]> The Tcpdump Group git mirrors - tcpdump/blob - print-ether.c
macsec: more cleanups.
[tcpdump] / print-ether.c
1 /*
2 * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 2000
3 * The Regents of the University of California. All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
16 * written permission.
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
20 */
21
22 /* \summary: Ethernet printer */
23
24 #ifdef HAVE_CONFIG_H
25 #include <config.h>
26 #endif
27
28 #include "netdissect-stdinc.h"
29
30 #include "netdissect.h"
31 #include "extract.h"
32 #include "addrtoname.h"
33 #include "ethertype.h"
34
35 /*
36 * Structure of an Ethernet header.
37 */
38 struct ether_header {
39 nd_mac_addr ether_dhost;
40 nd_mac_addr ether_shost;
41 nd_uint16_t ether_length_type;
42 };
43
44 /*
45 * Length of an Ethernet header; note that some compilers may pad
46 * "struct ether_header" to a multiple of 4 bytes, for example, so
47 * "sizeof (struct ether_header)" may not give the right answer.
48 */
49 #define ETHER_HDRLEN 14
50
51 const struct tok ethertype_values[] = {
52 { ETHERTYPE_IP, "IPv4" },
53 { ETHERTYPE_MPLS, "MPLS unicast" },
54 { ETHERTYPE_MPLS_MULTI, "MPLS multicast" },
55 { ETHERTYPE_IPV6, "IPv6" },
56 { ETHERTYPE_8021Q, "802.1Q" },
57 { ETHERTYPE_8021Q9100, "802.1Q-9100" },
58 { ETHERTYPE_8021QinQ, "802.1Q-QinQ" },
59 { ETHERTYPE_8021Q9200, "802.1Q-9200" },
60 { ETHERTYPE_MACSEC, "802.1AE MACsec" },
61 { ETHERTYPE_VMAN, "VMAN" },
62 { ETHERTYPE_PUP, "PUP" },
63 { ETHERTYPE_ARP, "ARP"},
64 { ETHERTYPE_REVARP, "Reverse ARP"},
65 { ETHERTYPE_NS, "NS" },
66 { ETHERTYPE_SPRITE, "Sprite" },
67 { ETHERTYPE_TRAIL, "Trail" },
68 { ETHERTYPE_MOPDL, "MOP DL" },
69 { ETHERTYPE_MOPRC, "MOP RC" },
70 { ETHERTYPE_DN, "DN" },
71 { ETHERTYPE_LAT, "LAT" },
72 { ETHERTYPE_SCA, "SCA" },
73 { ETHERTYPE_TEB, "TEB" },
74 { ETHERTYPE_LANBRIDGE, "Lanbridge" },
75 { ETHERTYPE_DECDNS, "DEC DNS" },
76 { ETHERTYPE_DECDTS, "DEC DTS" },
77 { ETHERTYPE_VEXP, "VEXP" },
78 { ETHERTYPE_VPROD, "VPROD" },
79 { ETHERTYPE_ATALK, "Appletalk" },
80 { ETHERTYPE_AARP, "Appletalk ARP" },
81 { ETHERTYPE_IPX, "IPX" },
82 { ETHERTYPE_PPP, "PPP" },
83 { ETHERTYPE_MPCP, "MPCP" },
84 { ETHERTYPE_SLOW, "Slow Protocols" },
85 { ETHERTYPE_PPPOED, "PPPoE D" },
86 { ETHERTYPE_PPPOES, "PPPoE S" },
87 { ETHERTYPE_EAPOL, "EAPOL" },
88 { ETHERTYPE_RRCP, "RRCP" },
89 { ETHERTYPE_MS_NLB_HB, "MS NLB heartbeat" },
90 { ETHERTYPE_JUMBO, "Jumbo" },
91 { ETHERTYPE_NSH, "NSH" },
92 { ETHERTYPE_LOOPBACK, "Loopback" },
93 { ETHERTYPE_ISO, "OSI" },
94 { ETHERTYPE_GRE_ISO, "GRE-OSI" },
95 { ETHERTYPE_CFM_OLD, "CFM (old)" },
96 { ETHERTYPE_CFM, "CFM" },
97 { ETHERTYPE_IEEE1905_1, "IEEE1905.1" },
98 { ETHERTYPE_LLDP, "LLDP" },
99 { ETHERTYPE_TIPC, "TIPC"},
100 { ETHERTYPE_GEONET_OLD, "GeoNet (old)"},
101 { ETHERTYPE_GEONET, "GeoNet"},
102 { ETHERTYPE_CALM_FAST, "CALM FAST"},
103 { ETHERTYPE_AOE, "AoE" },
104 { ETHERTYPE_PTP, "PTP" },
105 { ETHERTYPE_ARISTA, "Arista Vendor Specific Protocol" },
106 { 0, NULL}
107 };
108
109 static void
110 ether_addresses_print(netdissect_options *ndo, const u_char *src,
111 const u_char *dst)
112 {
113 ND_PRINT("%s > %s, ",
114 GET_ETHERADDR_STRING(src), GET_ETHERADDR_STRING(dst));
115 }
116
117 static void
118 ether_type_print(netdissect_options *ndo, uint16_t type)
119 {
120 if (!ndo->ndo_qflag)
121 ND_PRINT("ethertype %s (0x%04x)",
122 tok2str(ethertype_values, "Unknown", type), type);
123 else
124 ND_PRINT("%s",
125 tok2str(ethertype_values, "Unknown Ethertype (0x%04x)", type));
126 }
127
128 /*
129 * Common code for printing Ethernet frames.
