]> The Tcpdump Group git mirrors - tcpdump/blob - print-ether.c
Fix to use the new ND_PRINT().
[tcpdump] / print-ether.c
1 /*
2 * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 2000
3 * The Regents of the University of California. All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
16 * written permission.
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
20 */
21
22 /* \summary: Ethernet printer */
23
24 #ifdef HAVE_CONFIG_H
25 #include <config.h>
26 #endif
27
28 #include "netdissect-stdinc.h"
29
30 #include "netdissect.h"
31 #include "extract.h"
32 #include "addrtoname.h"
33 #include "ethertype.h"
34
35 /*
36 * Structure of an Ethernet header.
37 */
38 struct ether_header {
39 nd_mac_addr ether_dhost;
40 nd_mac_addr ether_shost;
41 nd_uint16_t ether_length_type;
42 };
43
44 /*
45 * Length of an Ethernet header; note that some compilers may pad
46 * "struct ether_header" to a multiple of 4 bytes, for example, so
47 * "sizeof (struct ether_header)" may not give the right answer.
48 */
49 #define ETHER_HDRLEN 14
50
51 const struct tok ethertype_values[] = {
52 { ETHERTYPE_IP, "IPv4" },
53 { ETHERTYPE_MPLS, "MPLS unicast" },
54 { ETHERTYPE_MPLS_MULTI, "MPLS multicast" },
55 { ETHERTYPE_IPV6, "IPv6" },
56 { ETHERTYPE_8021Q, "802.1Q" },
57 { ETHERTYPE_8021Q9100, "802.1Q-9100" },
58 { ETHERTYPE_8021QinQ, "802.1Q-QinQ" },
59 { ETHERTYPE_8021Q9200, "802.1Q-9200" },
60 { ETHERTYPE_MACSEC, "802.1AE MACsec" },
61 { ETHERTYPE_VMAN, "VMAN" },
62 { ETHERTYPE_PUP, "PUP" },
63 { ETHERTYPE_ARP, "ARP"},
64 { ETHERTYPE_REVARP, "Reverse ARP"},
65 { ETHERTYPE_NS, "NS" },
66 { ETHERTYPE_SPRITE, "Sprite" },
67 { ETHERTYPE_TRAIL, "Trail" },
68 { ETHERTYPE_MOPDL, "MOP DL" },
69 { ETHERTYPE_MOPRC, "MOP RC" },
70 { ETHERTYPE_DN, "DN" },
71 { ETHERTYPE_LAT, "LAT" },
72 { ETHERTYPE_SCA, "SCA" },
73 { ETHERTYPE_TEB, "TEB" },
74 { ETHERTYPE_LANBRIDGE, "Lanbridge" },
75 { ETHERTYPE_DECDNS, "DEC DNS" },
76 { ETHERTYPE_DECDTS, "DEC DTS" },
77 { ETHERTYPE_VEXP, "VEXP" },
78 { ETHERTYPE_VPROD, "VPROD" },
79 { ETHERTYPE_ATALK, "Appletalk" },
80 { ETHERTYPE_AARP, "Appletalk ARP" },
81 { ETHERTYPE_IPX, "IPX" },
82 { ETHERTYPE_PPP, "PPP" },
83 { ETHERTYPE_MPCP, "MPCP" },
84 { ETHERTYPE_SLOW, "Slow Protocols" },
85 { ETHERTYPE_PPPOED, "PPPoE D" },
86 { ETHERTYPE_PPPOES, "PPPoE S" },
87 { ETHERTYPE_EAPOL, "EAPOL" },
88 { ETHERTYPE_RRCP, "RRCP" },
89 { ETHERTYPE_MS_NLB_HB, "MS NLB heartbeat" },
90 { ETHERTYPE_JUMBO, "Jumbo" },
91 { ETHERTYPE_NSH, "NSH" },
92 { ETHERTYPE_LOOPBACK, "Loopback" },
93 { ETHERTYPE_ISO, "OSI" },
94 { ETHERTYPE_GRE_ISO, "GRE-OSI" },
95 { ETHERTYPE_CFM_OLD, "CFM (old)" },
96 { ETHERTYPE_CFM, "CFM" },
97 { ETHERTYPE_IEEE1905_1, "IEEE1905.1" },
98 { ETHERTYPE_LLDP, "LLDP" },
99 { ETHERTYPE_TIPC, "TIPC"},
100 { ETHERTYPE_GEONET_OLD, "GeoNet (old)"},
101 { ETHERTYPE_GEONET, "GeoNet"},
102 { ETHERTYPE_CALM_FAST, "CALM FAST"},
103 { ETHERTYPE_AOE, "AoE" },
104 { ETHERTYPE_PTP, "PTP" },
105 { ETHERTYPE_ARISTA, "Arista Vendor Specific Protocol" },
106 { 0, NULL}
107 };
108
109 static void
110 ether_addresses_print(netdissect_options *ndo, const u_char *src,
111 const u_char *dst)
112 {
113 ND_PRINT("%s > %s, ",
114 GET_ETHERADDR_STRING(src), GET_ETHERADDR_STRING(dst));
115 }
116
117 static void
118 ether_type_print(netdissect_options *ndo, uint16_t type)
119 {
120 if (!ndo->ndo_qflag)
121 ND_PRINT("ethertype %s (0x%04x)",
122 tok2str(ethertype_values, "Unknown", type), type);
123 else
124 ND_PRINT("%s",
125 tok2str(ethertype_values, "Unknown Ethertype (0x%04x)", type));
126 }
127
128 /*
129 * Common code for printing Ethernet frames.
