]> The Tcpdump Group git mirrors - tcpdump/blob - print-ether.c
Properly handle the return value of macsec_print().
[tcpdump] / print-ether.c
1 /*
2 * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 2000
3 * The Regents of the University of California. All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
16 * written permission.
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
20 */
21
22 /* \summary: Ethernet printer */
23
24 #ifdef HAVE_CONFIG_H
25 #include <config.h>
26 #endif
27
28 #include "netdissect-stdinc.h"
29
30 #include "netdissect.h"
31 #include "extract.h"
32 #include "addrtoname.h"
33 #include "ethertype.h"
34
35 /*
36 * Structure of an Ethernet header.
37 */
38 struct ether_header {
39 nd_mac_addr ether_dhost;
40 nd_mac_addr ether_shost;
41 nd_uint16_t ether_length_type;
42 };
43
44 /*
45 * Length of an Ethernet header; note that some compilers may pad
46 * "struct ether_header" to a multiple of 4 bytes, for example, so
47 * "sizeof (struct ether_header)" may not give the right answer.
48 */
49 #define ETHER_HDRLEN 14
50
51 const struct tok ethertype_values[] = {
52 { ETHERTYPE_IP, "IPv4" },
53 { ETHERTYPE_MPLS, "MPLS unicast" },
54 { ETHERTYPE_MPLS_MULTI, "MPLS multicast" },
55 { ETHERTYPE_IPV6, "IPv6" },
56 { ETHERTYPE_8021Q, "802.1Q" },
57 { ETHERTYPE_8021Q9100, "802.1Q-9100" },
58 { ETHERTYPE_8021QinQ, "802.1Q-QinQ" },
59 { ETHERTYPE_8021Q9200, "802.1Q-9200" },
60 { ETHERTYPE_MACSEC, "802.1AE MACsec" },
61 { ETHERTYPE_VMAN, "VMAN" },
62 { ETHERTYPE_PUP, "PUP" },
63 { ETHERTYPE_ARP, "ARP"},
64 { ETHERTYPE_REVARP, "Reverse ARP"},
65 { ETHERTYPE_NS, "NS" },
66 { ETHERTYPE_SPRITE, "Sprite" },
67 { ETHERTYPE_TRAIL, "Trail" },
68 { ETHERTYPE_MOPDL, "MOP DL" },
69 { ETHERTYPE_MOPRC, "MOP RC" },
70 { ETHERTYPE_DN, "DN" },
71 { ETHERTYPE_LAT, "LAT" },
72 { ETHERTYPE_SCA, "SCA" },
73 { ETHERTYPE_TEB, "TEB" },
74 { ETHERTYPE_LANBRIDGE, "Lanbridge" },
75 { ETHERTYPE_DECDNS, "DEC DNS" },
76 { ETHERTYPE_DECDTS, "DEC DTS" },
77 { ETHERTYPE_VEXP, "VEXP" },
78 { ETHERTYPE_VPROD, "VPROD" },
79 { ETHERTYPE_ATALK, "Appletalk" },
80 { ETHERTYPE_AARP, "Appletalk ARP" },
81 { ETHERTYPE_IPX, "IPX" },
82 { ETHERTYPE_PPP, "PPP" },
83 { ETHERTYPE_MPCP, "MPCP" },
84 { ETHERTYPE_SLOW, "Slow Protocols" },
85 { ETHERTYPE_PPPOED, "PPPoE D" },
86 { ETHERTYPE_PPPOES, "PPPoE S" },
87 { ETHERTYPE_EAPOL, "EAPOL" },
88 { ETHERTYPE_RRCP, "RRCP" },
89 { ETHERTYPE_MS_NLB_HB, "MS NLB heartbeat" },
90 { ETHERTYPE_JUMBO, "Jumbo" },
91 { ETHERTYPE_NSH, "NSH" },
92 { ETHERTYPE_LOOPBACK, "Loopback" },
93 { ETHERTYPE_ISO, "OSI" },
94 { ETHERTYPE_GRE_ISO, "GRE-OSI" },
95 { ETHERTYPE_CFM_OLD, "CFM (old)" },
96 { ETHERTYPE_CFM, "CFM" },
97 { ETHERTYPE_IEEE1905_1, "IEEE1905.1" },
98 { ETHERTYPE_LLDP, "LLDP" },
99 { ETHERTYPE_TIPC, "TIPC"},
100 { ETHERTYPE_GEONET_OLD, "GeoNet (old)"},
101 { ETHERTYPE_GEONET, "GeoNet"},
102 { ETHERTYPE_CALM_FAST, "CALM FAST"},
103 { ETHERTYPE_AOE, "AoE" },
104 { ETHERTYPE_PTP, "PTP" },
105 { ETHERTYPE_ARISTA, "Arista Vendor Specific Protocol" },
106 { 0, NULL}
107 };
108
109 static void
110 ether_addresses_print(netdissect_options *ndo, const u_char *src,
111 const u_char *dst)
112 {
113 ND_PRINT("%s > %s, ",
114 GET_ETHERADDR_STRING(src), GET_ETHERADDR_STRING(dst));
115 }
116
117 static void
118 ether_type_print(netdissect_options *ndo, uint16_t type)
119 {
120 if (!ndo->ndo_qflag)
121 ND_PRINT("ethertype %s (0x%04x)",
122 tok2str(ethertype_values, "Unknown", type), type);
123 else
124 ND_PRINT("%s",
125 tok2str(ethertype_values, "Unknown Ethertype (0x%04x)", type));
126 }
127
128 /*
129 * Common code for printing Ethernet frames.
