1 /*
2 * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997
3 * The Regents of the University of California. All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
16 * written permission.
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
20 */
21
22 /* \summary: Linux cooked sockets capture printer */
23
24 #ifdef HAVE_CONFIG_H
25 #include <config.h>
26 #endif
27
28 #ifdef HAVE_NET_IF_H
29 #include <net/if.h>
30 #endif
31
32 #include "netdissect-stdinc.h"
33
34 #define ND_LONGJMP_FROM_TCHECK
35 #include "netdissect.h"
36 #include "addrtoname.h"
37 #include "ethertype.h"
38 #include "extract.h"
39
40 /*
41 * For captures on Linux cooked sockets, we construct a fake header
42 * that includes:
43 *
44 * a 2-byte "packet type" which is one of:
45 *
46 * LINUX_SLL_HOST packet was sent to us
47 * LINUX_SLL_BROADCAST packet was broadcast
48 * LINUX_SLL_MULTICAST packet was multicast
49 * LINUX_SLL_OTHERHOST packet was sent to somebody else
50 * LINUX_SLL_OUTGOING packet was sent *by* us;
51 *
52 * a 2-byte Ethernet protocol field;
53 *
54 * a 2-byte link-layer type;
55 *
56 * a 2-byte link-layer address length;
57 *
58 * an 8-byte source link-layer address, whose actual length is
59 * specified by the previous value.
60 *
61 * All fields except for the link-layer address are in network byte order.
62 *
63 * DO NOT change the layout of this structure, or change any of the
64 * LINUX_SLL_ values below. If you must change the link-layer header
65 * for a "cooked" Linux capture, introduce a new DLT_ type (ask
66 * "tcpdump-workers@lists.tcpdump.org" for one, so that you don't give it
67 * a value that collides with a value already being used), and use the
68 * new header in captures of that type, so that programs that can
69 * handle DLT_LINUX_SLL captures will continue to handle them correctly
70 * without any change, and so that capture files with different headers
71 * can be told apart and programs that read them can dissect the
72 * packets in them.
73 *
74 * This structure, and the #defines below, must be the same in the
75 * libpcap and tcpdump versions of "sll.h".
76 */
77
78 /*
79 * A DLT_LINUX_SLL fake link-layer header.
80 */
81 #define SLL_HDR_LEN 16 /* total header length */
82 #define SLL_ADDRLEN 8 /* length of address field */
83
84 struct sll_header {
85 nd_uint16_t sll_pkttype; /* packet type */
86 nd_uint16_t sll_hatype; /* link-layer address type */
87 nd_uint16_t sll_halen; /* link-layer address length */
88 nd_byte sll_addr[SLL_ADDRLEN]; /* link-layer address */
89 nd_uint16_t sll_protocol; /* protocol */
90 };
91
92 /*
93 * A DLT_LINUX_SLL2 fake link-layer header.
94 */
95 #define SLL2_HDR_LEN 20 /* total header length */
96
97 struct sll2_header {
98 nd_uint16_t sll2_protocol; /* protocol */
99 nd_uint16_t sll2_reserved_mbz; /* reserved - must be zero */
100 nd_uint32_t sll2_if_index; /* 1-based interface index */
101 nd_uint16_t sll2_hatype; /* link-layer address type */
102 nd_uint8_t sll2_pkttype; /* packet type */
103 nd_uint8_t sll2_halen; /* link-layer address length */
104 nd_byte sll2_addr[SLL_ADDRLEN]; /* link-layer address */
105 };
106
107 /*
108 * The LINUX_SLL_ values for "sll_pkttype"; these correspond to the
109 * PACKET_ values on Linux, but are defined here so that they're
110 * available even on systems other than Linux, and so that they
111 * don't change even if the PACKET_ values change.
112 */
113 #define LINUX_SLL_HOST 0
114 #define LINUX_SLL_BROADCAST 1
115 #define LINUX_SLL_MULTICAST 2
116 #define LINUX_SLL_OTHERHOST 3
117 #define LINUX_SLL_OUTGOING 4
118
119 /*
120 * The LINUX_SLL_ values for "sll_protocol"; these correspond to the
121 * ETH_P_ values on Linux, but are defined here so that they're
122 * available even on systems other than Linux. We assume, for now,
123 * that the ETH_P_ values won't change in Linux; if they do, then:
124 *
125 * if we don't translate them in "pcap-linux.c", capture files
126 * won't necessarily be readable if captured on a system that
127 * defines ETH_P_ values that don't match these values;
128 *
129 * if we do translate them in "pcap-linux.c", that makes life
130 * unpleasant for the BPF code generator, as the values you test
131 * for in the kernel aren't the values that you test for when
132 * reading a capture file, so the fixup code run on BPF programs
133 * handed to the kernel ends up having to do more work.