130 *
131 * It can handle Ethernet headers with extra tag information inserted
132 * after the destination and source addresses, as is inserted by some
133 * switch chips, and extra encapsulation header information before
134 * printing Ethernet header information (such as a LANE ID for ATM LANE).
135 */
136 static u_int
137 ether_common_print(netdissect_options *ndo, const u_char *p, u_int length,
138 u_int caplen,
139 void (*print_switch_tag)(netdissect_options *ndo, const u_char *),
140 u_int switch_tag_len,
141 void (*print_encap_header)(netdissect_options *ndo, const u_char *),
142 const u_char *encap_header_arg)
143 {
144 const struct ether_header *ehp;
145 u_int orig_length;
146 u_int hdrlen;
147 u_short length_type;
148 int printed_length;
149 int llc_hdrlen;
150 struct lladdr_info src, dst;
151
152 if (caplen < ETHER_HDRLEN + switch_tag_len) {
153 nd_print_trunc(ndo);
154 return (caplen);
155 }
156 if (length < ETHER_HDRLEN + switch_tag_len) {
157 nd_print_trunc(ndo);
158 return (length);
159 }
160
161 if (print_encap_header != NULL)
162 (*print_encap_header)(ndo, encap_header_arg);
163
164 orig_length = length;
165
166 /*
167 * Get the source and destination addresses, skip past them,
168 * and print them if we're printing the link-layer header.
169 */
170 ehp = (const struct ether_header *)p;
171 src.addr = ehp->ether_shost;
172 src.addr_string = etheraddr_string;
173 dst.addr = ehp->ether_dhost;
174 dst.addr_string = etheraddr_string;
175
176 length -= 2*MAC_ADDR_LEN;
177 caplen -= 2*MAC_ADDR_LEN;
178 p += 2*MAC_ADDR_LEN;
179 hdrlen = 2*MAC_ADDR_LEN;
180
181 if (ndo->ndo_eflag)
182 ether_addresses_print(ndo, src.addr, dst.addr);
183
184 /*
185 * Print the switch tag, if we have one, and skip past it.
186 */
187 if (print_switch_tag != NULL)
188 (*print_switch_tag)(ndo, p);
189
190 length -= switch_tag_len;
191 caplen -= switch_tag_len;
192 p += switch_tag_len;
193 hdrlen += switch_tag_len;
194
195 /*
196 * Get the length/type field, skip past it, and print it
197 * if we're printing the link-layer header.
198 */
199 recurse:
200 length_type = GET_BE_U_2(p);
201
202 length -= 2;
203 caplen -= 2;
204 p += 2;
205 hdrlen += 2;
206
207 if (length_type == ETHERTYPE_MACSEC) {
208 /*
209 * MACsec, aka IEEE 802.1AE-2006
210 * Print the header, and try to print the payload if it's not encrypted
211 */
212 int ret = macsec_print(ndo, &p, &length, &caplen, &hdrlen, &length_type);
213
214 if (ret == 0)
215 goto raw;
216 else if (ret > 0)
217 return ret;
218 }
219
220 /*
221 * Process VLAN tag types.
222 */
223 printed_length = 0;
224 while (length_type == ETHERTYPE_8021Q ||
225 length_type == ETHERTYPE_8021Q9100 ||
226 length_type == ETHERTYPE_8021Q9200 ||
227 length_type == ETHERTYPE_8021QinQ) {
228 /*
229 * It has a VLAN tag.
230 * Print VLAN information, and then go back and process
231 * the enclosed type field.
