X-Git-Url: https://git.tcpdump.org/tcpdump/blobdiff_plain/176a3e498602351ae25833cf7456c1e30f7f59ae..refs/heads/master:/print-sll.c diff --git a/print-sll.c b/print-sll.c index 836140fd..87d82446 100644 --- a/print-sll.c +++ b/print-sll.c @@ -18,181 +18,454 @@ * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. */ -#ifndef lint -static const char rcsid[] = - "@(#) $Header: /tcpdump/master/tcpdump/print-sll.c,v 1.6 2001-07-05 18:54:18 guy Exp $ (LBL)"; -#endif - -#ifdef HAVE_CONFIG_H -#include "config.h" -#endif -#include -#include -#include +/* \summary: Linux cooked sockets capture printer */ -struct mbuf; -struct rtentry; +#include -#include +#ifdef __linux__ +#include +#endif -#include -#include -#include +#include "netdissect-stdinc.h" -#include "interface.h" +#define ND_LONGJMP_FROM_TCHECK +#include "netdissect.h" #include "addrtoname.h" #include "ethertype.h" +#include "extract.h" -#include "ether.h" -#include "sll.h" - -static inline void -sll_print(register const struct sll_header *sllp, u_int length) -{ - u_short halen; - - switch (ntohs(sllp->sll_pkttype)) { +/* + * For captures on Linux cooked sockets, we construct a fake header + * that includes: + * + * a 2-byte "packet type" which is one of: + * + * LINUX_SLL_HOST packet was sent to us + * LINUX_SLL_BROADCAST packet was broadcast + * LINUX_SLL_MULTICAST packet was multicast + * LINUX_SLL_OTHERHOST packet was sent to somebody else + * LINUX_SLL_OUTGOING packet was sent *by* us; + * + * a 2-byte Ethernet protocol field; + * + * a 2-byte link-layer type; + * + * a 2-byte link-layer address length; + * + * an 8-byte source link-layer address, whose actual length is + * specified by the previous value. + * + * All fields except for the link-layer address are in network byte order. + * + * DO NOT change the layout of this structure, or change any of the + * LINUX_SLL_ values below. If you must change the link-layer header + * for a "cooked" Linux capture, introduce a new DLT_ type (ask + * "tcpdump-workers@lists.tcpdump.org" for one, so that you don't give it + * a value that collides with a value already being used), and use the + * new header in captures of that type, so that programs that can + * handle DLT_LINUX_SLL captures will continue to handle them correctly + * without any change, and so that capture files with different headers + * can be told apart and programs that read them can dissect the + * packets in them. + * + * This structure, and the #defines below, must be the same in the + * libpcap and tcpdump versions of "sll.h". + */ - case LINUX_SLL_HOST: - (void)printf("< "); - break; +/* + * A DLT_LINUX_SLL fake link-layer header. + */ +#define SLL_HDR_LEN 16 /* total header length */ +#define SLL_ADDRLEN 8 /* length of address field */ - case LINUX_SLL_BROADCAST: - (void)printf("B "); - break; +struct sll_header { + nd_uint16_t sll_pkttype; /* packet type */ + nd_uint16_t sll_hatype; /* link-layer address type */ + nd_uint16_t sll_halen; /* link-layer address length */ + nd_byte sll_addr[SLL_ADDRLEN]; /* link-layer address */ + nd_uint16_t sll_protocol; /* protocol */ +}; - case LINUX_SLL_MULTICAST: - (void)printf("M "); - break; +/* + * A DLT_LINUX_SLL2 fake link-layer header. + */ +#define SLL2_HDR_LEN 20 /* total header length */ + +struct sll2_header { + nd_uint16_t sll2_protocol; /* protocol */ + nd_uint16_t sll2_reserved_mbz; /* reserved - must be zero */ + nd_uint32_t sll2_if_index; /* 1-based interface index */ + nd_uint16_t sll2_hatype; /* link-layer address type */ + nd_uint8_t sll2_pkttype; /* packet type */ + nd_uint8_t sll2_halen; /* link-layer address length */ + nd_byte sll2_addr[SLL_ADDRLEN]; /* link-layer