp" and "len" (like it is done in many functions elsewhere). Let the GET_ macros guard the snapshot end and use nd_trunc() to handle the remaining ND_TCHECK_LEN() instances. Articulate the part of the message sized by skipCount.
2020-09-18 09:27:43 +08:00
/* the octets to skip */
ND_TCHECK_LEN(cp, skipCount);
cp += skipCount;
len -= skipCount;
/* the first message to decode */
loopback_message_print(ndo, cp, len);
add a decoder for Loopback/CTP tcpdump used to print an empty line for a Loopback (CTP) packet, which many Cisco switches send by default every 10 seconds. This commit adds a decoder for the protocol and a test case, which uses the sample capture from Wireshark wiki (configuration_test_protocol_aka_loop.pcap).
2014-01-09 20:54:47 +08:00
return;
Use the word 'invalid' for 'malformed' or 'corrupted' packets An invalid packet could be: 1) built malformed originally by the sender or a fuzz tester, 2) became corrupted in transit.
2015-09-06 19:34:05 +08:00
invalid:
Add the nd_print_invalid() function It prints " (invalid)", used for malformed or corrupted packets. Moreover: Update CONTRIBUTING.
2018-09-11 18:27:55 +08:00
nd_print_invalid(ndo);
Loopback/CTP: Modernize packet parsing style. The change made in commit bdd97f54 was safe, but was slightly incorrect. Before the change the decoder used the _declared_ end of packet (the initial "cp" + the initial "len") as the target of how much data to try to decode, and whilst trying to do that it could cross the _captured_ end of packet (ndo_snapend) and give up complaining, so the output would correctly indicate there was supposed to be more data beyond the unexpected snapshot end. After the change the decoder started to use the captured end of packet to tell where the packet ends, so it would never cross ndo_snapend, but it would interpret the packet data as if the missing part was never supposed to be there and would thus decode truncated packets incorrectly. In order to eliminate this space for misinterpretation, remove the "ep" pointer and change the code both to advance "cp" and to decrease "len" as it is going through the protocol structures, so the part of the packet that is supposed to be present but has not been decoded yet can be addressed by just "cp" and "len" (like it is done in many functions elsewhere). Let the GET_ macros guard the snapshot end and use nd_trunc() to handle the remaining ND_TCHECK_LEN() instances. Articulate the part of the message sized by skipCount.
2020-09-18 09:27:43 +08:00
ND_TCHECK_LEN(cp, len);
add a decoder for Loopback/CTP tcpdump used to print an empty line for a Loopback (CTP) packet, which many Cisco switches send by default every 10 seconds. This commit adds a decoder for the protocol and a test case, which uses the sample capture from Wireshark wiki (configuration_test_protocol_aka_loop.pcap).
2014-01-09 20:54:47 +08:00
}
Reference in New Issue Copy Permalink