]> The Tcpdump Group git mirrors - tcpdump/blob - print-sll.c
projects / tcpdump / blob


38db4520fb8fe1daa2a6a0139fbb72bb06be2ac6
[tcpdump] / print-sll.c
1 /*
2 * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997
3 * The Regents of the University of California. All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
16 * written permission.
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
20 */
21
22 /* \summary: Linux cooked sockets capture printer */
23
24 #ifdef HAVE_CONFIG_H
25 #include <config.h>
26 #endif
27
28 #ifdef HAVE_NET_IF_H
29 #include <net/if.h>
30 #endif
31
32 #include "netdissect-stdinc.h"
33
34 #include "netdissect.h"
35 #include "addrtoname.h"
36 #include "ethertype.h"
37 #include "extract.h"
38
39 /*
40 * For captures on Linux cooked sockets, we construct a fake header
41 * that includes:
42 *
43 * a 2-byte "packet type" which is one of:
44 *
45 * LINUX_SLL_HOST packet was sent to us
46 * LINUX_SLL_BROADCAST packet was broadcast
47 * LINUX_SLL_MULTICAST packet was multicast
48 * LINUX_SLL_OTHERHOST packet was sent to somebody else
49 * LINUX_SLL_OUTGOING packet was sent *by* us;
50 *
51 * a 2-byte Ethernet protocol field;
52 *
53 * a 2-byte link-layer type;
54 *
55 * a 2-byte link-layer address length;
56 *
57 * an 8-byte source link-layer address, whose actual length is
58 * specified by the previous value.
59 *
60 * All fields except for the link-layer address are in network byte order.
61 *
62 * DO NOT change the layout of this structure, or change any of the
63 * LINUX_SLL_ values below. If you must change the link-layer header
64 * for a "cooked" Linux capture, introduce a new DLT_ type (ask
65 * "tcpdump-workers@lists.tcpdump.org" for one, so that you don't give it
66 * a value that collides with a value already being used), and use the
67 * new header in captures of that type, so that programs that can
68 * handle DLT_LINUX_SLL captures will continue to handle them correctly
69 * without any change, and so that capture files with different headers
70 * can be told apart and programs that read them can dissect the
71 * packets in them.
72 *
73 * This structure, and the #defines below, must be the same in the
74 * libpcap and tcpdump versions of "sll.h".
75 */
76
77 /*
78 * A DLT_LINUX_SLL fake link-layer header.
79 */
80 #define SLL_HDR_LEN 16 /* total header length */
81 #define SLL_ADDRLEN 8 /* length of address field */
82
83 struct sll_header {
84 nd_uint16_t sll_pkttype; /* packet type */
85 nd_uint16_t sll_hatype; /* link-layer address type */
86 nd_uint16_t sll_halen; /* link-layer address length */
87 nd_byte sll_addr[SLL_ADDRLEN]; /* link-layer address */
88 nd_uint16_t sll_protocol; /* protocol */
89 };
90
91 /*
92 * A DLT_LINUX_SLL2 fake link-layer header.
93 */
94 #define SLL2_HDR_LEN 20 /* total header length */
95
96 struct sll2_header {
97 nd_uint16_t sll2_protocol; /* protocol */
98 nd_uint16_t sll2_reserved_mbz; /* reserved - must be zero */
99 nd_uint32_t sll2_if_index; /* 1-based interface index */
100 nd_uint16_t sll2_hatype; /* link-layer address type */
101 nd_uint8_t sll2_pkttype; /* packet type */
102 nd_uint8_t sll2_halen; /* link-layer address length */
103 nd_byte sll2_addr[SLL_ADDRLEN]; /* link-layer address */
104 };
105
106 /*
107 * The LINUX_SLL_ values for "sll_pkttype"; these correspond to the
108 * PACKET_ values on Linux, but are defined here so that they're
109 * available even on systems other than Linux, and so that they
110 * don't change even if the PACKET_ values change.
