]> The Tcpdump Group git mirrors - tcpdump/blob - print-sll.c
projects / tcpdump / blob


a86bacef6cd21a776f7283c7820192b15293c761
[tcpdump] / print-sll.c
1 /*
2 * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997
3 * The Regents of the University of California. All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
16 * written permission.
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
20 */
21
22 /* \summary: Linux cooked sockets capture printer */
23
24 #include <config.h>
25
26 #ifdef __linux__
27 #include <net/if.h>
28 #endif
29
30 #include "netdissect-stdinc.h"
31
32 #define ND_LONGJMP_FROM_TCHECK
33 #include "netdissect.h"
34 #include "addrtoname.h"
35 #include "ethertype.h"
36 #include "extract.h"
37
38 /*
39 * For captures on Linux cooked sockets, we construct a fake header
40 * that includes:
41 *
42 * a 2-byte "packet type" which is one of:
43 *
44 * LINUX_SLL_HOST packet was sent to us
45 * LINUX_SLL_BROADCAST packet was broadcast
46 * LINUX_SLL_MULTICAST packet was multicast
47 * LINUX_SLL_OTHERHOST packet was sent to somebody else
48 * LINUX_SLL_OUTGOING packet was sent *by* us;
49 *
50 * a 2-byte Ethernet protocol field;
51 *
52 * a 2-byte link-layer type;
53 *
54 * a 2-byte link-layer address length;
55 *
56 * an 8-byte source link-layer address, whose actual length is
57 * specified by the previous value.
58 *
59 * All fields except for the link-layer address are in network byte order.
60 *
61 * DO NOT change the layout of this structure, or change any of the
62 * LINUX_SLL_ values below. If you must change the link-layer header
63 * for a "cooked" Linux capture, introduce a new DLT_ type (ask
64 * "tcpdump-workers@lists.tcpdump.org" for one, so that you don't give it
65 * a value that collides with a value already being used), and use the
66 * new header in captures of that type, so that programs that can
67 * handle DLT_LINUX_SLL captures will continue to handle them correctly
68 * without any change, and so that capture files with different headers
69 * can be told apart and programs that read them can dissect the
70 * packets in them.
71 *
72 * This structure, and the #defines below, must be the same in the
73 * libpcap and tcpdump versions of "sll.h".
74 */
75
76 /*
77 * A DLT_LINUX_SLL fake link-layer header.
78 */
79 #define SLL_HDR_LEN 16 /* total header length */
80 #define SLL_ADDRLEN 8 /* length of address field */
81
82 struct sll_header {
83 nd_uint16_t sll_pkttype; /* packet type */
84 nd_uint16_t sll_hatype; /* link-layer address type */
85 nd_uint16_t sll_halen; /* link-layer address length */
86 nd_byte sll_addr[SLL_ADDRLEN]; /* link-layer address */
87 nd_uint16_t sll_protocol; /* protocol */
88 };
89
90 /*
91 * A DLT_LINUX_SLL2 fake link-layer header.
92 */
93 #define SLL2_HDR_LEN 20 /* total header length */
94
95 struct sll2_header {
96 nd_uint16_t sll2_protocol; /* protocol */
97 nd_uint16_t sll2_reserved_mbz; /* reserved - must be zero */
98 nd_uint32_t sll2_if_index; /* 1-based interface index */
99 nd_uint16_t sll2_hatype; /* link-layer address type */
100 nd_uint8_t sll2_pkttype; /* packet type */
101 nd_uint8_t sll2_halen; /* link-layer address length */
102 nd_byte sll2_addr[SLL_ADDRLEN]; /* link-layer address */
103 };
104
105 /*
106 * The LINUX_SLL_ values for "sll_pkttype"; these correspond to the
107 * PACKET_ values on Linux, but are defined here so that they're
108 * available even on systems other than Linux, and so that they
109 * don't change even if the PACKET_ values change.
110 */
111 #define LINUX_SLL_HOST 0
112 #define LINUX_SLL_BROADCAST 1
113 #define LINUX_SLL_MULTICAST 2
114 #define LINUX_SLL_OTHERHOST 3
115 #define LINUX_SLL_OUTGOING 4
116
117 /*
118 * The LINUX_SLL_ values for "sll_protocol"; these correspond to the
119 * ETH_P_ values on Linux, but are defined here so that they're
120 * available even on systems other than Linux. We assume, for now,
121 * that the ETH_P_ values won't change in Linux; if they do, then:
122 *
123 * if we don't translate them in "pcap-linux.c", capture files
124 * won't necessarily be readable if captured on a system that
125 * defines ETH_P_ values that don't match these values;
126 *
127 * if we do translate them in "pcap-linux.c", that makes life
128 * unpleasant for the BPF code generator, as the values you test
129 * for in the kernel aren't the values that you test for when
130 * reading a capture file, so the fixup code run on BPF programs
131 * handed to the kernel ends up having to do more work.