130 *
131 * It can handle Ethernet headers with extra tag information inserted
132 * after the destination and source addresses, as is inserted by some
133 * switch chips, and extra encapsulation header information before
134 * printing Ethernet header information (such as a LANE ID for ATM LANE).
135 */
136 static u_int
137 ether_common_print(netdissect_options *ndo, const u_char *p, u_int length,
138 u_int caplen,
139 void (*print_switch_tag)(netdissect_options *ndo, const u_char *),
140 u_int switch_tag_len,
141 void (*print_encap_header)(netdissect_options *ndo, const u_char *),
142 const u_char *encap_header_arg)
143 {
144 const struct ether_header *ehp;
145 u_int orig_length;
146 u_int hdrlen;
147 u_short length_type;
148 int printed_length;
149 int llc_hdrlen;
150 struct lladdr_info src, dst;
151
152 if (caplen < ETHER_HDRLEN + switch_tag_len) {
153 nd_print_trunc(ndo);
154 return (caplen);
155 }
156 if (length < ETHER_HDRLEN + switch_tag_len) {
157 nd_print_trunc(ndo);
158 return (length);
159 }
160
161 if (print_encap_header != NULL)
162 (*print_encap_header)(ndo, encap_header_arg);
163
164 orig_length = length;
165
166 /*
167 * Get the source and destination addresses, skip past them,
168 * and print them if we're printing the link-layer header.
169 */
170 ehp = (const struct ether_header *)p;
171 src.addr = ehp->ether_shost;
172 src.addr_string = etheraddr_string;
173 dst.addr = ehp->ether_dhost;
174 dst.addr_string = etheraddr_string;
175
176 length -= 2*MAC_ADDR_LEN;
177 caplen -= 2*MAC_ADDR_LEN;
178 p += 2*MAC_ADDR_LEN;
179 hdrlen = 2*MAC_ADDR_LEN;
180
181 if (ndo->ndo_eflag)
182 ether_addresses_print(ndo, src.addr, dst.addr);
183
184 /*
185 * Print the switch tag, if we have one, and skip past it.
186 */
187 if (print_switch_tag != NULL)
188 (*print_switch_tag)(ndo, p);
189
190 length -= switch_tag_len;
191 caplen -= switch_tag_len;
192 p += switch_tag_len;
193 hdrlen += switch_tag_len;
194
195 /*
196 * Get the length/type field, skip past it, and print it
197 * if we're printing the link-layer header.
198 */
199 recurse:
200 length_type = GET_BE_U_2(p);
201
202 length -= 2;
203 caplen -= 2;
204 p += 2;
205 hdrlen += 2;
206
207 if (length_type == ETHERTYPE_MACSEC) {
208 /*
209 * MACsec, aka IEEE 802.1AE-2006
210 * Print the header, and try to print the payload if it's not encrypted
211 */
212 int ret = macsec_print(ndo, &p, &length, &caplen, &hdrlen);
213
214 if (ret == 0) {
215 /* Payload is encrypted; just quit. */
216 return (hdrlen + caplen);
217 } else if (ret > 0) {
218 /* Problem printing the header; just quit. */
219 return (ret);
220 } else {
221 /*
222 * Keep processing type/length fields.
223 */
224 goto recurse;
225 }
226 }
227
228 /*
229 * Process VLAN tag types.
230 */
231 printed_length = 0;
232 while (length_type == ETHERTYPE_8021Q ||
233 length_type == ETHERTYPE_8021Q9100 ||
234 length_type == ETHERTYPE_8021Q9200 ||
235 length_type == ETHERTYPE_8021QinQ) {
236 /*
237 * It has a VLAN tag.