address */ +}; - case LINUX_SLL_OTHERHOST: - (void)printf("P "); - break; +/* + * The LINUX_SLL_ values for "sll_pkttype"; these correspond to the + * PACKET_ values on Linux, but are defined here so that they're + * available even on systems other than Linux, and so that they + * don't change even if the PACKET_ values change. + */ +#define LINUX_SLL_HOST 0 +#define LINUX_SLL_BROADCAST 1 +#define LINUX_SLL_MULTICAST 2 +#define LINUX_SLL_OTHERHOST 3 +#define LINUX_SLL_OUTGOING 4 - case LINUX_SLL_OUTGOING: - (void)printf("> "); - break; +/* + * The LINUX_SLL_ values for "sll_protocol"; these correspond to the + * ETH_P_ values on Linux, but are defined here so that they're + * available even on systems other than Linux. We assume, for now, + * that the ETH_P_ values won't change in Linux; if they do, then: + * + * if we don't translate them in "pcap-linux.c", capture files + * won't necessarily be readable if captured on a system that + * defines ETH_P_ values that don't match these values; + * + * if we do translate them in "pcap-linux.c", that makes life + * unpleasant for the BPF code generator, as the values you test + * for in the kernel aren't the values that you test for when + * reading a capture file, so the fixup code run on BPF programs + * handed to the kernel ends up having to do more work. + * + * Add other values here as necessary, for handling packet types that + * might show up on non-Ethernet, non-802.x networks. (Not all the ones + * in the Linux "if_ether.h" will, I suspect, actually show up in + * captures.) + */ +#define LINUX_SLL_P_802_3 0x0001 /* Novell 802.3 frames without 802.2 LLC header */ +#define LINUX_SLL_P_802_2 0x0004 /* 802.2 frames (not D/I/X Ethernet) */ + +static const struct tok sll_pkttype_values[] = { + { LINUX_SLL_HOST, "In" }, + { LINUX_SLL_BROADCAST, "B" }, + { LINUX_SLL_MULTICAST, "M" }, + { LINUX_SLL_OTHERHOST, "P" }, + { LINUX_SLL_OUTGOING, "Out" }, + { 0, NULL} +}; + +static void +sll_print(netdissect_options *ndo, const struct sll_header *sllp, u_int length) +{ + u_short ether_type; - default: - (void)printf("? "); - break; - } + ndo->ndo_protocol = "sll"; + ND_PRINT("%3s ", + tok2str(sll_pkttype_values,"?",GET_BE_U_2(sllp->sll_pkttype))); /* * XXX - check the link-layer address type value? * For now, we just assume 6 means Ethernet. * XXX - print others as strings of hex? */ - halen = ntohs(sllp->sll_halen); - if (halen == 6) - (void)printf("%s ", etheraddr_string(sllp->sll_addr)); + if (GET_BE_U_2(sllp->sll_halen) == MAC48_LEN) + ND_PRINT("%s ", GET_MAC48_STRING(sllp->sll_addr)); + + if (!ndo->ndo_qflag) { + ether_type = GET_BE_U_2(sllp->sll_protocol); - if (!qflag) - (void)printf("%s ", etherproto_string(sllp->sll_protocol)); - (void)printf("%d: ", length); + if (ether_type <= MAX_ETHERNET_LENGTH_VAL) { + /* + * Not an Ethernet type; what type is it? + */ + switch (ether_type) { + + case LINUX_SLL_P_802_3: + /* + * Ethernet_802.3 IPX frame. + */ + ND_PRINT("802.3"); + break; + + case LINUX_SLL_P_802_2: + /* + * 802.2. + */ + ND_PRINT("802.2"); + break; + + default: + /* + * What is it? + */ + ND_PRINT("ethertype Unknown (0x%04x)", + ether_type); + break; + } + } else { + ND_PRINT("ethertype %s (0x%04x)", + tok2str(ethertype_values, "Unknown", ether_type), + ether_type); + } + ND_PRINT(", length %u: ", length); + } } /* - * This is the top level routine of the printer. 'p' is the points - * to the ether header of the packet, 'h->tv' is the timestamp, - * 'h->length' is the length of the packet off the wire, and 'h->caplen' + * This is the top level routine of the printer. 