* WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
*/
-#ifndef lint
-static const char rcsid[] =
- "@(#) $Header: /tcpdump/master/tcpdump/print-sll.c,v 1.4 2001-01-15 00:33:59 guy Exp $ (LBL)";
-#endif
#ifdef HAVE_CONFIG_H
#include "config.h"
#endif
-#include <sys/param.h>
-#include <sys/time.h>
-#include <sys/socket.h>
-
-struct mbuf;
-struct rtentry;
-
-#include <netinet/in.h>
-
-#include <stdio.h>
-#include <string.h>
-#include <pcap.h>
+#include <tcpdump-stdinc.h>
#include "interface.h"
#include "addrtoname.h"
#include "ethertype.h"
+#include "extract.h"
#include "ether.h"
-#include "sll.h"
-
-const u_char *packetp;
-const u_char *snapend;
-static inline void
-sll_print(register const struct sll_header *sllp, u_int length)
-{
- u_short halen;
-
- switch (ntohs(sllp->sll_pkttype)) {
+/*
+ * For captures on Linux cooked sockets, we construct a fake header
+ * that includes:
+ *
+ * a 2-byte "packet type" which is one of:
+ *
+ * LINUX_SLL_HOST packet was sent to us
+ * LINUX_SLL_BROADCAST packet was broadcast
+ * LINUX_SLL_MULTICAST packet was multicast
+ * LINUX_SLL_OTHERHOST packet was sent to somebody else
+ * LINUX_SLL_OUTGOING packet was sent *by* us;
+ *
+ * a 2-byte Ethernet protocol field;
+ *
+ * a 2-byte link-layer type;
+ *
+ * a 2-byte link-layer address length;
+ *
+ * an 8-byte source link-layer address, whose actual length is
+ * specified by the previous value.
+ *
+ * All fields except for the link-layer address are in network byte order.
+ *
+ * DO NOT change the layout of this structure, or change any of the
+ * LINUX_SLL_ values below. If you must change the link-layer header
+ * for a "cooked" Linux capture, introduce a new DLT_ type (ask
+ * a value that collides with a value already being used), and use the
+ * new header in captures of that type, so that programs that can
+ * handle DLT_LINUX_SLL captures will continue to handle them correctly
+ * without any change, and so that capture files with different headers
+ * can be told apart and programs that read them can dissect the
+ * packets in them.
+ *
+ * This structure, and the #defines below, must be the same in the
+ * libpcap and tcpdump versions of "sll.h".
+ */
- case LINUX_SLL_HOST:
- (void)printf("< ");
- break;
+/*
+ * A DLT_LINUX_SLL fake link-layer header.
+ */
+#define SLL_HDR_LEN 16 /* total header length */
+#define SLL_ADDRLEN 8 /* length of address field */
- case LINUX_SLL_BROADCAST:
- (void)printf("B ");
- break;
+struct sll_header {
+ uint16_t sll_pkttype; /* packet type */
+ uint16_t sll_hatype; /* link-layer address type */
+ uint16_t sll_halen; /* link-layer address length */
+ uint8_t sll_addr[SLL_ADDRLEN]; /* link-layer address */
+ uint16_t sll_protocol; /* protocol */
+};
- case LINUX_SLL_MULTICAST:
- (void)printf("M ");
- break;
+/*
+ * The LINUX_SLL_ values for "sll_pkttype"; these correspond to the
+ * PACKET_ values on Linux, but are defined here so that they're
+ * available even on systems other than Linux, and so that they
+ * don't change even if the PACKET_ values change.
+ */
+#define LINUX_SLL_HOST 0
+#define LINUX_SLL_BROADCAST 1
+#define LINUX_SLL_MULTICAST 2
+#define LINUX_SLL_OTHERHOST 3
+#define LINUX_SLL_OUTGOING 4
- case LINUX_SLL_OTHERHOST:
- (void)printf("P ");
- break;
+/*
+ * The LINUX_SLL_ values for "sll_protocol"; these correspond to the
+ * ETH_P_ values on Linux, but are defined here so that they're
+ * available even on systems other than Linux. We assume, for now,
+ * that the ETH_P_ values won't change in Linux; if they do, then:
+ *
+ * if we don't translate them in "pcap-linux.c", capture files
+ * won't necessarily be readable if captured on a system that
+ * defines ETH_P_ values that don't match these values;
+ *
+ * if we do translate them in "pcap-linux.c", that makes life
+ * unpleasant for the BPF code generator, as the values you test
+ * for in the kernel aren't the values that you test for when
+ * reading a capture file, so the fixup code run on BPF programs
+ * handed to the kernel ends up having to do more work.
+ *
+ * Add other values here as necessary, for handling packet types that
+ * might show up on non-Ethernet, non-802.x networks. (Not all the ones
+ * in the Linux "if_ether.h" will, I suspect, actually show up in
+ * captures.)
