]> The Tcpdump Group git mirrors - tcpdump/blob - print-sll.c
projects / tcpdump / blob
summary | shortlog | log | commit | commitdiff | tree
history | raw | HEAD
Fix spaces
[tcpdump] / print-sll.c
1 /*
2 * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997
3 * The Regents of the University of California. All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
16 * written permission.
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
20 */
21
22 /* \summary: Linux cooked sockets capture printer */
23
24 #ifdef HAVE_CONFIG_H
25 #include <config.h>
26 #endif
27
28 #ifdef HAVE_NET_IF_H
29 #include <net/if.h>
30 #endif
31
32 #include "netdissect-stdinc.h"
33
34 #include "netdissect.h"
35 #include "addrtoname.h"
36 #include "ethertype.h"
37 #include "extract.h"
38
39 /*
40 * For captures on Linux cooked sockets, we construct a fake header
41 * that includes:
42 *
43 * a 2-byte "packet type" which is one of:
44 *
45 * LINUX_SLL_HOST packet was sent to us
46 * LINUX_SLL_BROADCAST packet was broadcast
47 * LINUX_SLL_MULTICAST packet was multicast
48 * LINUX_SLL_OTHERHOST packet was sent to somebody else
49 * LINUX_SLL_OUTGOING packet was sent *by* us;
50 *
51 * a 2-byte Ethernet protocol field;
52 *
53 * a 2-byte link-layer type;
54 *
55 * a 2-byte link-layer address length;
56 *
57 * an 8-byte source link-layer address, whose actual length is
58 * specified by the previous value.
59 *
60 * All fields except for the link-layer address are in network byte order.
61 *
62 * DO NOT change the layout of this structure, or change any of the
63 * LINUX_SLL_ values below. If you must change the link-layer header
64 * for a "cooked" Linux capture, introduce a new DLT_ type (ask
65 * "tcpdump-workers@lists.tcpdump.org" for one, so that you don't give it
66 * a value that collides with a value already being used), and use the
67 * new header in captures of that type, so that programs that can
68 * handle DLT_LINUX_SLL captures will continue to handle them correctly
69 * without any change, and so that capture files with different headers
70 * can be told apart and programs that read them can dissect the
71 * packets in them.
72 *
73 * This structure, and the #defines below, must be the same in the
74 * libpcap and tcpdump versions of "sll.h".
75 */
76
77 /*
78 * A DLT_LINUX_SLL fake link-layer header.
79 */
80 #define SLL_HDR_LEN 16 /* total header length */
81 #define SLL_ADDRLEN 8 /* length of address field */
82
83 struct sll_header {
84 nd_uint16_t sll_pkttype; /* packet type */
85 nd_uint16_t sll_hatype; /* link-layer address type */
86 nd_uint16_t sll_halen; /* link-layer address length */
87 nd_byte sll_addr[SLL_ADDRLEN]; /* link-layer address */
88 nd_uint16_t sll_protocol; /* protocol */
89 };
90
91 /*
92 * A DLT_LINUX_SLL2 fake link-layer header.
93 */
94 #define SLL2_HDR_LEN 20 /* total header length */
95
96 struct sll2_header {
97 nd_uint16_t sll2_protocol; /* protocol */
98 nd_uint16_t sll2_reserved_mbz; /* reserved - must be zero */
99 nd_uint32_t sll2_if_index; /* 1-based interface index */
100 nd_uint16_t sll2_hatype; /* link-layer address type */
101 nd_uint8_t sll2_pkttype; /* packet type */
102 nd_uint8_t sll2_halen; /* link-layer address length */
103 nd_byte sll2_addr[SLL_ADDRLEN]; /* link-layer address */
104 };
105
106 /*
107 * The LINUX_SLL_ values for "sll_pkttype"; these correspond to the
108 * PACKET_ values on Linux, but are defined here so that they're
109 * available even on systems other than Linux, and so that they
110 * don't change even if the PACKET_ values change.
111 */
112 #define LINUX_SLL_HOST 0
113 #define LINUX_SLL_BROADCAST 1
114 #define LINUX_SLL_MULTICAST 2
115 #define LINUX_SLL_OTHERHOST 3
116 #define LINUX_SLL_OUTGOING 4
117
118 /*
119 * The LINUX_SLL_ values for "sll_protocol"; these correspond to the
120 * ETH_P_ values on Linux, but are defined here so that they're
121 * available even on systems other than Linux. We assume, for now,
122 * that the ETH_P_ values won't change in Linux; if they do, then:
123 *
124 * if we don't translate them in "pcap-linux.c", capture files
125 * won't necessarily be readable if captured on a system that
126 * defines ETH_P_ values that don't match these values;
127 *
128 * if we do translate them in "pcap-linux.c", that makes life
129 * unpleasant for the BPF code generator, as the values you test
130 * for in the kernel aren't the values that you test for when
131 * reading a capture file, so the fixup code run on BPF programs
132 * handed to the kernel ends up having to do more work.