130 *
131 * It can handle Ethernet headers with extra tag information inserted
132 * after the destination and source addresses, as is inserted by some
133 * switch chips, and extra encapsulation header information before
134 * printing Ethernet header information (such as a LANE ID for ATM LANE).
135 */
136 static u_int
137 ether_common_print(netdissect_options *ndo, const u_char *p, u_int length,
138 u_int caplen,
139 void (*print_switch_tag)(netdissect_options *ndo, const u_char *),
140 u_int switch_tag_len,
141 void (*print_encap_header)(netdissect_options *ndo, const u_char *),
142 const u_char *encap_header_arg)
143 {
144 const struct ether_header *ehp;
145 u_int orig_length;
146 u_int hdrlen;
147 u_short length_type;
148 int printed_length;
149 int llc_hdrlen;
150 struct lladdr_info src, dst;
151
152 if (caplen < ETHER_HDRLEN + switch_tag_len) {
153 nd_print_trunc(ndo);
154 return (caplen);
155 }
156 if (length < ETHER_HDRLEN + switch_tag_len) {
157 nd_print_trunc(ndo);
158 return (length);
159 }
160
161 if (print_encap_header != NULL)
162 (*print_encap_header)(ndo, encap_header_arg);
163
164 orig_length = length;
165
166 /*
167 * Get the source and destination addresses, skip past them,
168 * and print them if we're printing the link-layer header.
169 */
170 ehp = (const struct ether_header *)p;
171 src.addr = ehp->ether_shost;
172 src.addr_string = etheraddr_string;
173 dst.addr = ehp->ether_dhost;
174 dst.addr_string = etheraddr_string;
175
176 length -= 2*MAC_ADDR_LEN;
177 caplen -= 2*MAC_ADDR_LEN;
178 p += 2*MAC_ADDR_LEN;
179 hdrlen = 2*MAC_ADDR_LEN;
180
181 if (ndo->ndo_eflag)
182 ether_addresses_print(ndo, src.addr, dst.addr);
183
184 /*
185 * Print the switch tag, if we have one, and skip past it.
186 */
187 if (print_switch_tag != NULL)
188 (*print_switch_tag)(ndo, p);
189
190 length -= switch_tag_len;
191 caplen -= switch_tag_len;
192 p += switch_tag_len;
193 hdrlen += switch_tag_len;
194
195 /*
196 * Get the length/type field, skip past it, and print it
197 * if we're printing the link-layer header.
198 */
199 recurse:
200 length_type = GET_BE_U_2(p);
201
202 length -= 2;
203 caplen -= 2;
204 p += 2;
205 hdrlen += 2;
206
207 if (length_type == ETHERTYPE_MACSEC) {
208 /*
209 * MACsec, aka IEEE 802.1AE-2006
210 * Print the header, and try to print the payload if it's not encrypted
211 */
212 int ret = macsec_print(ndo, &p, &length, &caplen, &hdrlen, &length_type);
213
214 if (ret == 0) {
215 /* Payload is encrypted; just quit. */
216 return (hdrlen + caplen);
217 } else if (ret > 0) {
218 /* Problem printing the header; just quit. */
219 return (ret);
220 }
221 }
222
223 /*
224 * Process VLAN tag types.
225 */
226 printed_length = 0;
227 while (length_type == ETHERTYPE_8021Q ||
228 length_type == ETHERTYPE_8021Q9100 ||
229 length_type == ETHERTYPE_8021Q9200 ||
230 length_type == ETHERTYPE_8021QinQ) {
231 /*
232 * It has a VLAN tag.