+ */
+#define LINUX_SLL_P_802_3 0x0001 /* Novell 802.3 frames without 802.2 LLC header */
+#define LINUX_SLL_P_802_2 0x0004 /* 802.2 frames (not D/I/X Ethernet) */
+
+static const struct tok sll_pkttype_values[] = {
+ { LINUX_SLL_HOST, "In" },
+ { LINUX_SLL_BROADCAST, "B" },
+ { LINUX_SLL_MULTICAST, "M" },
+ { LINUX_SLL_OTHERHOST, "P" },
+ { LINUX_SLL_OUTGOING, "Out" },
+ { 0, NULL}
+};
- case LINUX_SLL_OUTGOING:
- (void)printf("> ");
- break;
+static inline void
+sll_print(netdissect_options *ndo, register const struct sll_header *sllp, u_int length)
+{
+ u_short ether_type;
- default:
- (void)printf("? ");
- break;
- }
+ ND_PRINT((ndo, "%3s ",tok2str(sll_pkttype_values,"?",EXTRACT_16BITS(&sllp->sll_pkttype))));
/*
* XXX - check the link-layer address type value?
* For now, we just assume 6 means Ethernet.
* XXX - print others as strings of hex?
*/
- halen = ntohs(sllp->sll_halen);
- if (halen == 6)
- (void)printf("%s ", etheraddr_string(sllp->sll_addr));
+ if (EXTRACT_16BITS(&sllp->sll_halen) == 6)
+ ND_PRINT((ndo, "%s ", etheraddr_string(ndo, sllp->sll_addr)));
- if (!qflag)
- (void)printf("%s ", etherproto_string(sllp->sll_protocol));
- (void)printf("%d: ", length);
+ if (!ndo->ndo_qflag) {
+ ether_type = EXTRACT_16BITS(&sllp->sll_protocol);
+
+ if (ether_type <= ETHERMTU) {
+ /*
+ * Not an Ethernet type; what type is it?
+ */
+ switch (ether_type) {
+
+ case LINUX_SLL_P_802_3:
+ /*
+ * Ethernet_802.3 IPX frame.
+ */
+ ND_PRINT((ndo, "802.3"));
+ break;
+
+ case LINUX_SLL_P_802_2:
+ /*
+ * 802.2.
+ */
+ ND_PRINT((ndo, "802.2"));
+ break;
+
+ default:
+ /*
+ * What is it?
+ */
+ ND_PRINT((ndo, "ethertype Unknown (0x%04x)",
+ ether_type));
+ break;
+ }
+ } else {
+ ND_PRINT((ndo, "ethertype %s (0x%04x)",
+ tok2str(ethertype_values, "Unknown", ether_type),
+ ether_type));
+ }
+ ND_PRINT((ndo, ", length %u: ", length));
+ }
}
/*
- * This is the top level routine of the printer. 'p' is the points
- * to the ether header of the packet, 'h->tv' is the timestamp,
- * 'h->length' is the length of the packet off the wire, and 'h->caplen'
+ * This is the top level routine of the printer. 'p' points to the
+ * Linux "cooked capture" header of the packet, 'h->ts' is the timestamp,
+ * 'h->len' is the length of the packet off the wire, and 'h->caplen'
* is the number of bytes actually captured.
*/
-void
-sll_if_print(u_char *user, const struct pcap_pkthdr *h, const u_char *p)
+u_int
+sll_if_print(netdissect_options *ndo, const struct pcap_pkthdr *h, const u_char *p)
{
u_int caplen = h->caplen;
u_int length = h->len;
register const struct sll_header *sllp;
- u_short pkttype;
- struct ether_header ehdr;
u_short ether_type;
- u_short extracted_ethertype;
-
- ts_print(&h->ts);
+ int llc_hdrlen;
+ u_int hdrlen;
if (caplen < SLL_HDR_LEN) {
/*
* adds this many bytes of header to every packet in a
* cooked socket capture.
*/
- printf("[|sll]");
- goto out;
+ ND_PRINT((ndo, "[|sll]"));
+ return (caplen);
}
sllp = (const struct sll_header *)p;
- /*
- * Fake up an Ethernet header for the benefit of printers that
- * insist on "packetp" pointing to an Ethernet header.
- */
- pkttype = ntohs(sllp->sll_pkttype);
-
- /* The source address is in the packet header */
- memcpy(ehdr.ether_shost, sllp->sll_addr, ETHER_ADDR_LEN);
-
- if (pkttype != LINUX_SLL_OUTGOING) {
- /*
- * We received this packet.
- *
- * We don't know the destination address, so
- * we fake it - all 0's except that the
- * bottommost bit of the bottommost octet
- * is set for a unicast packet, all 0's except
- * that the bottommost bit of the uppermost
- * octet is set for a multicast packet, all
- * 1's for a broadcast packet.