111 */
112 #define LINUX_SLL_HOST 0
113 #define LINUX_SLL_BROADCAST 1
114 #define LINUX_SLL_MULTICAST 2
115 #define LINUX_SLL_OTHERHOST 3
116 #define LINUX_SLL_OUTGOING 4
117
118 /*
119 * The LINUX_SLL_ values for "sll_protocol"; these correspond to the
120 * ETH_P_ values on Linux, but are defined here so that they're
121 * available even on systems other than Linux. We assume, for now,
122 * that the ETH_P_ values won't change in Linux; if they do, then:
123 *
124 * if we don't translate them in "pcap-linux.c", capture files
125 * won't necessarily be readable if captured on a system that
126 * defines ETH_P_ values that don't match these values;
127 *
128 * if we do translate them in "pcap-linux.c", that makes life
129 * unpleasant for the BPF code generator, as the values you test
130 * for in the kernel aren't the values that you test for when
131 * reading a capture file, so the fixup code run on BPF programs
132 * handed to the kernel ends up having to do more work.
133 *
134 * Add other values here as necessary, for handling packet types that
135 * might show up on non-Ethernet, non-802.x networks. (Not all the ones
136 * in the Linux "if_ether.h" will, I suspect, actually show up in
137 * captures.)
138 */
139 #define LINUX_SLL_P_802_3 0x0001 /* Novell 802.3 frames without 802.2 LLC header */
140 #define LINUX_SLL_P_802_2 0x0004 /* 802.2 frames (not D/I/X Ethernet) */
141
142 static const struct tok sll_pkttype_values[] = {
143 { LINUX_SLL_HOST, "In" },
144 { LINUX_SLL_BROADCAST, "B" },
145 { LINUX_SLL_MULTICAST, "M" },
146 { LINUX_SLL_OTHERHOST, "P" },
147 { LINUX_SLL_OUTGOING, "Out" },
148 { 0, NULL}
149 };
150
151 static void
152 sll_print(netdissect_options *ndo, const struct sll_header *sllp, u_int length)
153 {
154 u_short ether_type;
155
156 ndo->ndo_protocol = "sll";
157 ND_PRINT("%3s ",
158 tok2str(sll_pkttype_values,"?",GET_BE_U_2(sllp->sll_pkttype)));
159
160 /*
161 * XXX - check the link-layer address type value?
162 * For now, we just assume 6 means Ethernet.
163 * XXX - print others as strings of hex?
164 */
165 if (GET_BE_U_2(sllp->sll_halen) == 6)
166 ND_PRINT("%s ", GET_ETHERADDR_STRING(sllp->sll_addr));
167
168 if (!ndo->ndo_qflag) {
169 ether_type = GET_BE_U_2(sllp->sll_protocol);
170
171 if (ether_type <= MAX_ETHERNET_LENGTH_VAL) {
172 /*
173 * Not an Ethernet type; what type is it?
174 */
175 switch (ether_type) {
176
177 case LINUX_SLL_P_802_3:
178 /*
179 * Ethernet_802.3 IPX frame.
180 */
181 ND_PRINT("802.3");
182 break;
183
184 case LINUX_SLL_P_802_2:
185 /*
186 * 802.2.
187 */
188 ND_PRINT("802.2");
189 break;
190
191 default:
192 /*
193 * What is it?
194 */
195 ND_PRINT("ethertype Unknown (0x%04x)",
196 ether_type);
197 break;
198 }
199 } else {
200 ND_PRINT("ethertype %s (0x%04x)",
201 tok2str(ethertype_values, "Unknown", ether_type),
202 ether_type);
203 }
204 ND_PRINT(", length %u: ", length);
205 }
206 }
207
208 /*
209 * This is the top level routine of the printer. 'p' points to the
210 * Linux "cooked capture" header of the packet, 'h->ts' is the timestamp,
211 * 'h->len' is the length of the packet off the wire, and 'h->caplen'
212 * is the number of bytes actually captured.