233 * Print VLAN information, and then go back and process
234 * the enclosed type field.
235 */
236 if (caplen < 4) {
237 ndo->ndo_protocol = "vlan";
238 nd_print_trunc(ndo);
239 return (hdrlen + caplen);
240 }
241 if (length < 4) {
242 ndo->ndo_protocol = "vlan";
243 nd_print_trunc(ndo);
244 return (hdrlen + length);
245 }
246 if (ndo->ndo_eflag) {
247 uint16_t tag = GET_BE_U_2(p);
248
249 ether_type_print(ndo, length_type);
250 if (!printed_length) {
251 ND_PRINT(", length %u: ", orig_length);
252 printed_length = 1;
253 } else
254 ND_PRINT(", ");
255 ND_PRINT("%s, ", ieee8021q_tci_string(tag));
256 }
257
258 length_type = GET_BE_U_2(p + 2);
259 p += 4;
260 length -= 4;
261 caplen -= 4;
262 hdrlen += 4;
263 }
264
265 /*
266 * We now have the final length/type field.
267 */
268 if (length_type <= MAX_ETHERNET_LENGTH_VAL) {
269 /*
270 * It's a length field, containing the length of the
271 * remaining payload; use it as such, as long as
272 * it's not too large (bigger than the actual payload).
273 */
274 if (length_type < length) {
275 length = length_type;
276 if (caplen > length)
277 caplen = length;
278 }
279
280 /*
281 * Cut off the snapshot length to the end of the
282 * payload.
283 */
284 nd_push_snapend(ndo, p + length);
285
286 if (ndo->ndo_eflag) {
287 ND_PRINT("802.3");
288 if (!printed_length)
289 ND_PRINT(", length %u: ", length);
290 }
291
292 /*
293 * An LLC header follows the length. Print that and
294 * higher layers.
295 */
296 llc_hdrlen = llc_print(ndo, p, length, caplen, &src, &dst);
297 if (llc_hdrlen < 0) {
298 /* packet type not known, print raw packet */
299 if (!ndo->ndo_suppress_default_print)
300 ND_DEFAULTPRINT(p, caplen);
301 llc_hdrlen = -llc_hdrlen;
302 }
303 hdrlen += llc_hdrlen;
304 nd_pop_packet_info(ndo);
305 } else if (length_type == ETHERTYPE_JUMBO) {
306 /*
307 * It's a type field, with the type for Alteon jumbo frames.
308 * See
309 *
310 * https://tools.ietf.org/html/draft-ietf-isis-ext-eth-01
311 *
312 * which indicates that, following the type field,
313 * there's an LLC header and payload.
314 */
315 /* Try to print the LLC-layer header & higher layers */
316 llc_hdrlen = llc_print(ndo, p, length, caplen, &src, &dst);
317 if (llc_hdrlen < 0) {
318 /* packet type not known, print raw packet */
319 if (!ndo->ndo_suppress_default_print)
320 ND_DEFAULTPRINT(p, caplen);
321 llc_hdrlen = -llc_hdrlen;
322 }
323 hdrlen += llc_hdrlen;
324 } else if (length_type == ETHERTYPE_ARISTA) {
325 if (caplen < 2) {
326 ND_PRINT("[|arista]");
327 return (hdrlen + caplen);
328 }
329 if (length < 2) {
330 ND_PRINT("[|arista]");
331 return (hdrlen + length);
332 }
333 ether_type_print(ndo, length_type);
334 ND_PRINT(", length %u: ", orig_length);
335 int bytesConsumed = arista_ethertype_print(ndo, p, length);
336 if (bytesConsumed > 0) {
337 p += bytesConsumed;
338 length -= bytesConsumed;
339 caplen -= bytesConsumed;
340 hdrlen += bytesConsumed;
341 goto recurse;
342 } else {
343 /* subtype/version not known, print raw packet */
344 if (!ndo->ndo_eflag && length_type > MAX_ETHERNET_LENGTH_VAL) {
345 ether_addresses_print(ndo, src.addr, dst.addr);
346 ether_type_print(ndo, length_type);
347 ND_PRINT(", length %u: ", orig_length);
348 }
349 if (!ndo->ndo_suppress_default_print)
350 ND_DEFAULTPRINT(p, caplen);
351 }
352 } else {
353 /*
354 * It's a type field with some other value.