238 * Print VLAN information, and then go back and process
239 * the enclosed type field.
240 */
241 if (caplen < 4) {
242 ndo->ndo_protocol = "vlan";
243 nd_print_trunc(ndo);
244 return (hdrlen + caplen);
245 }
246 if (length < 4) {
247 ndo->ndo_protocol = "vlan";
248 nd_print_trunc(ndo);
249 return (hdrlen + length);
250 }
251 if (ndo->ndo_eflag) {
252 uint16_t tag = GET_BE_U_2(p);
253
254 ether_type_print(ndo, length_type);
255 if (!printed_length) {
256 ND_PRINT(", length %u: ", orig_length);
257 printed_length = 1;
258 } else
259 ND_PRINT(", ");
260 ND_PRINT("%s, ", ieee8021q_tci_string(tag));
261 }
262
263 length_type = GET_BE_U_2(p + 2);
264 p += 4;
265 length -= 4;
266 caplen -= 4;
267 hdrlen += 4;
268 }
269
270 /*
271 * We now have the final length/type field.
272 */
273 if (length_type <= MAX_ETHERNET_LENGTH_VAL) {
274 /*
275 * It's a length field, containing the length of the
276 * remaining payload; use it as such, as long as
277 * it's not too large (bigger than the actual payload).
278 */
279 if (length_type < length) {
280 length = length_type;
281 if (caplen > length)
282 caplen = length;
283 }
284
285 /*
286 * Cut off the snapshot length to the end of the
287 * payload.
288 */
289 nd_push_snapend(ndo, p + length);
290
291 if (ndo->ndo_eflag) {
292 ND_PRINT("802.3");
293 if (!printed_length)
294 ND_PRINT(", length %u: ", length);
295 }
296
297 /*
298 * An LLC header follows the length. Print that and
299 * higher layers.
300 */
301 llc_hdrlen = llc_print(ndo, p, length, caplen, &src, &dst);
302 if (llc_hdrlen < 0) {
303 /* packet type not known, print raw packet */
304 if (!ndo->ndo_suppress_default_print)
305 ND_DEFAULTPRINT(p, caplen);
306 llc_hdrlen = -llc_hdrlen;
307 }
308 hdrlen += llc_hdrlen;
309 nd_pop_packet_info(ndo);
310 } else if (length_type == ETHERTYPE_JUMBO) {
311 /*
312 * It's a type field, with the type for Alteon jumbo frames.
313 * See
314 *
315 * https://tools.ietf.org/html/draft-ietf-isis-ext-eth-01
316 *
317 * which indicates that, following the type field,
318 * there's an LLC header and payload.
319 */
320 /* Try to print the LLC-layer header & higher layers */
321 llc_hdrlen = llc_print(ndo, p, length, caplen, &src, &dst);
322 if (llc_hdrlen < 0) {
323 /* packet type not known, print raw packet */
324 if (!ndo->ndo_suppress_default_print)
325 ND_DEFAULTPRINT(p, caplen);
326 llc_hdrlen = -llc_hdrlen;
327 }
328 hdrlen += llc_hdrlen;
329 } else if (length_type == ETHERTYPE_ARISTA) {
330 if (caplen < 2) {
331 ND_PRINT("[|arista]");
332 return (hdrlen + caplen);
333 }
334 if (length < 2) {
335 ND_PRINT("[|arista]");
336 return (hdrlen + length);
337 }
338 ether_type_print(ndo, length_type);
339 ND_PRINT(", length %u: ", orig_length);
340 int bytesConsumed = arista_ethertype_print(ndo, p, length);
341 if (bytesConsumed > 0) {
342 p += bytesConsumed;
343 length -= bytesConsumed;
344 caplen -= bytesConsumed;
345 hdrlen += bytesConsumed;
346 goto recurse;
347 } else {
348 /* subtype/version not known, print raw packet */
349 if (!ndo->ndo_eflag && length_type > MAX_ETHERNET_LENGTH_VAL) {
350 ether_addresses_print(ndo, src.addr, dst.addr);
351 ether_type_print(ndo, length_type);
352 ND_PRINT(", length %u: ", orig_length);
353 }
354 if (!ndo->ndo_suppress_default_print)
355 ND_DEFAULTPRINT(p, caplen);
356 }
357 } else {
358 /*
359 * It's a type field with some other value.