213 */
214 void
215 sll_if_print(netdissect_options *ndo, const struct pcap_pkthdr *h, const u_char *p)
216 {
217 u_int caplen = h->caplen;
218 u_int length = h->len;
219 const struct sll_header *sllp;
220 u_short hatype;
221 u_short ether_type;
222 int llc_hdrlen;
223 u_int hdrlen;
224
225 ndo->ndo_protocol = "sll";
226 if (caplen < SLL_HDR_LEN) {
227 /*
228 * XXX - this "can't happen" because "pcap-linux.c" always
229 * adds this many bytes of header to every packet in a
230 * cooked socket capture.
231 */
232 nd_print_trunc(ndo);
233 ndo->ndo_ll_hdr_len += caplen;
234 return;
235 }
236
237 sllp = (const struct sll_header *)p;
238
239 if (ndo->ndo_eflag)
240 sll_print(ndo, sllp, length);
241
242 /*
243 * Go past the cooked-mode header.
244 */
245 length -= SLL_HDR_LEN;
246 caplen -= SLL_HDR_LEN;
247 p += SLL_HDR_LEN;
248 hdrlen = SLL_HDR_LEN;
249
250 hatype = GET_BE_U_2(sllp->sll_hatype);
251 switch (hatype) {
252
253 case 803:
254 /*
255 * This is an packet with a radiotap header;
256 * just dissect the payload as such.
257 */
258 ndo->ndo_ll_hdr_len += SLL_HDR_LEN;
259 ndo->ndo_ll_hdr_len += ieee802_11_radio_print(ndo, p, length, caplen);
260 return;
261 }
262 ether_type = GET_BE_U_2(sllp->sll_protocol);
263
264 recurse:
265 /*
266 * Is it (gag) an 802.3 encapsulation, or some non-Ethernet
267 * packet type?
268 */
269 if (ether_type <= MAX_ETHERNET_LENGTH_VAL) {
270 /*
271 * Yes - what type is it?
272 */
273 switch (ether_type) {
274
275 case LINUX_SLL_P_802_3:
276 /*
277 * Ethernet_802.3 IPX frame.
278 */
279 ipx_print(ndo, p, length);
280 break;
281
282 case LINUX_SLL_P_802_2:
283 /*
284 * 802.2.
285 * Try to print the LLC-layer header & higher layers.
286 */
287 llc_hdrlen = llc_print(ndo, p, length, caplen, NULL, NULL);
288 if (llc_hdrlen < 0)
289 goto unknown; /* unknown LLC type */
290 hdrlen += llc_hdrlen;
291 break;
292
293 default:
294 /*FALLTHROUGH*/
295
296 unknown:
297 /* packet type not known, print raw packet */
298 if (!ndo->ndo_suppress_default_print)
299 ND_DEFAULTPRINT(p, caplen);
300 break;
301 }
302 } else if (ether_type == ETHERTYPE_8021Q) {
303 /*
304 * Print VLAN information, and then go back and process
305 * the enclosed type field.