232 */
233 if (caplen < 4) {
234 ndo->ndo_protocol = "vlan";
235 nd_print_trunc(ndo);
236 return (hdrlen + caplen);
237 }
238 if (length < 4) {
239 ndo->ndo_protocol = "vlan";
240 nd_print_trunc(ndo);
241 return (hdrlen + length);
242 }
243 if (ndo->ndo_eflag) {
244 uint16_t tag = GET_BE_U_2(p);
245
246 ether_type_print(ndo, length_type);
247 if (!printed_length) {
248 ND_PRINT(", length %u: ", orig_length);
249 printed_length = 1;
250 } else
251 ND_PRINT(", ");
252 ND_PRINT("%s, ", ieee8021q_tci_string(tag));
253 }
254
255 length_type = GET_BE_U_2(p + 2);
256 p += 4;
257 length -= 4;
258 caplen -= 4;
259 hdrlen += 4;
260 }
261
262 /*
263 * We now have the final length/type field.
264 */
265 if (length_type <= MAX_ETHERNET_LENGTH_VAL) {
266 /*
267 * It's a length field, containing the length of the
268 * remaining payload; use it as such, as long as
269 * it's not too large (bigger than the actual payload).
270 */
271 if (length_type < length) {
272 length = length_type;
273 if (caplen > length)
274 caplen = length;
275 }
276
277 /*
278 * Cut off the snapshot length to the end of the
279 * payload.
280 */
281 nd_push_snapend(ndo, p + length);
282
283 if (ndo->ndo_eflag) {
284 ND_PRINT("802.3");
285 if (!printed_length)
286 ND_PRINT(", length %u: ", length);
287 }
288
289 /*
290 * An LLC header follows the length. Print that and
291 * higher layers.
292 */
293 llc_hdrlen = llc_print(ndo, p, length, caplen, &src, &dst);
294 if (llc_hdrlen < 0) {
295 /* packet type not known, print raw packet */
296 if (!ndo->ndo_suppress_default_print)
297 ND_DEFAULTPRINT(p, caplen);
298 llc_hdrlen = -llc_hdrlen;
299 }
300 hdrlen += llc_hdrlen;
301 nd_pop_packet_info(ndo);
302 } else if (length_type == ETHERTYPE_JUMBO) {
303 /*
304 * It's a type field, with the type for Alteon jumbo frames.
305 * See
306 *
307 * https://tools.ietf.org/html/draft-ietf-isis-ext-eth-01
308 *
309 * which indicates that, following the type field,
310 * there's an LLC header and payload.
311 */
312 /* Try to print the LLC-layer header & higher layers */
313 llc_hdrlen = llc_print(ndo, p, length, caplen, &src, &dst);
314 if (llc_hdrlen < 0) {
315 /* packet type not known, print raw packet */
316 if (!ndo->ndo_suppress_default_print)
317 ND_DEFAULTPRINT(p, caplen);
318 llc_hdrlen = -llc_hdrlen;
319 }
320 hdrlen += llc_hdrlen;
321 } else if (length_type == ETHERTYPE_ARISTA) {
322 if (caplen < 2) {
323 ND_PRINT("[|arista]");
324 return (hdrlen + caplen);
325 }
326 if (length < 2) {
327 ND_PRINT("[|arista]");
328 return (hdrlen + length);
329 }
330 ether_type_print(ndo, length_type);
331 ND_PRINT(", length %u: ", orig_length);
332 int bytesConsumed = arista_ethertype_print(ndo, p, length);
333 if (bytesConsumed > 0) {
334 p += bytesConsumed;
335 length -= bytesConsumed;
336 caplen -= bytesConsumed;
337 hdrlen += bytesConsumed;
338 goto recurse;
339 } else {
340 /* subtype/version not known, print raw packet */
341 if (!ndo->ndo_eflag && length_type > MAX_ETHERNET_LENGTH_VAL) {
342 ether_addresses_print(ndo, src.addr, dst.addr);
343 ether_type_print(ndo, length_type);
344 ND_PRINT(", length %u: ", orig_length);
345 }
346 if (!ndo->ndo_suppress_default_print)
347 ND_DEFAULTPRINT(p, caplen);
348 }
349 } else {
350 /*
351 * It's a type field with some other value.
352 */
353 if (ndo->ndo_eflag) {
354 ether_type_print(ndo, length_type);
355 if (!printed_length)
356 ND_PRINT(", length %u: ", orig_length);
357 else
358 ND_PRINT(", ");
359 }
360 if (ethertype_print(ndo, length_type, p, length, caplen, &src, &dst) == 0) {
361 raw:
362 /* type not known, print raw packet */
363 if (!ndo->ndo_eflag) {
364 /*
365 * We didn't print the full link-layer
366 * header, as -e wasn't specified, so
367 * print only the source and destination
368 * MAC addresses and the final Ethernet
369 * type.