360 */
361 if (ndo->ndo_eflag) {
362 ether_type_print(ndo, length_type);
363 if (!printed_length)
364 ND_PRINT(", length %u: ", orig_length);
365 else
366 ND_PRINT(", ");
367 }
368 if (ethertype_print(ndo, length_type, p, length, caplen, &src, &dst) == 0) {
369 /* type not known, print raw packet */
370 if (!ndo->ndo_eflag) {
371 /*
372 * We didn't print the full link-layer
373 * header, as -e wasn't specified, so
374 * print only the source and destination
375 * MAC addresses and the final Ethernet
376 * type.
377 */
378 ether_addresses_print(ndo, src.addr, dst.addr);
379 ether_type_print(ndo, length_type);
380 ND_PRINT(", length %u: ", orig_length);
381 }
382
383 if (!ndo->ndo_suppress_default_print)
384 ND_DEFAULTPRINT(p, caplen);
385 }
386 }
387 return (hdrlen);
388 }
389
390 /*
391 * Print an Ethernet frame while specyfing a non-standard Ethernet header
392 * length.
393 * This might be encapsulated within another frame; we might be passed
394 * a pointer to a function that can print header information for that
395 * frame's protocol, and an argument to pass to that function.
396 *
397 * FIXME: caplen can and should be derived from ndo->ndo_snapend and p.
398 */
399 u_int
400 ether_switch_tag_print(netdissect_options *ndo, const u_char *p, u_int length,
401 u_int caplen,
402 void (*print_switch_tag)(netdissect_options *, const u_char *),
403 u_int switch_tag_len)
404 {
405 return (ether_common_print(ndo, p, length, caplen, print_switch_tag,
406 switch_tag_len, NULL, NULL));
407 }
408
409 /*
410 * Print an Ethernet frame.
411 * This might be encapsulated within another frame; we might be passed
412 * a pointer to a function that can print header information for that
413 * frame's protocol, and an argument to pass to that function.
414 *
415 * FIXME: caplen can and should be derived from ndo->ndo_snapend and p.
416 */
417 u_int
418 ether_print(netdissect_options *ndo,
419 const u_char *p, u_int length, u_int caplen,
420 void (*print_encap_header)(netdissect_options *ndo, const u_char *),
421 const u_char *encap_header_arg)
422 {
423 ndo->ndo_protocol = "ether";
424 return (ether_common_print(ndo, p, length, caplen, NULL, 0,
425 print_encap_header, encap_header_arg));
426 }
427
428 /*
429 * This is the top level routine of the printer. 'p' points
430 * to the ether header of the packet, 'h->len' is the length
431 * of the packet off the wire, and 'h->caplen' is the number
432 * of bytes actually captured.
433 */
434 u_int
435 ether_if_print(netdissect_options *ndo, const struct pcap_pkthdr *h,
436 const u_char *p)
437 {
438 ndo->ndo_protocol = "ether_if";
439 return (ether_print(ndo, p, h->len, h->caplen, NULL, NULL));
440 }
441
442 /*
443 * This is the top level routine of the printer. 'p' points
444 * to the ether header of the packet, 'h->len' is the length
445 * of the packet off the wire, and 'h->caplen' is the number
446 * of bytes actually captured.
447 *
448 * This is for DLT_NETANALYZER, which has a 4-byte pseudo-header
449 * before the Ethernet header.
450 */
451 u_int
452 netanalyzer_if_print(netdissect_options *ndo, const struct pcap_pkthdr *h,
453 const u_char *p)
454 {
455 /*
456 * Fail if we don't have enough data for the Hilscher pseudo-header.
457 */
458 ndo->ndo_protocol = "netanalyzer_if";
459 if (h->caplen < 4) {
460 nd_print_trunc(ndo);
461 return (h->caplen);
462 }
463
464 /* Skip the pseudo-header. */
465 return (4 + ether_print(ndo, p + 4, h->len - 4, h->caplen - 4, NULL, NULL));
466 }
467
468 /*
469 * This is the top level routine of the printer. 'p' points
470 * to the ether header of the packet, 'h->len' is the length
471 * of the packet off the wire, and 'h->caplen' is the number
472 * of bytes actually captured.
473 *
474 * This is for DLT_NETANALYZER_TRANSPARENT, which has a 4-byte
475 * pseudo-header, a 7-byte Ethernet preamble, and a 1-byte Ethernet SOF
476 * before the Ethernet header.
477 */
478 u_int
479 netanalyzer_transparent_if_print(netdissect_options *ndo,
480 const struct pcap_pkthdr *h,
481 const u_char *p)
482 {
483 /*
484 * Fail if we don't have enough data for the Hilscher pseudo-header,
485 * preamble, and SOF.