355 */
356 if (ndo->ndo_eflag) {
357 ether_type_print(ndo, length_type);
358 if (!printed_length)
359 ND_PRINT(", length %u: ", orig_length);
360 else
361 ND_PRINT(", ");
362 }
363 if (ethertype_print(ndo, length_type, p, length, caplen, &src, &dst) == 0) {
364 raw:
365 /* type not known, print raw packet */
366 if (!ndo->ndo_eflag) {
367 /*
368 * We didn't print the full link-layer
369 * header, as -e wasn't specified, so
370 * print only the source and destination
371 * MAC addresses and the final Ethernet
372 * type.
373 */
374 ether_addresses_print(ndo, src.addr, dst.addr);
375 ether_type_print(ndo, length_type);
376 ND_PRINT(", length %u: ", orig_length);
377 }
378
379 if (!ndo->ndo_suppress_default_print)
380 ND_DEFAULTPRINT(p, caplen);
381 }
382 }
383 return (hdrlen);
384 }
385
386 /*
387 * Print an Ethernet frame while specyfing a non-standard Ethernet header
388 * length.
389 * This might be encapsulated within another frame; we might be passed
390 * a pointer to a function that can print header information for that
391 * frame's protocol, and an argument to pass to that function.
392 *
393 * FIXME: caplen can and should be derived from ndo->ndo_snapend and p.
394 */
395 u_int
396 ether_switch_tag_print(netdissect_options *ndo, const u_char *p, u_int length,
397 u_int caplen,
398 void (*print_switch_tag)(netdissect_options *, const u_char *),
399 u_int switch_tag_len)
400 {
401 return (ether_common_print(ndo, p, length, caplen, print_switch_tag,
402 switch_tag_len, NULL, NULL));
403 }
404
405 /*
406 * Print an Ethernet frame.
407 * This might be encapsulated within another frame; we might be passed
408 * a pointer to a function that can print header information for that
409 * frame's protocol, and an argument to pass to that function.
410 *
411 * FIXME: caplen can and should be derived from ndo->ndo_snapend and p.
412 */
413 u_int
414 ether_print(netdissect_options *ndo,
415 const u_char *p, u_int length, u_int caplen,
416 void (*print_encap_header)(netdissect_options *ndo, const u_char *),
417 const u_char *encap_header_arg)
418 {
419 ndo->ndo_protocol = "ether";
420 return (ether_common_print(ndo, p, length, caplen, NULL, 0,
421 print_encap_header, encap_header_arg));
422 }
423
424 /*
425 * This is the top level routine of the printer. 'p' points
426 * to the ether header of the packet, 'h->len' is the length
427 * of the packet off the wire, and 'h->caplen' is the number
428 * of bytes actually captured.
429 */
430 u_int
431 ether_if_print(netdissect_options *ndo, const struct pcap_pkthdr *h,
432 const u_char *p)
433 {
434 ndo->ndo_protocol = "ether_if";
435 return (ether_print(ndo, p, h->len, h->caplen, NULL, NULL));
436 }
437
438 /*
439 * This is the top level routine of the printer. 'p' points
440 * to the ether header of the packet, 'h->len' is the length
441 * of the packet off the wire, and 'h->caplen' is the number
442 * of bytes actually captured.
443 *
444 * This is for DLT_NETANALYZER, which has a 4-byte pseudo-header
445 * before the Ethernet header.
446 */
447 u_int
448 netanalyzer_if_print(netdissect_options *ndo, const struct pcap_pkthdr *h,
449 const u_char *p)
450 {
451 /*
452 * Fail if we don't have enough data for the Hilscher pseudo-header.
453 */
454 ndo->ndo_protocol = "netanalyzer_if";
455 if (h->caplen < 4) {
456 nd_print_trunc(ndo);
457 return (h->caplen);
458 }
459
460 /* Skip the pseudo-header. */
461 return (4 + ether_print(ndo, p + 4, h->len - 4, h->caplen - 4, NULL, NULL));
462 }
463
464 /*
465 * This is the top level routine of the printer. 'p' points
466 * to the ether header of the packet, 'h->len' is the length
467 * of the packet off the wire, and 'h->caplen' is the number
468 * of bytes actually captured.
469 *
470 * This is for DLT_NETANALYZER_TRANSPARENT, which has a 4-byte
471 * pseudo-header, a 7-byte Ethernet preamble, and a 1-byte Ethernet SOF
472 * before the Ethernet header.
473 */
474 u_int
475 netanalyzer_transparent_if_print(netdissect_options *ndo,
476 const struct pcap_pkthdr *h,
477 const u_char *p)
478 {
479 /*
480 * Fail if we don't have enough data for the Hilscher pseudo-header,
481 * preamble, and SOF.
