The Tcpdump Group git mirrors - tcpdump/blobdiff

* WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF

* MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.

*/

* WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF

* MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.

*/

-#ifndef lint

-static const char rcsid[] =

- "@(#) $Header: /tcpdump/master/tcpdump/print-sll.c,v 1.7 2002-06-01 23:50:33 guy Exp $ (LBL)";

-#endif

#ifdef HAVE_CONFIG_H

#include "config.h"

#endif

#ifdef HAVE_CONFIG_H

#include "config.h"

#endif

-#include <sys/param.h>

-#include <sys/time.h>

-#include <sys/socket.h>

-

-#include <netinet/in.h>

-

-#include <stdio.h>

-#include <string.h>

-#include <pcap.h>

+#include <netdissect-stdinc.h>

-#include "interface.h"

+#include "netdissect.h"

#include "addrtoname.h"

#include "ethertype.h"

#include "addrtoname.h"

#include "ethertype.h"

+#include "extract.h"

#include "ether.h"

-#include "sll.h"

-static inline void

-sll_print(register const struct sll_header *sllp, u_int length)

-{

- u_short halen;

+/*

+ * For captures on Linux cooked sockets, we construct a fake header

+ * that includes:

+ *

+ * a 2-byte "packet type" which is one of:

+ *

+ * LINUX_SLL_HOST packet was sent to us

+ * LINUX_SLL_BROADCAST packet was broadcast

+ * LINUX_SLL_MULTICAST packet was multicast

+ * LINUX_SLL_OTHERHOST packet was sent to somebody else

+ * LINUX_SLL_OUTGOING packet was sent *by* us;

+ *

+ * a 2-byte Ethernet protocol field;

+ *

+ * a 2-byte link-layer type;

+ *

+ * a 2-byte link-layer address length;

+ *

+ * an 8-byte source link-layer address, whose actual length is

+ * specified by the previous value.

+ *

+ * All fields except for the link-layer address are in network byte order.

+ *

+ * DO NOT change the layout of this structure, or change any of the

+ * LINUX_SLL_ values below. If you must change the link-layer header

+ * for a "cooked" Linux capture, introduce a new DLT_ type (ask

+ * "[email protected]" for one, so that you don't give it

+ * a value that collides with a value already being used), and use the

+ * new header in captures of that type, so that programs that can

+ * handle DLT_LINUX_SLL captures will continue to handle them correctly

+ * without any change, and so that capture files with different headers

+ * can be told apart and programs that read them can dissect the

+ * packets in them.

+ *

+ * This structure, and the #defines below, must be the same in the

+ * libpcap and tcpdump versions of "sll.h".

+ */

- switch (ntohs(sllp->sll_pkttype)) {

+/*

+ * A DLT_LINUX_SLL fake link-layer header.

+ */

+#define SLL_HDR_LEN 16 /* total header length */

+#define SLL_ADDRLEN 8 /* length of address field */

- case LINUX_SLL_HOST:

- (void)printf("< ");

- break;

+struct sll_header {

+ uint16_t sll_pkttype; /* packet type */

+ uint16_t sll_hatype; /* link-layer address type */

+ uint16_t sll_halen; /* link-layer address length */

+ uint8_t sll_addr[SLL_ADDRLEN]; /* link-layer address */

+ uint16_t sll_protocol; /* protocol */

+};

- case LINUX_SLL_BROADCAST:

- (void)printf("B ");

- break;

+/*

+ * The LINUX_SLL_ values for "sll_pkttype"; these correspond to the

+ * PACKET_ values on Linux, but are defined here so that they're

+ * available even on systems other than Linux, and so that they

+ * don't change even if the PACKET_ values change.