486 */
487 ndo->ndo_protocol = "netanalyzer_transparent_if";
488 if (h->caplen < 12) {
489 nd_print_trunc(ndo);
490 return (h->caplen);
491 }
492
493 /* Skip the pseudo-header, preamble, and SOF. */
494 return (12 + ether_print(ndo, p + 12, h->len - 12, h->caplen - 12, NULL, NULL));
495 }
496
497 /*
498 * Prints the packet payload, given an Ethernet type code for the payload's
499 * protocol.
500 *
501 * Returns non-zero if it can do so, zero if the ethertype is unknown.
502 */
503
504 int
505 ethertype_print(netdissect_options *ndo,
506 u_short ether_type, const u_char *p,
507 u_int length, u_int caplen,
508 const struct lladdr_info *src, const struct lladdr_info *dst)
509 {
510 switch (ether_type) {
511
512 case ETHERTYPE_IP:
513 ip_print(ndo, p, length);
514 return (1);
515
516 case ETHERTYPE_IPV6:
517 ip6_print(ndo, p, length);
518 return (1);
519
520 case ETHERTYPE_ARP:
521 case ETHERTYPE_REVARP:
522 arp_print(ndo, p, length, caplen);
523 return (1);
524
525 case ETHERTYPE_DN:
526 decnet_print(ndo, p, length, caplen);
527 return (1);
528
529 case ETHERTYPE_ATALK:
530 if (ndo->ndo_vflag)
531 ND_PRINT("et1 ");
532 atalk_print(ndo, p, length);
533 return (1);
534
535 case ETHERTYPE_AARP:
536 aarp_print(ndo, p, length);
537 return (1);
538
539 case ETHERTYPE_IPX:
540 ND_PRINT("(NOV-ETHII) ");
541 ipx_print(ndo, p, length);
542 return (1);
543
544 case ETHERTYPE_ISO:
545 if (length == 0 || caplen == 0) {
546 ndo->ndo_protocol = "isoclns";
547 nd_print_trunc(ndo);
548 return (1);
549 }
550 isoclns_print(ndo, p + 1, length - 1);
551 return(1);
552
553 case ETHERTYPE_PPPOED:
554 case ETHERTYPE_PPPOES:
555 case ETHERTYPE_PPPOED2:
556 case ETHERTYPE_PPPOES2:
557 pppoe_print(ndo, p, length);
558 return (1);
559
560 case ETHERTYPE_EAPOL:
561 eap_print(ndo, p, length);
562 return (1);
563
564 case ETHERTYPE_RRCP:
565 rrcp_print(ndo, p, length, src, dst);
566 return (1);
567
568 case ETHERTYPE_PPP:
569 if (length) {
570 ND_PRINT(": ");
571 ppp_print(ndo, p, length);
572 }
573 return (1);
574
575 case ETHERTYPE_MPCP:
576 mpcp_print(ndo, p, length);
577 return (1);
578
579 case ETHERTYPE_SLOW:
580 slow_print(ndo, p, length);
581 return (1);
582
583 case ETHERTYPE_CFM:
584 case ETHERTYPE_CFM_OLD:
585 cfm_print(ndo, p, length);
586 return (1);
587
588 case ETHERTYPE_LLDP:
589 lldp_print(ndo, p, length);
590 return (1);
591
592 case ETHERTYPE_NSH:
593 nsh_print(ndo, p, length);
594 return (1);
595
596 case ETHERTYPE_LOOPBACK:
597 loopback_print(ndo, p, length);
598 return (1);
599
600 case ETHERTYPE_MPLS:
601 case ETHERTYPE_MPLS_MULTI:
602 mpls_print(ndo, p, length);
603 return (1);
604
605 case ETHERTYPE_TIPC:
606 tipc_print(ndo, p, length, caplen);
607 return (1);
608
609 case ETHERTYPE_MS_NLB_HB:
610 msnlb_print(ndo, p);
611 return (1);
612
613 case ETHERTYPE_GEONET_OLD:
614 case ETHERTYPE_GEONET:
615 geonet_print(ndo, p, length, src);
616 return (1);
617
618 case ETHERTYPE_CALM_FAST:
619 calm_fast_print(ndo, p, length, src);
620 return (1);
621
622 case ETHERTYPE_AOE:
623 aoe_print(ndo, p, length);
624 return (1);
625
626 case ETHERTYPE_PTP:
627 ptp_print(ndo, p, length);
628 return (1);
629
630 case ETHERTYPE_LAT:
631 case ETHERTYPE_SCA:
632 case ETHERTYPE_MOPRC:
633 case ETHERTYPE_MOPDL:
634 case ETHERTYPE_IEEE1905_1:
635 /* default_print for now */
636 default:
637 return (0);
638 }
639 }