132 *
133 * Add other values here as necessary, for handling packet types that
134 * might show up on non-Ethernet, non-802.x networks. (Not all the ones
135 * in the Linux "if_ether.h" will, I suspect, actually show up in
136 * captures.)
137 */
138 #define LINUX_SLL_P_802_3 0x0001 /* Novell 802.3 frames without 802.2 LLC header */
139 #define LINUX_SLL_P_802_2 0x0004 /* 802.2 frames (not D/I/X Ethernet) */
140
141 static const struct tok sll_pkttype_values[] = {
142 { LINUX_SLL_HOST, "In" },
143 { LINUX_SLL_BROADCAST, "B" },
144 { LINUX_SLL_MULTICAST, "M" },
145 { LINUX_SLL_OTHERHOST, "P" },
146 { LINUX_SLL_OUTGOING, "Out" },
147 { 0, NULL}
148 };
149
150 static void
151 sll_print(netdissect_options *ndo, const struct sll_header *sllp, u_int length)
152 {
153 u_short ether_type;
154
155 ndo->ndo_protocol = "sll";
156 ND_PRINT("%3s ",
157 tok2str(sll_pkttype_values,"?",GET_BE_U_2(sllp->sll_pkttype)));
158
159 /*
160 * XXX - check the link-layer address type value?
161 * For now, we just assume 6 means Ethernet.
162 * XXX - print others as strings of hex?
163 */
164 if (GET_BE_U_2(sllp->sll_halen) == MAC48_LEN)
165 ND_PRINT("%s ", GET_MAC48_STRING(sllp->sll_addr));
166
167 if (!ndo->ndo_qflag) {
168 ether_type = GET_BE_U_2(sllp->sll_protocol);
169
170 if (ether_type <= MAX_ETHERNET_LENGTH_VAL) {
171 /*
172 * Not an Ethernet type; what type is it?
173 */
174 switch (ether_type) {
175
176 case LINUX_SLL_P_802_3:
177 /*
178 * Ethernet_802.3 IPX frame.
179 */
180 ND_PRINT("802.3");
181 break;
182
183 case LINUX_SLL_P_802_2:
184 /*
185 * 802.2.
186 */
187 ND_PRINT("802.2");
188 break;
189
190 default:
191 /*
192 * What is it?
193 */
194 ND_PRINT("ethertype Unknown (0x%04x)",
195 ether_type);
196 break;
197 }
198 } else {
199 ND_PRINT("ethertype %s (0x%04x)",
200 tok2str(ethertype_values, "Unknown", ether_type),
201 ether_type);
202 }
203 ND_PRINT(", length %u: ", length);
204 }
205 }
206
207 /*
208 * This is the top level routine of the printer. 'p' points to the
209 * Linux "cooked capture" header of the packet, 'h->ts' is the timestamp,
210 * 'h->len' is the length of the packet off the wire, and 'h->caplen'
211 * is the number of bytes actually captured.
212 */
213 void
214 sll_if_print(netdissect_options *ndo, const struct pcap_pkthdr *h, const u_char *p)
215 {
216 u_int caplen = h->caplen;
217 u_int length = h->len;
218 const struct sll_header *sllp;
219 u_short hatype;
220 u_short ether_type;
221 int llc_hdrlen;
222 u_int hdrlen;
223
224 ndo->ndo_protocol = "sll";
225 ND_TCHECK_LEN(p, SLL_HDR_LEN);
226
227 sllp = (const struct sll_header *)p;
228
229 if (ndo->ndo_eflag)
230 sll_print(ndo, sllp, length);
231
232 /*
233 * Go past the cooked-mode header.
234 */
235 length -= SLL_HDR_LEN;
236 caplen -= SLL_HDR_LEN;
237 p += SLL_HDR_LEN;
238 hdrlen = SLL_HDR_LEN;
239
240 hatype = GET_BE_U_2(sllp->sll_hatype);
241 switch (hatype) {
242
243 case 803:
244 /*
245 * This is an packet with a radiotap header;
246 * just dissect the payload as such.
247 */
248 ndo->ndo_ll_hdr_len += SLL_HDR_LEN;
249 ndo->ndo_ll_hdr_len += ieee802_11_radio_print(ndo, p, length, caplen);
250 return;
251 }
252 ether_type = GET_BE_U_2(sllp->sll_protocol);
253
254 recurse:
255 /*
256 * Is it (gag) an 802.3 encapsulation, or some non-Ethernet
257 * packet type?