+ */

+#define LINUX_SLL_HOST 0

+#define LINUX_SLL_BROADCAST 1

+#define LINUX_SLL_MULTICAST 2

+#define LINUX_SLL_OTHERHOST 3

+#define LINUX_SLL_OUTGOING 4

- case LINUX_SLL_MULTICAST:

- (void)printf("M ");

- break;

+/*

+ * The LINUX_SLL_ values for "sll_protocol"; these correspond to the

+ * ETH_P_ values on Linux, but are defined here so that they're

+ * available even on systems other than Linux. We assume, for now,

+ * that the ETH_P_ values won't change in Linux; if they do, then:

+ *

+ * if we don't translate them in "pcap-linux.c", capture files

+ * won't necessarily be readable if captured on a system that

+ * defines ETH_P_ values that don't match these values;

+ *

+ * if we do translate them in "pcap-linux.c", that makes life

+ * unpleasant for the BPF code generator, as the values you test

+ * for in the kernel aren't the values that you test for when

+ * reading a capture file, so the fixup code run on BPF programs

+ * handed to the kernel ends up having to do more work.

+ *

+ * Add other values here as necessary, for handling packet types that

+ * might show up on non-Ethernet, non-802.x networks. (Not all the ones

+ * in the Linux "if_ether.h" will, I suspect, actually show up in

+ * captures.)

+ */

+#define LINUX_SLL_P_802_3 0x0001 /* Novell 802.3 frames without 802.2 LLC header */

+#define LINUX_SLL_P_802_2 0x0004 /* 802.2 frames (not D/I/X Ethernet) */

- case LINUX_SLL_OTHERHOST:

- (void)printf("P ");

- break;

+static const struct tok sll_pkttype_values[] = {

+ { LINUX_SLL_HOST, "In" },

+ { LINUX_SLL_BROADCAST, "B" },

+ { LINUX_SLL_MULTICAST, "M" },

+ { LINUX_SLL_OTHERHOST, "P" },

+ { LINUX_SLL_OUTGOING, "Out" },

+ { 0, NULL}

+};

- case LINUX_SLL_OUTGOING:

- (void)printf("> ");

- break;

+static inline void

+sll_print(netdissect_options *ndo, register const struct sll_header *sllp, u_int length)

+{

+ u_short ether_type;

- default:

- (void)printf("? ");

- break;

- }

+ ND_PRINT((ndo, "%3s ",tok2str(sll_pkttype_values,"?",EXTRACT_16BITS(&sllp->sll_pkttype))));

/*

* XXX - check the link-layer address type value?

* For now, we just assume 6 means Ethernet.

* XXX - print others as strings of hex?

*/

/*

* XXX - check the link-layer address type value?

* For now, we just assume 6 means Ethernet.

* XXX - print others as strings of hex?

*/

- halen = ntohs(sllp->sll_halen);

- if (halen == 6)

- (void)printf("%s ", etheraddr_string(sllp->sll_addr));

+ if (EXTRACT_16BITS(&sllp->sll_halen) == 6)

+ ND_PRINT((ndo, "%s ", etheraddr_string(ndo, sllp->sll_addr)));

+

+ if (!ndo->ndo_qflag) {

+ ether_type = EXTRACT_16BITS(&sllp->sll_protocol);

+

+ if (ether_type <= ETHERMTU) {

+ /*

+ * Not an Ethernet type; what type is it?

+ */

+ switch (ether_type) {

+

+ case LINUX_SLL_P_802_3:

+ /*

+ * Ethernet_802.3 IPX frame.

+ */

+ ND_PRINT((ndo, "802.3"));

+ break;

+

+ case LINUX_SLL_P_802_2:

+ /*

+ * 802.2.

+ */

+ ND_PRINT((ndo, "802.2"));

+ break;

- if (!qflag)

- (void)printf("%s ", etherproto_string(sllp->sll_protocol));

- (void)printf("%d: ", length);

+ default:

+ /*

+ * What is it?