134 *
135 * Add other values here as necessary, for handling packet types that
136 * might show up on non-Ethernet, non-802.x networks. (Not all the ones
137 * in the Linux "if_ether.h" will, I suspect, actually show up in
138 * captures.)
139 */
140 #define LINUX_SLL_P_802_3 0x0001 /* Novell 802.3 frames without 802.2 LLC header */
141 #define LINUX_SLL_P_802_2 0x0004 /* 802.2 frames (not D/I/X Ethernet) */
142
143 static const struct tok sll_pkttype_values[] = {
144 { LINUX_SLL_HOST, "In" },
145 { LINUX_SLL_BROADCAST, "B" },
146 { LINUX_SLL_MULTICAST, "M" },
147 { LINUX_SLL_OTHERHOST, "P" },
148 { LINUX_SLL_OUTGOING, "Out" },
149 { 0, NULL}
150 };
151
152 static void
sll_print(netdissect_options * ndo,const struct sll_header * sllp,u_int length)153 sll_print(netdissect_options *ndo, const struct sll_header *sllp, u_int length)
154 {
155 u_short ether_type;
156
157 ndo->ndo_protocol = "sll";
158 ND_PRINT("%3s ",
159 tok2str(sll_pkttype_values,"?",GET_BE_U_2(sllp->sll_pkttype)));
160
161 /*
162 * XXX - check the link-layer address type value?
163 * For now, we just assume 6 means Ethernet.
164 * XXX - print others as strings of hex?
165 */
166 if (GET_BE_U_2(sllp->sll_halen) == MAC_ADDR_LEN)
167 ND_PRINT("%s ", GET_ETHERADDR_STRING(sllp->sll_addr));
168
169 if (!ndo->ndo_qflag) {
170 ether_type = GET_BE_U_2(sllp->sll_protocol);
171
172 if (ether_type <= MAX_ETHERNET_LENGTH_VAL) {
173 /*
174 * Not an Ethernet type; what type is it?
175 */
176 switch (ether_type) {
177
178 case LINUX_SLL_P_802_3:
179 /*
180 * Ethernet_802.3 IPX frame.
181 */
182 ND_PRINT("802.3");
183 break;
184
185 case LINUX_SLL_P_802_2:
186 /*
187 * 802.2.
188 */
189 ND_PRINT("802.2");
190 break;
191
192 default:
193 /*
194 * What is it?
195 */
196 ND_PRINT("ethertype Unknown (0x%04x)",
197 ether_type);
198 break;
199 }
200 } else {
201 ND_PRINT("ethertype %s (0x%04x)",
202 tok2str(ethertype_values, "Unknown", ether_type),
203 ether_type);
204 }
205 ND_PRINT(", length %u: ", length);
206 }
207 }
208
209 /*
210 * This is the top level routine of the printer. 'p' points to the
211 * Linux "cooked capture" header of the packet, 'h->ts' is the timestamp,
212 * 'h->len' is the length of the packet off the wire, and 'h->caplen'
213 * is the number of bytes actually captured.
214 */
215 void
sll_if_print(netdissect_options * ndo,const struct pcap_pkthdr * h,const u_char * p)216 sll_if_print(netdissect_options *ndo, const struct pcap_pkthdr *h, const u_char *p)
217 {
218 u_int caplen = h->caplen;
219 u_int length = h->len;
220 const struct sll_header *sllp;
221 u_short hatype;
222 u_short ether_type;
223 int llc_hdrlen;
224 u_int hdrlen;
225
226 ndo->ndo_protocol = "sll";
227 ND_TCHECK_LEN(p, SLL_HDR_LEN);
228
229 sllp = (const struct sll_header *)p;
230
231 if (ndo->ndo_eflag)
232 sll_print(ndo, sllp, length);
233
234 /*
235 * Go past the cooked-mode header.
236 */
237 length -= SLL_HDR_LEN;
238 caplen -= SLL_HDR_LEN;
239 p += SLL_HDR_LEN;
240 hdrlen = SLL_HDR_LEN;
241
242 hatype = GET_BE_U_2(sllp->sll_hatype);
243 switch (hatype) {
244
245 case 803:
246 /*
247 * This is an packet with a radiotap header;
248 * just dissect the payload as such.