258 */
259 if (ether_type <= MAX_ETHERNET_LENGTH_VAL) {
260 /*
261 * Yes - what type is it?
262 */
263 switch (ether_type) {
264
265 case LINUX_SLL_P_802_3:
266 /*
267 * Ethernet_802.3 IPX frame.
268 */
269 ipx_print(ndo, p, length);
270 break;
271
272 case LINUX_SLL_P_802_2:
273 /*
274 * 802.2.
275 * Try to print the LLC-layer header & higher layers.
276 */
277 llc_hdrlen = llc_print(ndo, p, length, caplen, NULL, NULL);
278 if (llc_hdrlen < 0)
279 goto unknown; /* unknown LLC type */
280 hdrlen += llc_hdrlen;
281 break;
282
283 default:
284 /*FALLTHROUGH*/
285
286 unknown:
287 /* packet type not known, print raw packet */
288 if (!ndo->ndo_suppress_default_print)
289 ND_DEFAULTPRINT(p, caplen);
290 break;
291 }
292 } else if (ether_type == ETHERTYPE_8021Q) {
293 /*
294 * Print VLAN information, and then go back and process
295 * the enclosed type field.
296 */
297 if (caplen < 4) {
298 ndo->ndo_protocol = "vlan";
299 nd_print_trunc(ndo);
300 ndo->ndo_ll_hdr_len += hdrlen + caplen;
301 return;
302 }
303 if (ndo->ndo_eflag) {
304 uint16_t tag = GET_BE_U_2(p);
305
306 ND_PRINT("%s, ", ieee8021q_tci_string(tag));
307 }
308
309 ether_type = GET_BE_U_2(p + 2);
310 if (ether_type <= MAX_ETHERNET_LENGTH_VAL)
311 ether_type = LINUX_SLL_P_802_2;
312 if (!ndo->ndo_qflag) {
313 ND_PRINT("ethertype %s, ",
314 tok2str(ethertype_values, "Unknown", ether_type));
315 }
316 p += 4;
317 length -= 4;
318 caplen -= 4;
319 hdrlen += 4;
320 goto recurse;
321 } else {
322 if (ethertype_print(ndo, ether_type, p, length, caplen, NULL, NULL) == 0) {
323 /* ether_type not known, print raw packet */
324 if (!ndo->ndo_eflag)
325 sll_print(ndo, sllp, length + SLL_HDR_LEN);
326 if (!ndo->ndo_suppress_default_print)
327 ND_DEFAULTPRINT(p, caplen);
328 }
329 }
330
331 ndo->ndo_ll_hdr_len += hdrlen;
332 }
333
334 static void
335 sll2_print(netdissect_options *ndo, const struct sll2_header *sllp, u_int length)
336 {
337 u_short ether_type;
338
339 ndo->ndo_protocol = "sll2";
340 ND_PRINT("ifindex %u ", GET_BE_U_4(sllp->sll2_if_index));
341
342 /*
343 * XXX - check the link-layer address type value?
344 * For now, we just assume 6 means Ethernet.
345 * XXX - print others as strings of hex?
346 */
347 if (GET_U_1(sllp->sll2_halen) == MAC48_LEN)
348 ND_PRINT("%s ", GET_MAC48_STRING(sllp->sll2_addr));
349
350 if (!ndo->ndo_qflag) {
351 ether_type = GET_BE_U_2(sllp->sll2_protocol);
352
353 if (ether_type <= MAX_ETHERNET_LENGTH_VAL) {
354 /*
355 * Not an Ethernet type; what type is it?
356 */
357 switch (ether_type) {
358
359 case LINUX_SLL_P_802_3:
360 /*
361 * Ethernet_802.3 IPX frame.
362 */
363 ND_PRINT("802.3");
364 break;
365
366 case LINUX_SLL_P_802_2:
367 /*
368 * 802.2.
369 */
370 ND_PRINT("802.2");
371 break;
372
373 default:
374 /*
375 * What is it?
376 */
377 ND_PRINT("ethertype Unknown (0x%04x)",
378 ether_type);
379 break;
380 }
381 } else {
382 ND_PRINT("ethertype %s (0x%04x)",
383 tok2str(ethertype_values, "Unknown", ether_type),
384 ether_type);
385 }
386 ND_PRINT(", length %u: ", length);
387 }
388 }
389
390 /*
391 * This is the top level routine of the printer. 'p' points to the
392 * Linux "cooked capture" header of the packet, 'h->ts' is the timestamp,
393 * 'h->len' is the length of the packet off the wire, and 'h->caplen'
394 * is the number of bytes actually captured.