+ */

+ ND_PRINT((ndo, "ethertype Unknown (0x%04x)",

+ ether_type));

+ break;

+ }

+ } else {

+ ND_PRINT((ndo, "ethertype %s (0x%04x)",

+ tok2str(ethertype_values, "Unknown", ether_type),

+ ether_type));

+ }

+ ND_PRINT((ndo, ", length %u: ", length));

+ }

}

/*

}

/*

- * This is the top level routine of the printer. 'p' is the points

- * to the ether header of the packet, 'h->tv' is the timestamp,

- * 'h->length' is the length of the packet off the wire, and 'h->caplen'

+ * This is the top level routine of the printer. 'p' points to the

+ * Linux "cooked capture" header of the packet, 'h->ts' is the timestamp,

+ * 'h->len' is the length of the packet off the wire, and 'h->caplen'

* is the number of bytes actually captured.

*/

* is the number of bytes actually captured.

*/

-void

-sll_if_print(u_char *user, const struct pcap_pkthdr *h, const u_char *p)

+u_int

+sll_if_print(netdissect_options *ndo, const struct pcap_pkthdr *h, const u_char *p)

{

u_int caplen = h->caplen;

u_int length = h->len;

register const struct sll_header *sllp;

{

u_int caplen = h->caplen;

u_int length = h->len;

register const struct sll_header *sllp;

- u_short pkttype;

- struct ether_header ehdr;

u_short ether_type;

- u_short extracted_ethertype;

-

- ++infodelay;

- ts_print(&h->ts);

+ int llc_hdrlen;

+ u_int hdrlen;

if (caplen < SLL_HDR_LEN) {

/*

if (caplen < SLL_HDR_LEN) {

/*

* adds this many bytes of header to every packet in a

* cooked socket capture.

*/

* adds this many bytes of header to every packet in a

* cooked socket capture.

*/

- printf("[|sll]");

- goto out;

+ ND_PRINT((ndo, "[|sll]"));

+ return (caplen);

}

sllp = (const struct sll_header *)p;

}

sllp = (const struct sll_header *)p;

- /*

- * Fake up an Ethernet header for the benefit of printers that

- * insist on "packetp" pointing to an Ethernet header.

- */

- pkttype = ntohs(sllp->sll_pkttype);

-

- /* The source address is in the packet header */

- memcpy(ehdr.ether_shost, sllp->sll_addr, ETHER_ADDR_LEN);

+ if (ndo->ndo_eflag)

+ sll_print(ndo, sllp, length);

- if (pkttype != LINUX_SLL_OUTGOING) {

- /*

- * We received this packet.

- *

- * We don't know the destination address, so

- * we fake it - all 0's except that the

- * bottommost bit of the bottommost octet

- * is set for a unicast packet, all 0's except

- * that the bottommost bit of the uppermost

- * octet is set for a multicast packet, all

- * 1's for a broadcast packet.

- */

- if (pkttype == LINUX_SLL_BROADCAST)

- memset(ehdr.ether_dhost, 0xFF, ETHER_ADDR_LEN);

- else {

- memset(ehdr.ether_dhost, 0, ETHER_ADDR_LEN);

- if (pkttype == LINUX_SLL_MULTICAST)

- ehdr.ether_dhost[0] = 1;

- else

- ehdr.ether_dhost[ETHER_ADDR_LEN-1] = 1;

- }

- } else {

- /*

- * We sent this packet; we don't know whether it's

- * broadcast, multicast, or unicast, so just make

- * the destination address all 0's.

- */

- memset(ehdr.ether_dhost, 0, ETHER_ADDR_LEN);

- }

-

- if (eflag)

- sll_print(sllp, length);

-

- /*

- * Some printers want to get back at the ethernet addresses,

- * and/or check that they're not walking off the end of the packet.

- * Rather than pass them all the way down, we set these globals.

- */

- snapend = p + caplen;

/*

- * Actually, the only printers that use packetp are print-arp.c

- * and print-bootp.c, and they assume that packetp points to an

- * Ethernet header. The right thing to do is to fix them to know

- * which link type is in use when they excavate. XXX

+ * Go past the cooked-mode header.

*/

- packetp = (u_char *)&ehdr;

-

length -= SLL_HDR_LEN;

caplen -= SLL_HDR_LEN;

p += SLL_HDR_LEN;

length -= SLL_HDR_LEN;

caplen -= SLL_HDR_LEN;

p += SLL_HDR_LEN;

+ hdrlen = SLL_HDR_LEN;

- ether_type = ntohs(sllp->sll_protocol);

+ ether_type = EXTRACT_16BITS(&sllp->sll_protocol);

+recurse:

/*

* Is it (gag) an 802.3 encapsulation, or some non-Ethernet

* packet type?