133 *
134 * Add other values here as necessary, for handling packet types that
135 * might show up on non-Ethernet, non-802.x networks. (Not all the ones
136 * in the Linux "if_ether.h" will, I suspect, actually show up in
137 * captures.)
138 */
139 #define LINUX_SLL_P_802_3 0x0001 /* Novell 802.3 frames without 802.2 LLC header */
140 #define LINUX_SLL_P_802_2 0x0004 /* 802.2 frames (not D/I/X Ethernet) */
141
142 static const struct tok sll_pkttype_values[] = {
143 { LINUX_SLL_HOST, "In" },
144 { LINUX_SLL_BROADCAST, "B" },
145 { LINUX_SLL_MULTICAST, "M" },
146 { LINUX_SLL_OTHERHOST, "P" },
147 { LINUX_SLL_OUTGOING, "Out" },
148 { 0, NULL}
149 };
150
151 static void
152 sll_print(netdissect_options *ndo, const struct sll_header *sllp, u_int length)
153 {
154 u_short ether_type;
155
156 ndo->ndo_protocol = "sll";
157 ND_PRINT("%3s ",tok2str(sll_pkttype_values,"?",EXTRACT_BE_U_2(sllp->sll_pkttype)));
158
159 /*
160 * XXX - check the link-layer address type value?
161 * For now, we just assume 6 means Ethernet.
162 * XXX - print others as strings of hex?
163 */
164 if (EXTRACT_BE_U_2(sllp->sll_halen) == 6)
165 ND_PRINT("%s ", etheraddr_string(ndo, sllp->sll_addr));
166
167 if (!ndo->ndo_qflag) {
168 ether_type = EXTRACT_BE_U_2(sllp->sll_protocol);
169
170 if (ether_type <= MAX_ETHERNET_LENGTH_VAL) {
171 /*
172 * Not an Ethernet type; what type is it?
173 */
174 switch (ether_type) {
175
176 case LINUX_SLL_P_802_3:
177 /*
178 * Ethernet_802.3 IPX frame.
179 */
180 ND_PRINT("802.3");
181 break;
182
183 case LINUX_SLL_P_802_2:
184 /*
185 * 802.2.
186 */
187 ND_PRINT("802.2");
188 break;
189
190 default:
191 /*
192 * What is it?
193 */
194 ND_PRINT("ethertype Unknown (0x%04x)",
195 ether_type);
196 break;
197 }
198 } else {
199 ND_PRINT("ethertype %s (0x%04x)",
200 tok2str(ethertype_values, "Unknown", ether_type),
201 ether_type);
202 }
203 ND_PRINT(", length %u: ", length);
204 }
205 }
206
207 /*
208 * This is the top level routine of the printer. 'p' points to the
209 * Linux "cooked capture" header of the packet, 'h->ts' is the timestamp,
210 * 'h->len' is the length of the packet off the wire, and 'h->caplen'
211 * is the number of bytes actually captured.
212 */
213 u_int
214 sll_if_print(netdissect_options *ndo, const struct pcap_pkthdr *h, const u_char *p)
215 {
216 u_int caplen = h->caplen;
217 u_int length = h->len;
218 const struct sll_header *sllp;
219 u_short ether_type;
220 int llc_hdrlen;
221 u_int hdrlen;
222
223 ndo->ndo_protocol = "sll_if";
224 if (caplen < SLL_HDR_LEN) {
225 /*
226 * XXX - this "can't happen" because "pcap-linux.c" always
227 * adds this many bytes of header to every packet in a
228 * cooked socket capture.
229 */
230 nd_print_trunc(ndo);
231 return (caplen);
232 }
233
234 sllp = (const struct sll_header *)p;
235
236 if (ndo->ndo_eflag)
237 sll_print(ndo, sllp, length);
238
239 /*
240 * Go past the cooked-mode header.
241 */
242 length -= SLL_HDR_LEN;
243 caplen -= SLL_HDR_LEN;
244 p += SLL_HDR_LEN;
245 hdrlen = SLL_HDR_LEN;
246
247 ether_type = EXTRACT_BE_U_2(sllp->sll_protocol);
248
249 recurse:
250 /*
251 * Is it (gag) an 802.3 encapsulation, or some non-Ethernet
252 * packet type?
