From: Guy Harris Date: Sun, 21 Feb 2010 20:44:53 +0000 (-0800) Subject: Process VLAN frames and Alteon jumbo frames in the Ethernet printer. X-Git-Tag: tcpdump-4.1.0~9 X-Git-Url: https://git.tcpdump.org/tcpdump/commitdiff_plain/ea5736c8c68f0fc3699cff8205f2823f97a05f8b?hp=f99863c5be7e7b32757e5012af87b17f601b4459 Process VLAN frames and Alteon jumbo frames in the Ethernet printer. Instead of having the Ethernet-type handler process the VLAN and Alteon jumbo frame Ethernet type values, process them in the Ethernet (and Linux cooked-mode) dissectors. This makes it easier for the right MAC addresses to be printed for those packets. As part of that, rename ether_encap_print() to ethertype_print() - it doesn't print encapsulated Ethernet frames, it prints payloads whose packet type is indicated by an Ethernet type field value - and remove the no-longer-needed "extracted Ethernet type" argument. That also lets us eliminate it from the SNAP print routine. Make ether_print() take a function, and an argument to pass to that function, as parameters, so that, for example, the ATM LANE printer can use it and put the LEC ID into the link-layer headeer printout. --- diff --git a/interface.h b/interface.h index 3638ddf7..6e04b058 100644 --- a/interface.h +++ b/interface.h @@ -166,10 +166,10 @@ extern void hex_and_ascii_print(const char *, const u_char *, u_int); extern void hex_print_with_offset(const char *, const u_char *, u_int, u_int); extern void hex_print(const char *, const u_char *, u_int); extern void telnet_print(const u_char *, u_int); -extern int ether_encap_print(u_short, const u_char *, u_int, u_int, u_short *); +extern int ethertype_print(u_short, const u_char *, u_int, u_int); extern int llc_print(const u_char *, u_int, u_int, const u_char *, const u_char *, u_short *); -extern int snap_print(const u_char *, u_int, u_int, u_short *, u_int); +extern int snap_print(const u_char *, u_int, u_int, u_int); extern void aarp_print(const u_char *, u_int); extern void aodv_print(const u_char *, u_int, int); extern void atalk_print(const u_char *, u_int); @@ -189,7 +189,8 @@ extern u_int enc_if_print(const struct pcap_pkthdr *, const u_char *); extern u_int pflog_if_print(const struct pcap_pkthdr *, const u_char *); extern u_int arcnet_if_print(const struct pcap_pkthdr *, const u_char *); extern u_int arcnet_linux_if_print(const struct pcap_pkthdr *, const u_char *); -extern void ether_print(const u_char *, u_int, u_int); +extern void ether_print(const u_char *, u_int, u_int, + void (*)(const u_char *), const u_char *); extern u_int ether_if_print(const struct pcap_pkthdr *, const u_char *); extern u_int token_print(const u_char *, u_int, u_int); extern u_int token_if_print(const struct pcap_pkthdr *, const u_char *); diff --git a/netdissect.h b/netdissect.h index f5c9211a..e87941da 100644 --- a/netdissect.h +++ b/netdissect.h @@ -291,8 +291,8 @@ extern void hex_print_with_offset(netdissect_options *,const char *, u_int, u_int); extern void hex_print(netdissect_options *,const char *, u_int); extern void telnet_print(netdissect_options *,const u_char *, u_int); -extern int ether_encap_print(netdissect_options *,u_short, const u_char *, - u_int, u_int, u_short *); +extern int ethertype_print(netdissect_options *,u_short, const