249 */
250 ndo->ndo_ll_hdr_len += SLL_HDR_LEN;
251 ndo->ndo_ll_hdr_len += ieee802_11_radio_print(ndo, p, length, caplen);
252 return;
253 }
254 ether_type = GET_BE_U_2(sllp->sll_protocol);
255
256 recurse:
257 /*
258 * Is it (gag) an 802.3 encapsulation, or some non-Ethernet
259 * packet type?
260 */
261 if (ether_type <= MAX_ETHERNET_LENGTH_VAL) {
262 /*
263 * Yes - what type is it?
264 */
265 switch (ether_type) {
266
267 case LINUX_SLL_P_802_3:
268 /*
269 * Ethernet_802.3 IPX frame.
270 */
271 ipx_print(ndo, p, length);
272 break;
273
274 case LINUX_SLL_P_802_2:
275 /*
276 * 802.2.
277 * Try to print the LLC-layer header & higher layers.
278 */
279 llc_hdrlen = llc_print(ndo, p, length, caplen, NULL, NULL);
280 if (llc_hdrlen < 0)
281 goto unknown; /* unknown LLC type */
282 hdrlen += llc_hdrlen;
283 break;
284
285 default:
286 /*FALLTHROUGH*/
287
288 unknown:
289 /* packet type not known, print raw packet */
290 if (!ndo->ndo_suppress_default_print)
291 ND_DEFAULTPRINT(p, caplen);
292 break;
293 }
294 } else if (ether_type == ETHERTYPE_8021Q) {
295 /*
296 * Print VLAN information, and then go back and process
297 * the enclosed type field.
298 */
299 if (caplen < 4) {
300 ndo->ndo_protocol = "vlan";
301 nd_print_trunc(ndo);
302 ndo->ndo_ll_hdr_len += hdrlen + caplen;
303 return;
304 }
305 if (ndo->ndo_eflag) {
306 uint16_t tag = GET_BE_U_2(p);
307
308 ND_PRINT("%s, ", ieee8021q_tci_string(tag));
309 }
310
311 ether_type = GET_BE_U_2(p + 2);
312 if (ether_type <= MAX_ETHERNET_LENGTH_VAL)
313 ether_type = LINUX_SLL_P_802_2;
314 if (!ndo->ndo_qflag) {
315 ND_PRINT("ethertype %s, ",
316 tok2str(ethertype_values, "Unknown", ether_type));
317 }
318 p += 4;
319 length -= 4;
320 caplen -= 4;
321 hdrlen += 4;
322 goto recurse;
323 } else {
324 if (ethertype_print(ndo, ether_type, p, length, caplen, NULL, NULL) == 0) {
325 /* ether_type not known, print raw packet */
326 if (!ndo->ndo_eflag)
327 sll_print(ndo, sllp, length + SLL_HDR_LEN);
328 if (!ndo->ndo_suppress_default_print)
329 ND_DEFAULTPRINT(p, caplen);
330 }
331 }
332
333 ndo->ndo_ll_hdr_len += hdrlen;
334 }
335
336 static void
sll2_print(netdissect_options * ndo,const struct sll2_header * sllp,u_int length)337 sll2_print(netdissect_options *ndo, const struct sll2_header *sllp, u_int length)
338 {
339 u_short ether_type;
340
341 ndo->ndo_protocol = "sll2";
342 ND_PRINT("ifindex %u ", GET_BE_U_4(sllp->sll2_if_index));
343
344 /*
345 * XXX - check the link-layer address type value?
346 * For now, we just assume 6 means Ethernet.
347 * XXX - print others as strings of hex?
348 */
349 if (GET_U_1(sllp->sll2_halen) == MAC_ADDR_LEN)
350 ND_PRINT("%s ", GET_ETHERADDR_STRING(sllp->sll2_addr));
351
352 if (!ndo->ndo_qflag) {
353 ether_type = GET_BE_U_2(sllp->sll2_protocol);
354
355 if (ether_type <= MAX_ETHERNET_LENGTH_VAL) {
356 /*
357 * Not an Ethernet type; what type is it?
358 */
359 switch (ether_type) {
360
361 case LINUX_SLL_P_802_3:
362 /*
363 * Ethernet_802.3 IPX frame.
364 */
365 ND_PRINT("802.3");
366 break;
367
368 case LINUX_SLL_P_802_2:
369 /*
370 * 802.2.
371 */
372 ND_PRINT("802.2");
373 break;
374
375 default:
376 /*
377 * What is it?