- */
- if (pkttype == LINUX_SLL_BROADCAST)
- memset(ehdr.ether_dhost, 0xFF, ETHER_ADDR_LEN);
- else {
- memset(ehdr.ether_dhost, 0, ETHER_ADDR_LEN);
- if (pkttype == LINUX_SLL_MULTICAST)
- ehdr.ether_dhost[0] = 1;
- else
- ehdr.ether_dhost[ETHER_ADDR_LEN-1] = 1;
- }
- } else {
- /*
- * We sent this packet; we don't know whether it's
- * broadcast, multicast, or unicast, so just make
- * the destination address all 0's.
- */
- memset(ehdr.ether_dhost, 0, ETHER_ADDR_LEN);
- }
-
- if (eflag)
- sll_print(sllp, length);
+ if (ndo->ndo_eflag)
+ sll_print(ndo, sllp, length);
/*
- * Some printers want to get back at the ethernet addresses,
- * and/or check that they're not walking off the end of the packet.
- * Rather than pass them all the way down, we set these globals.
+ * Go past the cooked-mode header.
*/
- snapend = p + caplen;
- /*
- * Actually, the only printers that use packetp are print-arp.c
- * and print-bootp.c, and they assume that packetp points to an
- * Ethernet header. The right thing to do is to fix them to know
- * which link type is in use when they excavate. XXX
- */
- packetp = (u_char *)&ehdr;
-
length -= SLL_HDR_LEN;
caplen -= SLL_HDR_LEN;
p += SLL_HDR_LEN;
+ hdrlen = SLL_HDR_LEN;
- ether_type = ntohs(sllp->sll_protocol);
+ ether_type = EXTRACT_16BITS(&sllp->sll_protocol);
+recurse:
/*
* Is it (gag) an 802.3 encapsulation, or some non-Ethernet
* packet type?
*/
- extracted_ethertype = 0;
if (ether_type <= ETHERMTU) {
/*
* Yes - what type is it?
/*
* Ethernet_802.3 IPX frame.
*/
- ipx_print(p, length);
+ ipx_print(ndo, p, length);
break;
case LINUX_SLL_P_802_2:
* 802.2.
* Try to print the LLC-layer header & higher layers.
*/
- if (llc_print(p, length, caplen, ESRC(&ehdr),
- EDST(&ehdr), &extracted_ethertype) == 0)
+ llc_hdrlen = llc_print(ndo, p, length, caplen, NULL, NULL);
+ if (llc_hdrlen < 0)
goto unknown; /* unknown LLC type */
+ hdrlen += llc_hdrlen;
break;
default:
+ /*FALLTHROUGH*/
+
unknown:
/* ether_type not known, print raw packet */
- if (!eflag)
- sll_print(sllp, length + SLL_HDR_LEN);
- if (extracted_ethertype) {
- printf("(LLC %s) ",
- etherproto_string(htons(extracted_ethertype)));
- }
- if (!xflag && !qflag)
- default_print(p, caplen);
+ if (!ndo->ndo_suppress_default_print)
+ ND_DEFAULTPRINT(p, caplen);
break;
}
- } else if (ether_encap_print(ether_type, p, length, caplen,
- &extracted_ethertype) == 0) {
- /* ether_type not known, print raw packet */
- if (!eflag)
- sll_print(sllp, length + SLL_HDR_LEN);
- if (!xflag && !qflag)
- default_print(p, caplen);
+ } else if (ether_type == ETHERTYPE_8021Q) {
+ /*
+ * Print VLAN information, and then go back and process
+ * the enclosed type field.
+ */
+ if (caplen < 4) {
+ ND_PRINT((ndo, "[|vlan]"));
+ return (hdrlen + caplen);
+ }
+ if (length < 4) {
+ ND_PRINT((ndo, "[|vlan]"));
+ return (hdrlen + length);
+ }
+ if (ndo->ndo_eflag) {
+ uint16_t tag = EXTRACT_16BITS(p);
+
+ ND_PRINT((ndo, "%s, ", ieee8021q_tci_string(tag)));
+ }
+
+ ether_type = EXTRACT_16BITS(p + 2);
+ if (ether_type <= ETHERMTU)
+ ether_type = LINUX_SLL_P_802_2;
+ if (!ndo->ndo_qflag) {
+ ND_PRINT((ndo, "ethertype %s, ",
+ tok2str(ethertype_values, "Unknown", ether_type)));
+ }
+ p += 4;
+ length -= 4;
+ caplen -= 4;
+ hdrlen += 4;
+ goto recurse;
+ } else {
+ if (ethertype_print(ndo, ether_type, p, length, caplen) == 0) {
+ /* ether_type not known, print raw packet */
+ if (!ndo->ndo_eflag)
+ sll_print(ndo, sllp, length + SLL_HDR_LEN);
+ if (!ndo->ndo_suppress_default_print)
+ ND_DEFAULTPRINT(p, caplen);
+ }
}
- if (xflag)
- default_print(p, caplen);
- out:
- putchar('\n');
+
+ return (hdrlen);
}
projects / tcpdump / blobdiff