u_char *, + u_int, u_int); extern int llc_print(netdissect_options *, const u_char *, u_int, u_int, const u_char *, const u_char *, u_short *); diff --git a/print-ap1394.c b/print-ap1394.c index fe07a673..cb9d972f 100644 --- a/print-ap1394.c +++ b/print-ap1394.c @@ -91,7 +91,6 @@ ap1394_if_print(const struct pcap_pkthdr *h, const u_char *p) u_int caplen = h->caplen; struct firewire_header *fp; u_short ether_type; - u_short extracted_ether_type; if (caplen < FIREWIRE_HDRLEN) { printf("[|ap1394]"); @@ -107,10 +106,7 @@ ap1394_if_print(const struct pcap_pkthdr *h, const u_char *p) p += FIREWIRE_HDRLEN; ether_type = EXTRACT_16BITS(&fp->firewire_type); - - extracted_ether_type = 0; - if (ether_encap_print(ether_type, p, length, caplen, - &extracted_ether_type) == 0) { + if (ethertype_print(ether_type, p, length, caplen) == 0) { /* ether_type not known, print raw packet */ if (!eflag) ap1394_hdr_print((u_char *)fp, length + FIREWIRE_HDRLEN); diff --git a/print-ether.c b/print-ether.c index 581d6882..e086d166 100644 --- a/print-ether.c +++ b/print-ether.c @@ -113,20 +113,32 @@ ether_hdr_print(register const u_char *bp, u_int length) (void)printf(", length %u: ", length); } +/* + * Print an Ethernet frame. + * This might be encapsulated within another frame; we might be passed + * a pointer to a function that can print header information for that + * frame's protocol, and an argument to pass to that function. + */ void -ether_print(const u_char *p, u_int length, u_int caplen) +ether_print(const u_char *p, u_int length, u_int caplen, + void (*print_encap_header)(const u_char *), const u_char *encap_header_arg) { struct ether_header *ep; + u_int orig_length; u_short ether_type; u_short extracted_ether_type; - if (caplen < ETHER_HDRLEN) { + if (caplen < ETHER_HDRLEN || length < ETHER_HDRLEN) { printf("[|ether]"); return; } - if (eflag) + if (eflag) { + if (print_encap_header != NULL) + (*print_encap_header)(encap_header_arg); ether_hdr_print(p, length); + } + orig_length = length; length -= ETHER_HDRLEN; caplen -= ETHER_HDRLEN; @@ -135,6 +147,7 @@ ether_print(const u_char *p, u_int length, u_int caplen) ether_type = EXTRACT_16BITS(&ep->ether_type); +recurse: /* * Is it (gag) an 802.3 encapsulation? */ @@ -143,21 +156,76 @@ ether_print(const u_char *p, u_int length, u_int caplen) if (llc_print(p, length, caplen, ESRC(ep), EDST(ep), &extracted_ether_type) == 0) { /* ether_type not known, print raw packet */ - if (!eflag) - ether_hdr_print((u_char *)ep, length + ETHER_HDRLEN); + if (!eflag) { + if (print_encap_header != NULL) + (*print_encap_header)(encap_header_arg); + ether_hdr_print((u_char *)ep, orig_length); + } + + if (!suppress_default_print) + default_print(p, caplen); + } + } else if (ether_type == ETHERTYPE_8021Q) { + /* + * Print VLAN information, and then go back and process + * the enclosed type field. + */ + if (caplen < 4 || length < 4) { + printf("[|vlan]"); + return; + } + if (eflag) { + u_int16_t tag = EXTRACT_16BITS(p); + + printf("vlan %u, p %u%s, ", + tag & 0xfff, + tag >> 13, + (tag & 0x1000) ? ", CFI" : ""); + } + + ether_type = EXTRACT_16BITS(p + 2); + if (eflag && ether_type > ETHERMTU) + printf("ethertype %s, ", tok2str(ethertype_values,"0x%04x", ether_type)); + p += 4; + length -= 4; + caplen -= 4; + goto