306 */
307 if (caplen < 4) {
308 ndo->ndo_protocol = "vlan";
309 nd_print_trunc(ndo);
310 ndo->ndo_ll_hdr_len += hdrlen + caplen;
311 return;
312 }
313 if (ndo->ndo_eflag) {
314 uint16_t tag = GET_BE_U_2(p);
315
316 ND_PRINT("%s, ", ieee8021q_tci_string(tag));
317 }
318
319 ether_type = GET_BE_U_2(p + 2);
320 if (ether_type <= MAX_ETHERNET_LENGTH_VAL)
321 ether_type = LINUX_SLL_P_802_2;
322 if (!ndo->ndo_qflag) {
323 ND_PRINT("ethertype %s, ",
324 tok2str(ethertype_values, "Unknown", ether_type));
325 }
326 p += 4;
327 length -= 4;
328 caplen -= 4;
329 hdrlen += 4;
330 goto recurse;
331 } else {
332 if (ethertype_print(ndo, ether_type, p, length, caplen, NULL, NULL) == 0) {
333 /* ether_type not known, print raw packet */
334 if (!ndo->ndo_eflag)
335 sll_print(ndo, sllp, length + SLL_HDR_LEN);
336 if (!ndo->ndo_suppress_default_print)
337 ND_DEFAULTPRINT(p, caplen);
338 }
339 }
340
341 ndo->ndo_ll_hdr_len += hdrlen;
342 }
343
344 static void
345 sll2_print(netdissect_options *ndo, const struct sll2_header *sllp, u_int length)
346 {
347 u_short ether_type;
348
349 ndo->ndo_protocol = "sll2";
350 ND_PRINT("ifindex %u ", GET_BE_U_4(sllp->sll2_if_index));
351
352 /*
353 * XXX - check the link-layer address type value?
354 * For now, we just assume 6 means Ethernet.
355 * XXX - print others as strings of hex?
356 */
357 if (GET_U_1(sllp->sll2_halen) == 6)
358 ND_PRINT("%s ", GET_ETHERADDR_STRING(sllp->sll2_addr));
359
360 if (!ndo->ndo_qflag) {
361 ether_type = GET_BE_U_2(sllp->sll2_protocol);
362
363 if (ether_type <= MAX_ETHERNET_LENGTH_VAL) {
364 /*
365 * Not an Ethernet type; what type is it?
366 */
367 switch (ether_type) {
368
369 case LINUX_SLL_P_802_3:
370 /*
371 * Ethernet_802.3 IPX frame.
372 */
373 ND_PRINT("802.3");
374 break;
375
376 case LINUX_SLL_P_802_2:
377 /*
378 * 802.2.
379 */
380 ND_PRINT("802.2");
381 break;
382
383 default:
384 /*
385 * What is it?
386 */
387 ND_PRINT("ethertype Unknown (0x%04x)",
388 ether_type);
389 break;
390 }
391 } else {
392 ND_PRINT("ethertype %s (0x%04x)",
393 tok2str(ethertype_values, "Unknown", ether_type),
394 ether_type);
395 }
396 ND_PRINT(", length %u: ", length);
397 }
398 }
399
400 /*
401 * This is the top level routine of the printer. 'p' points to the
402 * Linux "cooked capture" header of the packet, 'h->ts' is the timestamp,
403 * 'h->len' is the length of the packet off the wire, and 'h->caplen'
404 * is the number of bytes actually captured.
405 */
406 void
407 sll2_if_print(netdissect_options *ndo, const struct pcap_pkthdr *h, const u_char *p)
408 {
409 u_int caplen = h->caplen;
410 u_int length = h->len;
411 const struct sll2_header *sllp;
412 u_short hatype;
413 u_short ether_type;
414 int llc_hdrlen;
415 u_int hdrlen;
416 #ifdef HAVE_NET_IF_H
417 uint32_t if_index;
418 char ifname[IF_NAMESIZE];
419 #endif
420
421 ndo->ndo_protocol = "sll2";
422 if (caplen < SLL2_HDR_LEN) {
423 /*
424 * XXX - this "can't happen" because "pcap-linux.c" always
425 * adds this many bytes of header to every packet in a
426 * cooked socket capture.
427 */
428 nd_print_trunc(ndo);
429 ndo->ndo_ll_hdr_len += caplen;
430 return;
431 }
432
433 sllp = (const struct sll2_header *)p;
434 #ifdef HAVE_NET_IF_H
435 if_index = GET_BE_U_4(sllp->sll2_if_index);
436 if (!if_indextoname(if_index, ifname))
437 strncpy(ifname, "?", 2);
438 ND_PRINT("%-5s ", ifname);
439 #endif
440
441 ND_PRINT("%-3s ",
442 tok2str(sll_pkttype_values, "?", GET_U_1(sllp->sll2_pkttype)));
443
444 if (ndo->ndo_eflag)
445 sll2_print(ndo, sllp, length);
446
447 /*
448 * Go past the cooked-mode header.