370 */
371 ether_addresses_print(ndo, src.addr, dst.addr);
372 ether_type_print(ndo, length_type);
373 ND_PRINT(", length %u: ", orig_length);
374 }
375
376 if (!ndo->ndo_suppress_default_print)
377 ND_DEFAULTPRINT(p, caplen);
378 }
379 }
380 return (hdrlen);
381 }
382
383 /*
384 * Print an Ethernet frame while specyfing a non-standard Ethernet header
385 * length.
386 * This might be encapsulated within another frame; we might be passed
387 * a pointer to a function that can print header information for that
388 * frame's protocol, and an argument to pass to that function.
389 *
390 * FIXME: caplen can and should be derived from ndo->ndo_snapend and p.
391 */
392 u_int
393 ether_switch_tag_print(netdissect_options *ndo, const u_char *p, u_int length,
394 u_int caplen,
395 void (*print_switch_tag)(netdissect_options *, const u_char *),
396 u_int switch_tag_len)
397 {
398 return (ether_common_print(ndo, p, length, caplen, print_switch_tag,
399 switch_tag_len, NULL, NULL));
400 }
401
402 /*
403 * Print an Ethernet frame.
404 * This might be encapsulated within another frame; we might be passed
405 * a pointer to a function that can print header information for that
406 * frame's protocol, and an argument to pass to that function.
407 *
408 * FIXME: caplen can and should be derived from ndo->ndo_snapend and p.
409 */
410 u_int
411 ether_print(netdissect_options *ndo,
412 const u_char *p, u_int length, u_int caplen,
413 void (*print_encap_header)(netdissect_options *ndo, const u_char *),
414 const u_char *encap_header_arg)
415 {
416 ndo->ndo_protocol = "ether";
417 return (ether_common_print(ndo, p, length, caplen, NULL, 0,
418 print_encap_header, encap_header_arg));
419 }
420
421 /*
422 * This is the top level routine of the printer. 'p' points
423 * to the ether header of the packet, 'h->len' is the length
424 * of the packet off the wire, and 'h->caplen' is the number
425 * of bytes actually captured.
426 */
427 u_int
428 ether_if_print(netdissect_options *ndo, const struct pcap_pkthdr *h,
429 const u_char *p)
430 {
431 ndo->ndo_protocol = "ether_if";
432 return (ether_print(ndo, p, h->len, h->caplen, NULL, NULL));
433 }
434
435 /*
436 * This is the top level routine of the printer. 'p' points
437 * to the ether header of the packet, 'h->len' is the length
438 * of the packet off the wire, and 'h->caplen' is the number
439 * of bytes actually captured.
440 *
441 * This is for DLT_NETANALYZER, which has a 4-byte pseudo-header
442 * before the Ethernet header.
443 */
444 u_int
445 netanalyzer_if_print(netdissect_options *ndo, const struct pcap_pkthdr *h,
446 const u_char *p)
447 {
448 /*
449 * Fail if we don't have enough data for the Hilscher pseudo-header.
450 */
451 ndo->ndo_protocol = "netanalyzer_if";
452 if (h->caplen < 4) {
453 nd_print_trunc(ndo);
454 return (h->caplen);
455 }
456
457 /* Skip the pseudo-header. */
458 return (4 + ether_print(ndo, p + 4, h->len - 4, h->caplen - 4, NULL, NULL));
459 }
460
461 /*
462 * This is the top level routine of the printer. 'p' points
463 * to the ether header of the packet, 'h->len' is the length
464 * of the packet off the wire, and 'h->caplen' is the number
465 * of bytes actually captured.
466 *
467 * This is for DLT_NETANALYZER_TRANSPARENT, which has a 4-byte
468 * pseudo-header, a 7-byte Ethernet preamble, and a 1-byte Ethernet SOF
469 * before the Ethernet header.
470 */
471 u_int
472 netanalyzer_transparent_if_print(netdissect_options *ndo,
473 const struct pcap_pkthdr *h,
474 const u_char *p)
475 {
476 /*
477 * Fail if we don't have enough data for the Hilscher pseudo-header,
478 * preamble, and SOF.