recurse; + } else if (ether_type == ETHERTYPE_JUMBO) { + /* + * Alteon jumbo frames. + * See + * + * http://tools.ietf.org/html/draft-ietf-isis-ext-eth-01 + * + * which indicates that, following the type field, + * there's an LLC header and payload. + */ + /* Try to print the LLC-layer header & higher layers */ + if (llc_print(p, length, caplen, ESRC(ep), EDST(ep), + &extracted_ether_type) == 0) { + /* ether_type not known, print raw packet */ + if (!eflag) { + if (print_encap_header != NULL) + (*print_encap_header)(encap_header_arg); + ether_hdr_print((u_char *)ep, orig_length); + } + + if (!suppress_default_print) + default_print(p, caplen); + } + } else { + if (ethertype_print(ether_type, p, length, caplen) == 0) { + /* ether_type not known, print raw packet */ + if (!eflag) { + if (print_encap_header != NULL) + (*print_encap_header)(encap_header_arg); + ether_hdr_print((u_char *)ep, orig_length); + } if (!suppress_default_print) default_print(p, caplen); } - } else if (ether_encap_print(ether_type, p, length, caplen, - &extracted_ether_type) == 0) { - /* ether_type not known, print raw packet */ - if (!eflag) - ether_hdr_print((u_char *)ep, length + ETHER_HDRLEN); - - if (!suppress_default_print) - default_print(p, caplen); - } + } } /* @@ -169,30 +237,21 @@ ether_print(const u_char *p, u_int length, u_int caplen) u_int ether_if_print(const struct pcap_pkthdr *h, const u_char *p) { - ether_print(p, h->len, h->caplen); + ether_print(p, h->len, h->caplen, NULL, NULL); return (ETHER_HDRLEN); } /* - * Prints the packet encapsulated in an Ethernet data segment - * (or an equivalent encapsulation), given the Ethernet type code. + * Prints the packet payload, given an Ethernet type code for the payload's + * protocol. * * Returns non-zero if it can do so, zero if the ethertype is unknown. - * - * The Ethernet type code is passed through a pointer; if it was - * ETHERTYPE_8021Q, it gets updated to be the Ethernet type of - * the 802.1Q payload, for the benefit of lower layers that might - * want to know what it is. */ int -ether_encap_print(u_short ether_type, const u_char *p, - u_int length, u_int caplen, u_short *extracted_ether_type) +ethertype_print(u_short ether_type, const u_char *p, u_int length, u_int caplen) { - recurse: - *extracted_ether_type = ether_type; - switch (ether_type) { case ETHERTYPE_IP: @@ -229,68 +288,6 @@ ether_encap_print(u_short ether_type, const u_char *p, ipx_print(p, length); return (1); - case ETHERTYPE_8021Q: - if (eflag) { - u_int16_t tag = EXTRACT_16BITS(p); - - printf("vlan %u, p %u%s, ", - tag & 0xfff, - tag >> 13, - (tag & 0x1000) ? ", CFI" : ""); - } - - ether_type = EXTRACT_16BITS(p + 2); - p += 4; - length -= 4; - caplen -= 4; - - if (ether_type > ETHERMTU) { - if (eflag) - printf("ethertype %s, ", - tok2str(ethertype_values,"0x%04x", ether_type)); - goto recurse; - } - - *extracted_ether_type = 0; - - if (llc_print(p, length, caplen, p - 18, p - 12, - extracted_ether_type) == 0) { - ether_hdr_print(p - 18, length + 4); - - if (!suppress_default_print) { - default_print(p - 18, caplen + 4); - } - } - - - return (1); - - case ETHERTYPE_JUMBO: - ether_type = EXTRACT_16BITS(p); - p += 2; - length -= 2; - caplen -= 2; - - if (ether_type > ETHERMTU) { - if (eflag) - printf("ethertype %s, ", - tok2str(ethertype_values,"0x%04x", ether_type)); - goto recurse; - } - - *extracted_ether_type = 0; - - if (llc_print(p, length, caplen, p - 16, p - 10, - extracted_ether_type) == 0) { - ether_hdr_print(p - 16, length + 2); - - if (!suppress_default_print) { - default_print(p - 16, caplen + 2); - } - } - - return (1); - case ETHERTYPE_ISO: isoclns_print(p+1, length-1, length-1); return(1); diff --git a/print-fr.c b/print-fr.c index f71aee66..8f1409e9 100644 --- a/print-fr.c +++ b/print-fr.c @@ -256,11 +256,10 @@ fr_print(register const u_char *p, u_int length) if (eflag) fr_hdr_print(length, addr_len, dlci, flags, extracted_ethertype); - if (ether_encap_print(extracted_ethertype, + if (ethertype_print(extracted_ethertype, p+addr_len+ETHERTYPE_LEN, length-addr_len-ETHERTYPE_LEN, - length-addr_len-ETHERTYPE_LEN, - &extracted_ethertype) == 0) + length-addr_len-ETHERTYPE_LEN) == 0) /* ether_type not known, probably it wasn't one */ printf("UI %02x! ", p[addr_len]); else @@ -297,7 +296,7 @@ fr_print(register const u_char *p, u_int length) break; case NLPID_SNAP: - if (snap_print(p, length, length, &extracted_ethertype, 0) == 0) { + if (snap_print(p, length, length, 0) == 0) { /* ether_type not known, print raw packet */ if (!eflag) fr_hdr_print(length + hdr_len, hdr_len, diff --git a/print-gre.c b/print-gre.c index 8473848d..106e6fd3 100644 --- a/print-gre.c +++ b/print-gre.c @@ -226,7 +226,7 @@ gre_print_0(const u_char *bp, u_int length) isoclns_print(bp, len, len); break; case ETHERTYPE_TEB: - ether_print(bp, len, len); + ether_print(bp, len, len, NULL, NULL); break; default: printf("gre-proto-0x%x", prot); diff --git a/print-juniper.c b/print-juniper.c index 08a929f1..55ca1c9c 100644 --- a/print-juniper.c +++ b/print-juniper.c @@ -647,7 +647,7 @@ juniper_pppoe_print(const struct pcap_pkthdr *h, register const u_char *p) p+=l2info.header_len; /* this DLT contains nothing but raw ethernet frames */ - ether_print(p, l2info.length, l2info.caplen); + ether_print(p, l2info.length, l2info.caplen, NULL, NULL); return l2info.header_len; } #endif @@ -664,7 +664,7 @@ juniper_ether_print(const struct pcap_pkthdr *h, register const u_char *p) p+=l2info.header_len; /* this DLT contains nothing but raw Ethernet frames */ - ether_print(p, l2info.length, l2info.caplen); + ether_print(p, l2info.length, l2info.caplen, NULL, NULL); return l2info.header_len; } #endif @@ -736,11 +736,10 @@ juniper_pppoe_atm_print(const struct pcap_pkthdr *h, register const u_char *p) extracted_ethertype = EXTRACT_16BITS(p); /* this DLT contains nothing but raw PPPoE frames, * prepended with a type field*/ - if (ether_encap_print(extracted_ethertype, + if (ethertype_print(extracted_ethertype, p+ETHERTYPE_LEN, l2info.length-ETHERTYPE_LEN, - l2info.caplen-ETHERTYPE_LEN, - &extracted_ethertype) == 0) + l2info.caplen-ETHERTYPE_LEN) == 0) /* ether_type not known, probably it wasn't one */ printf("unknown ethertype 0x%04x", extracted_ethertype); @@ -988,7 +987,7 @@ juniper_atm2_print(const struct pcap_pkthdr *h, register const u_char *p) if (l2info.direction != JUNIPER_BPF_PKT_IN && /* ether-over-1483 encaps ? */ (EXTRACT_32BITS(l2info.cookie) & ATM2_GAP_COUNT_MASK)) { - ether_print(p, l2info.length, l2info.caplen); + ether_print(p, l2info.length, l2info.caplen, NULL, NULL); return