449 */
450 length -= SLL2_HDR_LEN;
451 caplen -= SLL2_HDR_LEN;
452 p += SLL2_HDR_LEN;
453 hdrlen = SLL2_HDR_LEN;
454
455 hatype = GET_BE_U_2(sllp->sll2_hatype);
456 switch (hatype) {
457
458 case 803:
459 /*
460 * This is an packet with a radiotap header;
461 * just dissect the payload as such.
462 */
463 ndo->ndo_ll_hdr_len += SLL2_HDR_LEN;
464 ndo->ndo_ll_hdr_len += ieee802_11_radio_print(ndo, p, length, caplen);
465 return;
466 }
467 ether_type = GET_BE_U_2(sllp->sll2_protocol);
468
469 recurse:
470 /*
471 * Is it (gag) an 802.3 encapsulation, or some non-Ethernet
472 * packet type?
473 */
474 if (ether_type <= MAX_ETHERNET_LENGTH_VAL) {
475 /*
476 * Yes - what type is it?
477 */
478 switch (ether_type) {
479
480 case LINUX_SLL_P_802_3:
481 /*
482 * Ethernet_802.3 IPX frame.
483 */
484 ipx_print(ndo, p, length);
485 break;
486
487 case LINUX_SLL_P_802_2:
488 /*
489 * 802.2.
490 * Try to print the LLC-layer header & higher layers.
491 */
492 llc_hdrlen = llc_print(ndo, p, length, caplen, NULL, NULL);
493 if (llc_hdrlen < 0)
494 goto unknown; /* unknown LLC type */
495 hdrlen += llc_hdrlen;
496 break;
497
498 default:
499 /*FALLTHROUGH*/
500
501 unknown:
502 /* packet type not known, print raw packet */
503 if (!ndo->ndo_suppress_default_print)
504 ND_DEFAULTPRINT(p, caplen);
505 break;
506 }
507 } else if (ether_type == ETHERTYPE_8021Q) {
508 /*
509 * Print VLAN information, and then go back and process
510 * the enclosed type field.
511 */
512 if (caplen < 4) {
513 ndo->ndo_protocol = "vlan";
514 nd_print_trunc(ndo);
515 ndo->ndo_ll_hdr_len += hdrlen + caplen;
516 return;
517 }
518 if (ndo->ndo_eflag) {
519 uint16_t tag = GET_BE_U_2(p);
520
521 ND_PRINT("%s, ", ieee8021q_tci_string(tag));
522 }
523
524 ether_type = GET_BE_U_2(p + 2);
525 if (ether_type <= MAX_ETHERNET_LENGTH_VAL)
526 ether_type = LINUX_SLL_P_802_2;
527 if (!ndo->ndo_qflag) {
528 ND_PRINT("ethertype %s, ",
529 tok2str(ethertype_values, "Unknown", ether_type));
530 }
531 p += 4;
532 length -= 4;
533 caplen -= 4;
534 hdrlen += 4;
535 goto recurse;
536 } else {
537 if (ethertype_print(ndo, ether_type, p, length, caplen, NULL, NULL) == 0) {
538 /* ether_type not known, print raw packet */
539 if (!ndo->ndo_eflag)
540 sll2_print(ndo, sllp, length + SLL2_HDR_LEN);
541 if (!ndo->ndo_suppress_default_print)
542 ND_DEFAULTPRINT(p, caplen);
543 }
544 }
545
546 ndo->ndo_ll_hdr_len += hdrlen;
547 }
[mirror] the TCPdump network dissector