*/

/*

* Is it (gag) an 802.3 encapsulation, or some non-Ethernet

* packet type?

*/

- extracted_ethertype = 0;

if (ether_type <= ETHERMTU) {

/*

* Yes - what type is it?

if (ether_type <= ETHERMTU) {

/*

* Yes - what type is it?

/*

* Ethernet_802.3 IPX frame.

*/

/*

* Ethernet_802.3 IPX frame.

*/

- ipx_print(p, length);

+ ipx_print(ndo, p, length);

break;

case LINUX_SLL_P_802_2:

break;

case LINUX_SLL_P_802_2:

* 802.2.

* Try to print the LLC-layer header & higher layers.

*/

* 802.2.

* Try to print the LLC-layer header & higher layers.

*/

- if (llc_print(p, length, caplen, ESRC(&ehdr),

- EDST(&ehdr), &extracted_ethertype) == 0)

+ llc_hdrlen = llc_print(ndo, p, length, caplen, NULL, NULL);

+ if (llc_hdrlen < 0)

goto unknown; /* unknown LLC type */

+ hdrlen += llc_hdrlen;

break;

default:

break;

default:

+ /*FALLTHROUGH*/

+

unknown:

- /* ether_type not known, print raw packet */

- if (!eflag)

- sll_print(sllp, length + SLL_HDR_LEN);

- if (extracted_ethertype) {

- printf("(LLC %s) ",

- etherproto_string(htons(extracted_ethertype)));

- }

- if (!xflag && !qflag)

- default_print(p, caplen);

+ /* packet type not known, print raw packet */

+ if (!ndo->ndo_suppress_default_print)

+ ND_DEFAULTPRINT(p, caplen);

break;

}

break;

}

- } else if (ether_encap_print(ether_type, p, length, caplen,

- &extracted_ethertype) == 0) {

- /* ether_type not known, print raw packet */

- if (!eflag)

- sll_print(sllp, length + SLL_HDR_LEN);

- if (!xflag && !qflag)

- default_print(p, caplen);

+ } else if (ether_type == ETHERTYPE_8021Q) {

+ /*

+ * Print VLAN information, and then go back and process

+ * the enclosed type field.

+ */

+ if (caplen < 4) {

+ ND_PRINT((ndo, "[|vlan]"));

+ return (hdrlen + caplen);

+ }

+ if (length < 4) {

+ ND_PRINT((ndo, "[|vlan]"));

+ return (hdrlen + length);

+ }

+ if (ndo->ndo_eflag) {

+ uint16_t tag = EXTRACT_16BITS(p);

+

+ ND_PRINT((ndo, "%s, ", ieee8021q_tci_string(tag)));

+ }

+

+ ether_type = EXTRACT_16BITS(p + 2);

+ if (ether_type <= ETHERMTU)

+ ether_type = LINUX_SLL_P_802_2;

+ if (!ndo->ndo_qflag) {

+ ND_PRINT((ndo, "ethertype %s, ",

+ tok2str(ethertype_values, "Unknown", ether_type)));

+ }

+ p += 4;

+ length -= 4;

+ caplen -= 4;

+ hdrlen += 4;

+ goto recurse;

+ } else {

+ if (ethertype_print(ndo, ether_type, p, length, caplen) == 0) {

+ /* ether_type not known, print raw packet */

+ if (!ndo->ndo_eflag)

+ sll_print(ndo, sllp, length + SLL_HDR_LEN);

+ if (!ndo->ndo_suppress_default_print)

+ ND_DEFAULTPRINT(p, caplen);

+ }

}

- if (xflag)

- default_print(p, caplen);

- out:

- putchar('\n');

- --infodelay;

- if (infoprint)

- info(0);

+

+ return (hdrlen);

}