479 */
480 ndo->ndo_protocol = "netanalyzer_transparent_if";
481 if (h->caplen < 12) {
482 nd_print_trunc(ndo);
483 return (h->caplen);
484 }
485
486 /* Skip the pseudo-header, preamble, and SOF. */
487 return (12 + ether_print(ndo, p + 12, h->len - 12, h->caplen - 12, NULL, NULL));
488 }
489
490 /*
491 * Prints the packet payload, given an Ethernet type code for the payload's
492 * protocol.
493 *
494 * Returns non-zero if it can do so, zero if the ethertype is unknown.
495 */
496
497 int
498 ethertype_print(netdissect_options *ndo,
499 u_short ether_type, const u_char *p,
500 u_int length, u_int caplen,
501 const struct lladdr_info *src, const struct lladdr_info *dst)
502 {
503 switch (ether_type) {
504
505 case ETHERTYPE_IP:
506 ip_print(ndo, p, length);
507 return (1);
508
509 case ETHERTYPE_IPV6:
510 ip6_print(ndo, p, length);
511 return (1);
512
513 case ETHERTYPE_ARP:
514 case ETHERTYPE_REVARP:
515 arp_print(ndo, p, length, caplen);
516 return (1);
517
518 case ETHERTYPE_DN:
519 decnet_print(ndo, p, length, caplen);
520 return (1);
521
522 case ETHERTYPE_ATALK:
523 if (ndo->ndo_vflag)
524 ND_PRINT("et1 ");
525 atalk_print(ndo, p, length);
526 return (1);
527
528 case ETHERTYPE_AARP:
529 aarp_print(ndo, p, length);
530 return (1);
531
532 case ETHERTYPE_IPX:
533 ND_PRINT("(NOV-ETHII) ");
534 ipx_print(ndo, p, length);
535 return (1);
536
537 case ETHERTYPE_ISO:
538 if (length == 0 || caplen == 0) {
539 ndo->ndo_protocol = "isoclns";
540 nd_print_trunc(ndo);
541 return (1);
542 }
543 isoclns_print(ndo, p + 1, length - 1);
544 return(1);
545
546 case ETHERTYPE_PPPOED:
547 case ETHERTYPE_PPPOES:
548 case ETHERTYPE_PPPOED2:
549 case ETHERTYPE_PPPOES2:
550 pppoe_print(ndo, p, length);
551 return (1);
552
553 case ETHERTYPE_EAPOL:
554 eap_print(ndo, p, length);
555 return (1);
556
557 case ETHERTYPE_RRCP:
558 rrcp_print(ndo, p, length, src, dst);
559 return (1);
560
561 case ETHERTYPE_PPP:
562 if (length) {
563 ND_PRINT(": ");
564 ppp_print(ndo, p, length);
565 }
566 return (1);
567
568 case ETHERTYPE_MPCP:
569 mpcp_print(ndo, p, length);
570 return (1);
571
572 case ETHERTYPE_SLOW:
573 slow_print(ndo, p, length);
574 return (1);
575
576 case ETHERTYPE_CFM:
577 case ETHERTYPE_CFM_OLD:
578 cfm_print(ndo, p, length);
579 return (1);
580
581 case ETHERTYPE_LLDP:
582 lldp_print(ndo, p, length);
583 return (1);
584
585 case ETHERTYPE_NSH:
586 nsh_print(ndo, p, length);
587 return (1);
588
589 case ETHERTYPE_LOOPBACK:
590 loopback_print(ndo, p, length);
591 return (1);
592
593 case ETHERTYPE_MPLS:
594 case ETHERTYPE_MPLS_MULTI:
595 mpls_print(ndo, p, length);
596 return (1);
597
598 case ETHERTYPE_TIPC:
599 tipc_print(ndo, p, length, caplen);
600 return (1);
601
602 case ETHERTYPE_MS_NLB_HB:
603 msnlb_print(ndo, p);
604 return (1);
605
606 case ETHERTYPE_GEONET_OLD:
607 case ETHERTYPE_GEONET:
608 geonet_print(ndo, p, length, src);
609 return (1);
610
611 case ETHERTYPE_CALM_FAST:
612 calm_fast_print(ndo, p, length, src);
613 return (1);
614
615 case ETHERTYPE_AOE:
616 aoe_print(ndo, p, length);
617 return (1);
618
619 case ETHERTYPE_PTP:
620 ptp_print(ndo, p, length);
621 return (1);
622
623 case ETHERTYPE_LAT:
624 case ETHERTYPE_SCA:
625 case ETHERTYPE_MOPRC:
626 case ETHERTYPE_MOPDL:
627 case ETHERTYPE_IEEE1905_1:
628 /* default_print for now */
629 default:
630 return (0);
631 }
632 }