253 */
254 if (ether_type <= MAX_ETHERNET_LENGTH_VAL) {
255 /*
256 * Yes - what type is it?
257 */
258 switch (ether_type) {
259
260 case LINUX_SLL_P_802_3:
261 /*
262 * Ethernet_802.3 IPX frame.
263 */
264 ipx_print(ndo, p, length);
265 break;
266
267 case LINUX_SLL_P_802_2:
268 /*
269 * 802.2.
270 * Try to print the LLC-layer header & higher layers.
271 */
272 llc_hdrlen = llc_print(ndo, p, length, caplen, NULL, NULL);
273 if (llc_hdrlen < 0)
274 goto unknown; /* unknown LLC type */
275 hdrlen += llc_hdrlen;
276 break;
277
278 default:
279 /*FALLTHROUGH*/
280
281 unknown:
282 /* packet type not known, print raw packet */
283 if (!ndo->ndo_suppress_default_print)
284 ND_DEFAULTPRINT(p, caplen);
285 break;
286 }
287 } else if (ether_type == ETHERTYPE_8021Q) {
288 /*
289 * Print VLAN information, and then go back and process
290 * the enclosed type field.
291 */
292 if (caplen < 4) {
293 ND_PRINT("[|vlan]");
294 return (hdrlen + caplen);
295 }
296 if (length < 4) {
297 ND_PRINT("[|vlan]");
298 return (hdrlen + length);
299 }
300 if (ndo->ndo_eflag) {
301 uint16_t tag = EXTRACT_BE_U_2(p);
302
303 ND_PRINT("%s, ", ieee8021q_tci_string(tag));
304 }
305
306 ether_type = EXTRACT_BE_U_2(p + 2);
307 if (ether_type <= MAX_ETHERNET_LENGTH_VAL)
308 ether_type = LINUX_SLL_P_802_2;
309 if (!ndo->ndo_qflag) {
310 ND_PRINT("ethertype %s, ",
311 tok2str(ethertype_values, "Unknown", ether_type));
312 }
313 p += 4;
314 length -= 4;
315 caplen -= 4;
316 hdrlen += 4;
317 goto recurse;
318 } else {
319 if (ethertype_print(ndo, ether_type, p, length, caplen, NULL, NULL) == 0) {
320 /* ether_type not known, print raw packet */
321 if (!ndo->ndo_eflag)
322 sll_print(ndo, sllp, length + SLL_HDR_LEN);
323 if (!ndo->ndo_suppress_default_print)
324 ND_DEFAULTPRINT(p, caplen);
325 }
326 }
327
328 return (hdrlen);
329 }
330
331 static void
332 sll2_print(netdissect_options *ndo, const struct sll2_header *sllp, u_int length)
333 {
334 u_short ether_type;
335
336 ndo->ndo_protocol = "sll2";
337 ND_PRINT("%3s ",tok2str(sll_pkttype_values,"?",EXTRACT_U_1(sllp->sll2_pkttype)));
338
339 /*
340 * XXX - check the link-layer address type value?
341 * For now, we just assume 6 means Ethernet.
342 * XXX - print others as strings of hex?
343 */
344 if (EXTRACT_U_1(sllp->sll2_halen) == 6)
345 ND_PRINT("%s ", etheraddr_string(ndo, sllp->sll2_addr));
346
347 if (!ndo->ndo_qflag) {
348 ether_type = EXTRACT_BE_U_2(sllp->sll2_protocol);
349
350 if (ether_type <= MAX_ETHERNET_LENGTH_VAL) {
351 /*
352 * Not an Ethernet type; what type is it?
353 */
354 switch (ether_type) {
355
356 case LINUX_SLL_P_802_3:
357 /*
358 * Ethernet_802.3 IPX frame.
359 */
360 ND_PRINT("802.3");
361 break;
362
363 case LINUX_SLL_P_802_2:
364 /*
365 * 802.2.
366 */
367 ND_PRINT("802.2");
368 break;
369
370 default:
371 /*
372 * What is it?
373 */
374 ND_PRINT("ethertype Unknown (0x%04x)",
375 ether_type);
376 break;
377 }
378 } else {
379 ND_PRINT("ethertype %s (0x%04x)",
380 tok2str(ethertype_values, "Unknown", ether_type),
381 ether_type);
382 }
383 ND_PRINT(", length %u: ", length);
384 }
385 }
386
387 /*
388 * This is the top level routine of the printer. 'p' points to the
389 * Linux "cooked capture" header of the packet, 'h->ts' is the timestamp,
390 * 'h->len' is the length of the packet off the wire, and 'h->caplen'
391 * is the number of bytes actually captured.