482 */
483 ndo->ndo_protocol = "netanalyzer_transparent_if";
484 if (h->caplen < 12) {
485 nd_print_trunc(ndo);
486 return (h->caplen);
487 }
488
489 /* Skip the pseudo-header, preamble, and SOF. */
490 return (12 + ether_print(ndo, p + 12, h->len - 12, h->caplen - 12, NULL, NULL));
491 }
492
493 /*
494 * Prints the packet payload, given an Ethernet type code for the payload's
495 * protocol.
496 *
497 * Returns non-zero if it can do so, zero if the ethertype is unknown.
498 */
499
500 int
501 ethertype_print(netdissect_options *ndo,
502 u_short ether_type, const u_char *p,
503 u_int length, u_int caplen,
504 const struct lladdr_info *src, const struct lladdr_info *dst)
505 {
506 switch (ether_type) {
507
508 case ETHERTYPE_IP:
509 ip_print(ndo, p, length);
510 return (1);
511
512 case ETHERTYPE_IPV6:
513 ip6_print(ndo, p, length);
514 return (1);
515
516 case ETHERTYPE_ARP:
517 case ETHERTYPE_REVARP:
518 arp_print(ndo, p, length, caplen);
519 return (1);
520
521 case ETHERTYPE_DN:
522 decnet_print(ndo, p, length, caplen);
523 return (1);
524
525 case ETHERTYPE_ATALK:
526 if (ndo->ndo_vflag)
527 ND_PRINT("et1 ");
528 atalk_print(ndo, p, length);
529 return (1);
530
531 case ETHERTYPE_AARP:
532 aarp_print(ndo, p, length);
533 return (1);
534
535 case ETHERTYPE_IPX:
536 ND_PRINT("(NOV-ETHII) ");
537 ipx_print(ndo, p, length);
538 return (1);
539
540 case ETHERTYPE_ISO:
541 if (length == 0 || caplen == 0) {
542 ndo->ndo_protocol = "isoclns";
543 nd_print_trunc(ndo);
544 return (1);
545 }
546 isoclns_print(ndo, p + 1, length - 1);
547 return(1);
548
549 case ETHERTYPE_PPPOED:
550 case ETHERTYPE_PPPOES:
551 case ETHERTYPE_PPPOED2:
552 case ETHERTYPE_PPPOES2:
553 pppoe_print(ndo, p, length);
554 return (1);
555
556 case ETHERTYPE_EAPOL:
557 eap_print(ndo, p, length);
558 return (1);
559
560 case ETHERTYPE_RRCP:
561 rrcp_print(ndo, p, length, src, dst);
562 return (1);
563
564 case ETHERTYPE_PPP:
565 if (length) {
566 ND_PRINT(": ");
567 ppp_print(ndo, p, length);
568 }
569 return (1);
570
571 case ETHERTYPE_MPCP:
572 mpcp_print(ndo, p, length);
573 return (1);
574
575 case ETHERTYPE_SLOW:
576 slow_print(ndo, p, length);
577 return (1);
578
579 case ETHERTYPE_CFM:
580 case ETHERTYPE_CFM_OLD:
581 cfm_print(ndo, p, length);
582 return (1);
583
584 case ETHERTYPE_LLDP:
585 lldp_print(ndo, p, length);
586 return (1);
587
588 case ETHERTYPE_NSH:
589 nsh_print(ndo, p, length);
590 return (1);
591
592 case ETHERTYPE_LOOPBACK:
593 loopback_print(ndo, p, length);
594 return (1);
595
596 case ETHERTYPE_MPLS:
597 case ETHERTYPE_MPLS_MULTI:
598 mpls_print(ndo, p, length);
599 return (1);
600
601 case ETHERTYPE_TIPC:
602 tipc_print(ndo, p, length, caplen);
603 return (1);
604
605 case ETHERTYPE_MS_NLB_HB:
606 msnlb_print(ndo, p);
607 return (1);
608
609 case ETHERTYPE_GEONET_OLD:
610 case ETHERTYPE_GEONET:
611 geonet_print(ndo, p, length, src);
612 return (1);
613
614 case ETHERTYPE_CALM_FAST:
615 calm_fast_print(ndo, p, length, src);
616 return (1);
617
618 case ETHERTYPE_AOE:
619 aoe_print(ndo, p, length);
620 return (1);
621
622 case ETHERTYPE_PTP:
623 ptp_print(ndo, p, length);
624 return (1);
625
626 case ETHERTYPE_LAT:
627 case ETHERTYPE_SCA:
628 case ETHERTYPE_MOPRC:
629 case ETHERTYPE_MOPDL:
630 case ETHERTYPE_IEEE1905_1:
631 /* default_print for now */
632 default:
633 return (0);
634 }
635 }