l2info.header_len; } diff --git a/print-lane.c b/print-lane.c index 33723aaa..54c68c82 100644 --- a/print-lane.c +++ b/print-lane.c @@ -60,25 +60,10 @@ static const struct tok lecop2str[] = { { 0, NULL } }; -static inline void -lane_hdr_print(register const u_char *bp, int length) +static void +lane_hdr_print(const u_char *bp) { - register const struct lecdatahdr_8023 *ep; - - ep = (const struct lecdatahdr_8023 *)bp; - if (qflag) - (void)printf("lecid:%x %s %s %d: ", - EXTRACT_16BITS(&ep->le_header), - etheraddr_string(ep->h_source), - etheraddr_string(ep->h_dest), - length); - else - (void)printf("lecid:%x %s %s %s %d: ", - EXTRACT_16BITS(&ep->le_header), - etheraddr_string(ep->h_source), - etheraddr_string(ep->h_dest), - etherproto_string(ep->h_type), - length); + (void)printf("lecid:%x ", EXTRACT_16BITS(bp)); } /* @@ -93,9 +78,6 @@ void lane_print(const u_char *p, u_int length, u_int caplen) { struct lane_controlhdr *lec; - struct lecdatahdr_8023 *ep; - u_short ether_type; - u_short extracted_ethertype; if (caplen < sizeof(struct lane_controlhdr)) { printf("[|lane]"); @@ -113,49 +95,18 @@ lane_print(const u_char *p, u_int length, u_int caplen) return; } - if (caplen < sizeof(struct lecdatahdr_8023)) { - printf("[|lane]"); - return; - } - - if (eflag) - lane_hdr_print(p, length); - /* - * Go past the LANE header. + * Go past the LE header. */ - length -= sizeof(struct lecdatahdr_8023); - caplen -= sizeof(struct lecdatahdr_8023); - ep = (struct lecdatahdr_8023 *)p; - p += sizeof(struct lecdatahdr_8023); - - ether_type = EXTRACT_16BITS(&ep->h_type); + length -= 2; + caplen -= 2; + p += 2; /* - * Is it (gag) an 802.3 encapsulation? + * Now print the encapsulated frame, under the assumption + * that it's an Ethernet frame. */ - if (ether_type <= ETHERMTU) { - /* Try to print the LLC-layer header & higher layers */ - if (llc_print(p, length, caplen, ep->h_source, ep->h_dest, - &extracted_ethertype) == 0) { - /* ether_type not known, print raw packet */ - if (!eflag) - lane_hdr_print((u_char *)ep, length + sizeof(*ep)); - if (extracted_ethertype) { - printf("(LLC %s) ", - etherproto_string(htons(extracted_ethertype))); - } - if (!suppress_default_print) - default_print(p, caplen); - } - } else if (ether_encap_print(ether_type, p, length, caplen, - &extracted_ethertype) == 0) { - /* ether_type not known, print raw packet */ - if (!eflag) - lane_hdr_print((u_char *)ep, length + sizeof(*ep)); - if (!suppress_default_print) - default_print(p, caplen); - } + ether_print(p, length, caplen, lane_hdr_print, p - 2); } u_int diff --git a/print-llc.c b/print-llc.c index 0c8259fb..d20fbdf1 100644 --- a/print-llc.c +++ b/print-llc.c @@ -309,8 +309,7 @@ llc_print(const u_char *p, u_int length, u_int caplen, * Does anybody ever bridge one form of LAN traffic * over a networking type that uses 802.2 LLC? */ - ret = snap_print(p+3, length-3, caplen-3, extracted_ethertype, - 2); + ret = snap_print(p+3, length-3, caplen-3, 2); if (ret) return (ret); } @@ -378,8 +377,7 @@ llc_print(const u_char *p, u_int length, u_int caplen, } int -snap_print(const u_char *p, u_int length, u_int caplen, - u_short *extracted_ethertype, u_int bridge_pad) +snap_print(const u_char *p, u_int length, u_int caplen, u_int bridge_pad) { u_int32_t