'p' points to the + * Linux "cooked capture" header of the packet, 'h->ts' is the timestamp, + * 'h->len' is the length of the packet off the wire, and 'h->caplen' * is the number of bytes actually captured. */ void -sll_if_print(u_char *user, const struct pcap_pkthdr *h, const u_char *p) +sll_if_print(netdissect_options *ndo, const struct pcap_pkthdr *h, const u_char *p) { u_int caplen = h->caplen; u_int length = h->len; - register const struct sll_header *sllp; - u_short pkttype; - struct ether_header ehdr; + const struct sll_header *sllp; + u_short hatype; u_short ether_type; - u_short extracted_ethertype; + int llc_hdrlen; + u_int hdrlen; - ++infodelay; - ts_print(&h->ts); + ndo->ndo_protocol = "sll"; + ND_TCHECK_LEN(p, SLL_HDR_LEN); + + sllp = (const struct sll_header *)p; - if (caplen < SLL_HDR_LEN) { + if (ndo->ndo_eflag) + sll_print(ndo, sllp, length); + + /* + * Go past the cooked-mode header. + */ + length -= SLL_HDR_LEN; + caplen -= SLL_HDR_LEN; + p += SLL_HDR_LEN; + hdrlen = SLL_HDR_LEN; + + hatype = GET_BE_U_2(sllp->sll_hatype); + switch (hatype) { + + case 803: /* - * XXX - this "can't happen" because "pcap-linux.c" always - * adds this many bytes of header to every packet in a - * cooked socket capture. + * This is an packet with a radiotap header; + * just dissect the payload as such. */ - printf("[|sll]"); - goto out; + ndo->ndo_ll_hdr_len += SLL_HDR_LEN; + ndo->ndo_ll_hdr_len += ieee802_11_radio_print(ndo, p, length, caplen); + return; } + ether_type = GET_BE_U_2(sllp->sll_protocol); - sllp = (const struct sll_header *)p; - +recurse: /* - * Fake up an Ethernet header for the benefit of printers that - * insist on "packetp" pointing to an Ethernet header. + * Is it (gag) an 802.3 encapsulation, or some non-Ethernet + * packet type? */ - pkttype = ntohs(sllp->sll_pkttype); + if (ether_type <= MAX_ETHERNET_LENGTH_VAL) { + /* + * Yes - what type is it? + */ + switch (ether_type) { - /* The source address is in the packet header */ - memcpy(ehdr.ether_shost, sllp->sll_addr, ETHER_ADDR_LEN); + case LINUX_SLL_P_802_3: + /* + * Ethernet_802.3 IPX frame. + */ + ipx_print(ndo, p, length); + break; + + case LINUX_SLL_P_802_2: + /* + * 802.2. + * Try to print the LLC-layer header & higher layers. + */ + llc_hdrlen = llc_print(ndo, p, length, caplen, NULL, NULL); + if (llc_hdrlen < 0) + goto unknown; /* unknown LLC type */ + hdrlen += llc_hdrlen; + break; - if (pkttype != LINUX_SLL_OUTGOING) { + default: + /*FALLTHROUGH*/ + + unknown: + /* packet type not known, print raw packet */ + if (!ndo->ndo_suppress_default_print) + ND_DEFAULTPRINT(p, caplen); + break; + } + } else if (ether_type == ETHERTYPE_8021Q) { /* - * We received this packet. - * - * We don't know the destination address, so - * we fake it - all 0's except that the - * bottommost bit of the bottommost octet - * is set for a unicast packet, all 0's except - * that the bottommost bit of the uppermost - * octet is set for a multicast packet, all - * 1's for a broadcast packet. + * Print VLAN information, and then go back and process + * the enclosed type field. */ - if (pkttype == LINUX_SLL_BROADCAST) - memset(ehdr.ether_dhost, 0xFF, ETHER_ADDR_LEN); - else { - memset(ehdr.ether_dhost, 0, ETHER_ADDR_LEN); - if (pkttype == LINUX_SLL_MULTICAST) - ehdr.ether_dhost[0] = 1; - else - ehdr.ether_dhost[ETHER_ADDR_LEN-1] = 1; + if (caplen < 4) { + ndo->ndo_protocol = "vlan"; + nd_print_trunc(ndo); + ndo->ndo_ll_hdr_len += hdrlen + caplen; + return; + } + if (ndo->ndo_eflag) { + uint16_t tag = GET_BE_U_2(p); + + ND_PRINT("%s, ", ieee8021q_tci_string(tag)); + } + + ether_type = GET_BE_U_2(p + 2); + if (ether_type <= MAX_ETHERNET_LENGTH_VAL) + ether_type = LINUX_SLL_P_802_2; + if (!ndo->ndo_qflag) { + ND_PRINT("ethertype %s, ", + tok2str(ethertype_values, "Unknown", ether_type)); } + p += 4; + length -= 4; + caplen -= 4; + hdrlen += 4; + goto recurse; } else { - /* - * We sent this packet; we don't know whether it's - * broadcast, multicast, or unicast, so just make - * the destination address all 0's. - */ - memset(ehdr.ether_dhost, 0, ETHER_ADDR_LEN); + if (ethertype_print(ndo, ether_type, p, length, caplen, NULL, NULL) == 0) { + /* ether_type not known, print raw packet */ + if (!ndo->ndo_eflag) + sll_print(ndo, sllp, length + SLL_HDR_LEN); + if (!ndo->ndo_suppress_default_print) + ND_DEFAULTPRINT(p, caplen); + } } - if (eflag) - sll_print(sllp, length); + ndo->ndo_ll_hdr_len += hdrlen; +} + +static void +sll2_print(netdissect_options *ndo, const struct sll2_header *sllp, u_int length) +{ + u_short ether_type; + + ndo->ndo_protocol = "sll2"; + ND_PRINT("ifindex %u ", GET_BE_U_4(sllp->sll2_if_index)); /* - * Some printers want to get back at the ethernet addresses, - * and/or check that they're not walking off the end of the packet. - * Rather than pass them all the way down, we set these globals. + * XXX - check the link-layer address type value? + * For now, we just assume 6 means Ethernet. + * XXX - print others as strings of hex? */ - snapend = p + caplen; + if (GET_U_1(sllp->sll2_halen) == MAC48_LEN) + ND_PRINT("%s ", GET_MAC48_STRING(sllp->sll2_addr)); + + if (!ndo->ndo_qflag) { + ether_type = GET_BE_U_2(sllp->sll2_protocol); + + if (ether_type <= MAX_ETHERNET_LENGTH_VAL) { + /* + * Not an Ethernet type; what type is it? + */ + switch (ether_type) { + + case LINUX_SLL_P_802_3: + /* + * Ethernet_802.3 IPX frame. + */ + ND_PRINT("802.3"); + break; + + case LINUX_SLL_P_802_2: + /* + * 802.2. + */ + ND_PRINT("802.2"); + break; + + default: + /* + * What is it? + */ + ND_PRINT("ethertype Unknown (0x%04x)", + ether_type); + break; + } + } else { + ND_PRINT("ethertype %s (0x%04x)", + tok2str(ethertype_values, "Unknown", ether_type), + ether_type); + } + ND_PRINT(", length %u: ", length); + } +} + +/* + * This is the top level routine of the printer. 'p' points to the + * Linux "cooked capture" header of the packet, 'h->ts' is the timestamp, + * 'h->len' is the length of the packet off the wire, and 'h->caplen' + * is the number of bytes actually captured. + * + * On Linux, we attempt to look up the interface index and print the + * name of the interface on which the packet arrived or was sent. + * + * This look up is only likely to work well if done on the same machine + * as the one on which the capture was done, as the interface with a + * given index on the latter machine is unlikely to have the same + * name as the interface with that index on the former machine. + * + * As DLT_LINUX_SLL2 live captures are supported only on Linux, this + * means that if the machine on which we're reading the file isn't + * running Linux, it's probably not the machine that captured the file, + * so we don't bother trying to do the lookup on non-Linux machines. + */ +void +sll2_if_print(netdissect_options *ndo, const struct pcap_pkthdr *h, const u_char *p) +{ + u_int caplen = h->caplen; + u_int length = h->len; + const struct sll2_header *sllp; + u_short hatype; + u_short ether_type; + int llc_hdrlen; + u_int hdrlen; +#ifdef __linux__ + uint32_t if_index; + char ifname[IF_NAMESIZE]; +#endif + + ndo->ndo_protocol = "sll2"; + ND_TCHECK_LEN(p, SLL2_HDR_LEN); + + sllp = (const struct sll2_header *)p; +#ifdef __linux__ + if_index = GET_BE_U_4(sllp->sll2_if_index); + if (!if_indextoname(if_index, ifname)) + strncpy(ifname, "?", 2); + ND_PRINT("%-5s ", ifname); +#endif + + ND_PRINT("%-3s ", + tok2str(sll_pkttype_values, "?", GET_U_1(sllp->sll2_pkttype))); + + if (ndo->ndo_eflag) + sll2_print(ndo, sllp, length); + /* - * Actually, the only printers that use packetp are print-arp.c - * and print-bootp.c, and they assume that packetp points to an - * Ethernet header. The right thing to do is to fix them to know - * which link type is in use when they excavate. XXX + * Go past the cooked-mode header. */ - packetp = (u_char *)&ehdr; + length -= SLL2_HDR_LEN; + caplen -= SLL2_HDR_LEN; + p += SLL2_HDR_LEN; + hdrlen = SLL2_HDR_LEN; - length -= SLL_HDR_LEN; - caplen -= SLL_HDR_LEN; - p += SLL_HDR_LEN; + hatype = GET_BE_U_2(sllp->sll2_hatype); + switch (hatype) { - ether_type = ntohs(sllp->sll_protocol); + case 803: + /* + * This is an packet with a radiotap header; + * just dissect the payload as such. + */ + ndo->ndo_ll_hdr_len += SLL2_HDR_LEN; + ndo->ndo_ll_hdr_len += ieee802_11_radio_print(ndo, p, length, caplen); + return; + } + ether_type = GET_BE_U_2(sllp->sll2_protocol); +recurse: /* * Is it (gag) an 802.3 encapsulation, or some non-Ethernet * packet type? */ - extracted_ethertype = 0; - if (ether_type <= ETHERMTU) { + if (ether_type <= MAX_ETHERNET_LENGTH_VAL) { /* * Yes - what type is it? */ @@ -202,7 +475,7 @@ sll_if_print(u_char *user, const struct pcap_pkthdr *h, const u_char *p) /* * Ethernet_802.3 IPX frame. */ - ipx_print(p, length); + ipx_print(ndo, p, length); break; case LINUX_SLL_P_802_2: @@ -210,37 +483,59 @@ sll_if_print(u_char *user, const struct pcap_pkthdr *h, const u_char *p) * 802.2. * Try to print the LLC-layer header & higher layers. */ - if (llc_print(p, length, caplen, ESRC(&ehdr), - EDST(&ehdr), &extracted_ethertype) == 0) + llc_hdrlen = llc_print(ndo, p, length, caplen, NULL, NULL); + if (llc_hdrlen < 0) goto unknown; /* unknown LLC type */ + hdrlen += llc_hdrlen; break; default: + /*FALLTHROUGH*/ + unknown: - /* ether_type not known, print raw packet */ - if (!eflag) - sll_print(sllp, length + SLL_HDR_LEN); - if (extracted_ethertype) { - printf("(LLC %s) ", - etherproto_string(htons(extracted_ethertype))); - } - if (!xflag && !qflag) - default_print(p, caplen); + /* packet type not known, print raw packet */ + if (!ndo->ndo_suppress_default_print) + ND_DEFAULTPRINT(p, caplen); break; } - } else if (ether_encap_print(ether_type, p, length, caplen, - &extracted_ethertype) == 0) { - /* ether_type not known, print raw packet */ - if (!eflag) - sll_print(sllp, length + SLL_HDR_LEN); - if (!xflag && !qflag) - default_print(p, caplen); + } else if (ether_type == ETHERTYPE_8021Q) { + /* + * Print VLAN information, and then go back and process + * the enclosed type field. + */ + if (caplen < 4) { + ndo->ndo_protocol = "vlan"; + nd_print_trunc(ndo); + ndo->ndo_ll_hdr_len += hdrlen + caplen; + return; + } + if (ndo->ndo_eflag) { + uint16_t tag = GET_BE_U_2(p); + + ND_PRINT("%s, ", ieee8021q_tci_string(tag)); + } + + ether_type = GET_BE_U_2(p + 2); + if (ether_type <= MAX_ETHERNET_LENGTH_VAL) + ether_type = LINUX_SLL_P_802_2; + if (!ndo->ndo_qflag) { + ND_PRINT("ethertype %s, ", + tok2str(ethertype_values, "Unknown", ether_type)); + } + p += 4; + length -= 4; + caplen -= 4; + hdrlen += 4; + goto recurse; + } else { + if (ethertype_print(ndo, ether_type, p, length, caplen, NULL, NULL) == 0) { + /* ether_type not known, print raw packet */ + if (!ndo->ndo_eflag) + sll2_print(ndo, sllp, length + SLL2_HDR_LEN); + if (!ndo->ndo_suppress_default_print) + ND_DEFAULTPRINT(p, caplen); + } } - if (xflag) - default_print(p, caplen); - out: - putchar('\n'); - --infodelay; - if (infoprint) - info(0); + + ndo->ndo_ll_hdr_len += hdrlen; }