395 */
396 void
397 sll2_if_print(netdissect_options *ndo, const struct pcap_pkthdr *h, const u_char *p)
398 {
399 u_int caplen = h->caplen;
400 u_int length = h->len;
401 const struct sll2_header *sllp;
402 u_short hatype;
403 u_short ether_type;
404 int llc_hdrlen;
405 u_int hdrlen;
406 #ifdef __linux__
407 uint32_t if_index;
408 char ifname[IF_NAMESIZE];
409 #endif
410
411 ndo->ndo_protocol = "sll2";
412 ND_TCHECK_LEN(p, SLL2_HDR_LEN);
413
414 sllp = (const struct sll2_header *)p;
415 #ifdef __linux__
416 if_index = GET_BE_U_4(sllp->sll2_if_index);
417 if (!if_indextoname(if_index, ifname))
418 strncpy(ifname, "?", 2);
419 ND_PRINT("%-5s ", ifname);
420 #endif
421
422 ND_PRINT("%-3s ",
423 tok2str(sll_pkttype_values, "?", GET_U_1(sllp->sll2_pkttype)));
424
425 if (ndo->ndo_eflag)
426 sll2_print(ndo, sllp, length);
427
428 /*
429 * Go past the cooked-mode header.
430 */
431 length -= SLL2_HDR_LEN;
432 caplen -= SLL2_HDR_LEN;
433 p += SLL2_HDR_LEN;
434 hdrlen = SLL2_HDR_LEN;
435
436 hatype = GET_BE_U_2(sllp->sll2_hatype);
437 switch (hatype) {
438
439 case 803:
440 /*
441 * This is an packet with a radiotap header;
442 * just dissect the payload as such.
443 */
444 ndo->ndo_ll_hdr_len += SLL2_HDR_LEN;
445 ndo->ndo_ll_hdr_len += ieee802_11_radio_print(ndo, p, length, caplen);
446 return;
447 }
448 ether_type = GET_BE_U_2(sllp->sll2_protocol);
449
450 recurse:
451 /*
452 * Is it (gag) an 802.3 encapsulation, or some non-Ethernet
453 * packet type?
454 */
455 if (ether_type <= MAX_ETHERNET_LENGTH_VAL) {
456 /*
457 * Yes - what type is it?
458 */
459 switch (ether_type) {
460
461 case LINUX_SLL_P_802_3:
462 /*
463 * Ethernet_802.3 IPX frame.
464 */
465 ipx_print(ndo, p, length);
466 break;
467
468 case LINUX_SLL_P_802_2:
469 /*
470 * 802.2.
471 * Try to print the LLC-layer header & higher layers.
472 */
473 llc_hdrlen = llc_print(ndo, p, length, caplen, NULL, NULL);
474 if (llc_hdrlen < 0)
475 goto unknown; /* unknown LLC type */
476 hdrlen += llc_hdrlen;
477 break;
478
479 default:
480 /*FALLTHROUGH*/
481
482 unknown:
483 /* packet type not known, print raw packet */
484 if (!ndo->ndo_suppress_default_print)
485 ND_DEFAULTPRINT(p, caplen);
486 break;
487 }
488 } else if (ether_type == ETHERTYPE_8021Q) {
489 /*
490 * Print VLAN information, and then go back and process
491 * the enclosed type field.
492 */
493 if (caplen < 4) {
494 ndo->ndo_protocol = "vlan";
495 nd_print_trunc(ndo);
496 ndo->ndo_ll_hdr_len += hdrlen + caplen;
497 return;
498 }
499 if (ndo->ndo_eflag) {
500 uint16_t tag = GET_BE_U_2(p);
501
502 ND_PRINT("%s, ", ieee8021q_tci_string(tag));
503 }
504
505 ether_type = GET_BE_U_2(p + 2);
506 if (ether_type <= MAX_ETHERNET_LENGTH_VAL)
507 ether_type = LINUX_SLL_P_802_2;
508 if (!ndo->ndo_qflag) {
509 ND_PRINT("ethertype %s, ",
510 tok2str(ethertype_values, "Unknown", ether_type));
511 }
512 p += 4;
513 length -= 4;
514 caplen -= 4;
515 hdrlen += 4;
516 goto recurse;
517 } else {
518 if (ethertype_print(ndo, ether_type, p, length, caplen, NULL, NULL) == 0) {
519 /* ether_type not known, print raw packet */
520 if (!ndo->ndo_eflag)
521 sll2_print(ndo, sllp, length + SLL2_HDR_LEN);
522 if (!ndo->ndo_suppress_default_print)
523 ND_DEFAULTPRINT(p, caplen);
524 }
525 }
526
527 ndo->ndo_ll_hdr_len += hdrlen;
528 }
[mirror] the TCPdump network dissector