orgcode; register u_short et; @@ -419,8 +417,7 @@ snap_print(const u_char *p, u_int length, u_int caplen, * Cisco hardware; the protocol ID is * an Ethernet protocol type. */ - ret = ether_encap_print(et, p, length, caplen, - extracted_ethertype); + ret = ethertype_print(et, p, length, caplen); if (ret) return (ret); break; @@ -435,8 +432,7 @@ snap_print(const u_char *p, u_int length, u_int caplen, * but used 0x000000 and an Ethernet * packet type for AARP packets. */ - ret = ether_encap_print(et, p, length, caplen, - extracted_ethertype); + ret = ethertype_print(et, p, length, caplen); if (ret) return (ret); } @@ -483,7 +479,7 @@ snap_print(const u_char *p, u_int length, u_int caplen, /* * What remains is an Ethernet packet. */ - ether_print(p, length, caplen); + ether_print(p, length, caplen, NULL, NULL); return (1); case PID_RFC2684_802_5_FCS: diff --git a/print-sll.c b/print-sll.c index 8edf3b0e..c9546585 100644 --- a/print-sll.c +++ b/print-sll.c @@ -144,6 +144,7 @@ sll_if_print(const struct pcap_pkthdr *h, const u_char *p) ether_type = EXTRACT_16BITS(&sllp->sll_protocol); +recurse: /* * Is it (gag) an 802.3 encapsulation, or some non-Ethernet * packet type? @@ -187,13 +188,43 @@ sll_if_print(const struct pcap_pkthdr *h, const u_char *p) default_print(p, caplen); break; } - } else if (ether_encap_print(ether_type, p, length, caplen, - &extracted_ethertype) == 0) { - /* ether_type not known, print raw packet */ - if (!eflag) - sll_print(sllp, length + SLL_HDR_LEN); - if (!suppress_default_print) - default_print(p, caplen); + } else if (ether_type == ETHERTYPE_8021Q) { + /* + * Print VLAN information, and then go back and process + * the enclosed type field. + */ + if (caplen < 4 || length < 4) { + printf("[|vlan]"); + return (SLL_HDR_LEN); + } + if (eflag) { + u_int16_t tag = EXTRACT_16BITS(p); + + printf("vlan %u, p %u%s, ", + tag & 0xfff, + tag >> 13, + (tag & 0x1000) ? ", CFI" : ""); + } + + ether_type = EXTRACT_16BITS(p + 2); + if (ether_type <= ETHERMTU) + ether_type = LINUX_SLL_P_802_2; + if (!qflag) { + (void)printf("ethertype %s, ", + tok2str(ethertype_values, "Unknown", ether_type)); + } + p += 4; + length -= 4; + caplen -= 4; + goto recurse; + } else { + if (ethertype_print(ether_type, p, length, caplen) == 0) { + /* ether_type not known, print raw packet */ + if (!eflag) + sll_print(sllp, length + SLL_HDR_LEN); + if (!suppress_default_print) + default_print(p, caplen); + } } return (SLL_HDR_LEN); diff --git a/print-symantec.c b/print-symantec.c index e212b1a4..0fba8e53 100644 --- a/print-symantec.c +++ b/print-symantec.c @@ -84,7 +84,6 @@ symantec_if_print(const struct pcap_pkthdr *h, const u_char *p) u_int caplen = h->caplen; struct symantec_header *sp; u_short ether_type; - u_short extracted_ether_type; if (caplen < sizeof (struct symantec_header)) { printf("[|symantec]"); @@ -108,8 +107,7 @@ symantec_if_print(const struct pcap_pkthdr *h, const u_char *p) if (!suppress_default_print) default_print(p, caplen); - } else if (ether_encap_print(ether_type, p, length, caplen, - &extracted_ether_type) == 0) { + } else if (ethertype_print(ether_type, p, length, caplen) == 0) { /* ether_type not known, print raw packet */ if (!eflag) symantec_hdr_print((u_char *)sp, length + sizeof (struct symantec_header));