392 */
393 u_int
394 sll2_if_print(netdissect_options *ndo, const struct pcap_pkthdr *h, const u_char *p)
395 {
396 u_int caplen = h->caplen;
397 u_int length = h->len;
398 const struct sll2_header *sllp;
399 u_short ether_type;
400 int llc_hdrlen;
401 u_int hdrlen;
402 #ifdef HAVE_NET_IF_H
403 uint32_t index;
404 char ifname[IF_NAMESIZE];
405 #endif
406
407 ndo->ndo_protocol = "sll2_if";
408 if (caplen < SLL2_HDR_LEN) {
409 /*
410 * XXX - this "can't happen" because "pcap-linux.c" always
411 * adds this many bytes of header to every packet in a
412 * cooked socket capture.
413 */
414 nd_print_trunc(ndo);
415 return (caplen);
416 }
417
418 sllp = (const struct sll2_header *)p;
419 #ifdef HAVE_NET_IF_H
420 index = EXTRACT_BE_U_4(sllp->sll2_if_index);
421 if (if_indextoname(index, ifname))
422 ND_PRINT("ifindex %u (%s) ", index, ifname);
423 else
424 ND_PRINT("ifindex %u ", index);
425 #endif
426
427 if (ndo->ndo_eflag)
428 sll2_print(ndo, sllp, length);
429
430 /*
431 * Go past the cooked-mode header.
432 */
433 length -= SLL2_HDR_LEN;
434 caplen -= SLL2_HDR_LEN;
435 p += SLL2_HDR_LEN;
436 hdrlen = SLL2_HDR_LEN;
437
438 ether_type = EXTRACT_BE_U_2(sllp->sll2_protocol);
439
440 recurse:
441 /*
442 * Is it (gag) an 802.3 encapsulation, or some non-Ethernet
443 * packet type?
444 */
445 if (ether_type <= MAX_ETHERNET_LENGTH_VAL) {
446 /*
447 * Yes - what type is it?
448 */
449 switch (ether_type) {
450
451 case LINUX_SLL_P_802_3:
452 /*
453 * Ethernet_802.3 IPX frame.
454 */
455 ipx_print(ndo, p, length);
456 break;
457
458 case LINUX_SLL_P_802_2:
459 /*
460 * 802.2.
461 * Try to print the LLC-layer header & higher layers.
462 */
463 llc_hdrlen = llc_print(ndo, p, length, caplen, NULL, NULL);
464 if (llc_hdrlen < 0)
465 goto unknown; /* unknown LLC type */
466 hdrlen += llc_hdrlen;
467 break;
468
469 default:
470 /*FALLTHROUGH*/
471
472 unknown:
473 /* packet type not known, print raw packet */
474 if (!ndo->ndo_suppress_default_print)
475 ND_DEFAULTPRINT(p, caplen);
476 break;
477 }
478 } else if (ether_type == ETHERTYPE_8021Q) {
479 /*
480 * Print VLAN information, and then go back and process
481 * the enclosed type field.
482 */
483 if (caplen < 4) {
484 ND_PRINT("[|vlan]");
485 return (hdrlen + caplen);
486 }
487 if (length < 4) {
488 ND_PRINT("[|vlan]");
489 return (hdrlen + length);
490 }
491 if (ndo->ndo_eflag) {
492 uint16_t tag = EXTRACT_BE_U_2(p);
493
494 ND_PRINT("%s, ", ieee8021q_tci_string(tag));
495 }
496
497 ether_type = EXTRACT_BE_U_2(p + 2);
498 if (ether_type <= MAX_ETHERNET_LENGTH_VAL)
499 ether_type = LINUX_SLL_P_802_2;
500 if (!ndo->ndo_qflag) {
501 ND_PRINT("ethertype %s, ",
502 tok2str(ethertype_values, "Unknown", ether_type));
503 }
504 p += 4;
505 length -= 4;
506 caplen -= 4;
507 hdrlen += 4;
508 goto recurse;
509 } else {
510 if (ethertype_print(ndo, ether_type, p, length, caplen, NULL, NULL) == 0) {
511 /* ether_type not known, print raw packet */
512 if (!ndo->ndo_eflag)
513 sll2_print(ndo, sllp, length + SLL_HDR_LEN);
514 if (!ndo->ndo_suppress_default_print)
515 ND_DEFAULTPRINT(p, caplen);
516 }
517 }
518
519 return (hdrlen);
520 }
[mirror] the TCPdump network dissector