Changeset 120540d for libpacketdump

Timestamp:

12/07/06 13:16:25 (14 years ago)

Author:

Scott Raynel <smr26@…>

Branches:

4.0.1-hotfixes, cachetimestamps, develop, dpdk-ndag, etsilive, getfragoff, help, libtrace4, master, ndag_format, pfring, rc-4.0.1, rc-4.0.2, rc-4.0.3, rc-4.0.4, ringdecrementfix, ringperformance, ringtimestampfixes

Children:

d4c8a518

Parents:

0a62bba

Message:

Fixes a very broken ARP decoder for libpacketdump. Also adds
decoding of arp reply packets.

File:

• libpacketdump/eth_2054.c (modified) (4 diffs)

libpacketdump/eth_2054.c

@@ -14 +14 @@
 #include <string.h>
 
-#define DISPLAY_EXP(x,fmt,exp) \
-        if ((unsigned int)len>=((char*)&ip->x-(char*)ip+sizeof(ip->x))) \
-                printf(fmt,exp); \
-        else \
-                return; 
-
-#define DISPLAY(x,fmt) DISPLAY_EXP(x,fmt,ip->x)
-
-#define DISPLAYS(x,fmt) DISPLAY_EXP(x,fmt,htons(ip->x))
-#define DISPLAYIP(x,fmt) DISPLAY_EXP(x,fmt,inet_ntoa(*(struct in_addr*)&ip->x))
-
-static char *format(struct arphdr *arp, char *hrd, char *pro)
-{
-        static char buffer[1024];
-        char ether_buf[18] = {0, };
+/* 
+ * Converts an ARP hardware address to a printable string.
+ * Takes an ARP header structure and a pointer to the start
+ * of the hardware address in the structure that we should
+ * attempt to decode.
+ */
+char *format_hrd(struct arphdr *arp, char *hrd) {
+        static char buffer[1024] = {0,};
+        uint8_t *addr = (uint8_t *)hrd;
         int i;
 
-        if (hrd==NULL)
-                return "Truncated (Truncated)";
-        switch(arp->ar_hrd) {
+        if (!hrd) {
+                strncpy(buffer, "(Truncated)", sizeof(buffer));
+                return buffer;
+        }
+
+        switch(ntohs(arp->ar_hrd)) {
                 case ARPHRD_ETHER:
-                        strcpy(buffer,trace_ether_ntoa((uint8_t *)&hrd, 
-                                                ether_buf));
+                        trace_ether_ntoa(hrd, buffer);
                         break;
                 default:
@@ -43 +39 @@
                                                 buffer,(unsigned char)hrd[i]);
                         }
+                        break;
         }
-        if (pro==NULL) {
-                strncat(buffer," (Truncated)",sizeof(buffer));
+        
+        return buffer;
+}
+
+/* 
+ * Converts an ARP protocol address to a printable string.
+ * Takes an ARP header structure and a pointer to the start
+ * of the protocol address in the structure that we should
+ * attempt to decode.
+ */
+char *format_pro(struct arphdr *arp, char *pro) {
+        static char buffer[1024] = {0,};
+        int i;
+        
+        if (!pro) {
+                strncpy(buffer, "(Truncated)", sizeof(buffer));
                 return buffer;
         }
-        switch(arp->ar_pro) {
+
+        switch(ntohs(arp->ar_pro)) {
                 case 0x0800:
-                        snprintf(buffer,sizeof(buffer),"%s (%s)",
-                                        buffer,inet_ntoa(*(struct in_addr*)&pro));
+                        snprintf(buffer,sizeof(buffer),"%s",
+                                        inet_ntoa(*(struct in_addr*)pro));
                         break;
                 default:
@@ -63 +75 @@
         }
         return buffer;
+        
 }
-
+        
 void decode(int link_type,char *packet,int len)
 {
@@ -72 +85 @@
         char *dest_hrd = NULL;
         char *dest_pro = NULL;
-        if (len<8)
+
+        if (len < sizeof(struct arphdr)) {
+                printf(" ARP: (Truncated)\n");
                 return;
-        if (sizeof(*arp)<=(unsigned int)len) 
-                source_hrd=packet+sizeof(arp);
-        if (source_hrd && source_hrd-packet+arp->ar_hln<=len)
-                source_pro =source_hrd+arp->ar_hln;
-        if (source_pro  && source_pro-packet+arp->ar_pln<=len)
-                dest_hrd  =source_pro +arp->ar_pln;
-        if (dest_hrd   && dest_hrd-packet+arp->ar_pln<=len)
-                dest_pro   =dest_hrd  +arp->ar_hln;
-        switch(arp->ar_op) {
+        }
+
+        if (len >= sizeof(struct arphdr) + arp->ar_hln) 
+                source_hrd = packet + sizeof(struct arphdr);
+        if (len >= sizeof(struct arphdr) + arp->ar_hln + arp->ar_pln)
+                source_pro = source_hrd + arp->ar_hln;
+        if (len >= sizeof(struct arphdr) + arp->ar_hln * 2 + arp->ar_pln)
+                dest_hrd = source_pro + arp->ar_pln;
+        if (len >= sizeof(struct arphdr) + arp->ar_hln * 2 + arp->ar_pln * 2)
+                dest_pro = dest_hrd + arp->ar_hln;
+
+        switch(ntohs(arp->ar_op)) {
                 case ARPOP_REQUEST:
-                        printf(" ARP: Who-has %s",
-                                        format(arp,source_hrd,source_pro));
-                        printf(" please tell %s",
-                                        format(arp,dest_hrd,dest_pro));
+                        printf(" ARP: who-has %s", format_pro(arp, dest_pro));
+                        printf(" tell %s (%s)\n", format_pro(arp, source_pro),
+                                        format_hrd(arp, source_hrd));
+                        break;
+                case ARPOP_REPLY:
+                        printf(" ARP: reply %s", format_pro(arp, dest_pro));
+                        printf(" is-at %s\n", format_hrd(arp, dest_hrd));
                         break;
                 default:
-                        printf(" ARP: Unknown opcode (%i) from %s",
-                                        arp->ar_op,
-                                        format(arp,source_hrd,source_pro));
-                        printf(" to %s",
-                                        format(arp,dest_hrd,dest_pro));
+                        printf(" ARP: Unknown opcode (%i) from %s to %s\n",
+                                        ntohs(arp->ar_op),
+                                        format_pro(arp, source_pro),
+                                        format_pro(arp, dest_pro));
+
                         break;
         }