378 */
379 ND_PRINT("ethertype Unknown (0x%04x)",
380 ether_type);
381 break;
382 }
383 } else {
384 ND_PRINT("ethertype %s (0x%04x)",
385 tok2str(ethertype_values, "Unknown", ether_type),
386 ether_type);
387 }
388 ND_PRINT(", length %u: ", length);
389 }
390 }
391
392 /*
393 * This is the top level routine of the printer. 'p' points to the
394 * Linux "cooked capture" header of the packet, 'h->ts' is the timestamp,
395 * 'h->len' is the length of the packet off the wire, and 'h->caplen'
396 * is the number of bytes actually captured.
397 */
398 void
sll2_if_print(netdissect_options * ndo,const struct pcap_pkthdr * h,const u_char * p)399 sll2_if_print(netdissect_options *ndo, const struct pcap_pkthdr *h, const u_char *p)
400 {
401 u_int caplen = h->caplen;
402 u_int length = h->len;
403 const struct sll2_header *sllp;
404 u_short hatype;
405 u_short ether_type;
406 int llc_hdrlen;
407 u_int hdrlen;
408 #ifdef HAVE_NET_IF_H
409 uint32_t if_index;
410 char ifname[IF_NAMESIZE];
411 #endif
412
413 ndo->ndo_protocol = "sll2";
414 ND_TCHECK_LEN(p, SLL2_HDR_LEN);
415
416 sllp = (const struct sll2_header *)p;
417 #ifdef HAVE_NET_IF_H
418 if_index = GET_BE_U_4(sllp->sll2_if_index);
419 if (!if_indextoname(if_index, ifname))
420 strncpy(ifname, "?", 2);
421 ND_PRINT("%-5s ", ifname);
422 #endif
423
424 ND_PRINT("%-3s ",
425 tok2str(sll_pkttype_values, "?", GET_U_1(sllp->sll2_pkttype)));
426
427 if (ndo->ndo_eflag)
428 sll2_print(ndo, sllp, length);
429
430 /*
431 * Go past the cooked-mode header.
432 */
433 length -= SLL2_HDR_LEN;
434 caplen -= SLL2_HDR_LEN;
435 p += SLL2_HDR_LEN;
436 hdrlen = SLL2_HDR_LEN;
437
438 hatype = GET_BE_U_2(sllp->sll2_hatype);
439 switch (hatype) {
440
441 case 803:
442 /*
443 * This is an packet with a radiotap header;
444 * just dissect the payload as such.
445 */
446 ndo->ndo_ll_hdr_len += SLL2_HDR_LEN;
447 ndo->ndo_ll_hdr_len += ieee802_11_radio_print(ndo, p, length, caplen);
448 return;
449 }
450 ether_type = GET_BE_U_2(sllp->sll2_protocol);
451
452 recurse:
453 /*
454 * Is it (gag) an 802.3 encapsulation, or some non-Ethernet
455 * packet type?
456 */
457 if (ether_type <= MAX_ETHERNET_LENGTH_VAL) {
458 /*
459 * Yes - what type is it?
460 */
461 switch (ether_type) {
462
463 case LINUX_SLL_P_802_3:
464 /*
465 * Ethernet_802.3 IPX frame.
466 */
467 ipx_print(ndo, p, length);
468 break;
469
470 case LINUX_SLL_P_802_2:
471 /*
472 * 802.2.
473 * Try to print the LLC-layer header & higher layers.
474 */
475 llc_hdrlen = llc_print(ndo, p, length, caplen, NULL, NULL);
476 if (llc_hdrlen < 0)
477 goto unknown; /* unknown LLC type */
478 hdrlen += llc_hdrlen;
479 break;
480
481 default:
482 /*FALLTHROUGH*/
483
484 unknown:
485 /* packet type not known, print raw packet */
486 if (!ndo->ndo_suppress_default_print)
487 ND_DEFAULTPRINT(p, caplen);
488 break;
489 }
490 } else if (ether_type == ETHERTYPE_8021Q) {
491 /*
492 * Print VLAN information, and then go back and process
493 * the enclosed type field.
494 */
495 if (caplen < 4) {
496 ndo->ndo_protocol = "vlan";
497 nd_print_trunc(ndo);
498 ndo->ndo_ll_hdr_len += hdrlen + caplen;
499 return;
500 }
501 if (ndo->ndo_eflag) {
502 uint16_t tag = GET_BE_U_2(p);
503
504 ND_PRINT("%s, ", ieee8021q_tci_string(tag));
505 }
506
507 ether_type = GET_BE_U_2(p + 2);
508 if (ether_type <= MAX_ETHERNET_LENGTH_VAL)
509 ether_type = LINUX_SLL_P_802_2;
510 if (!ndo->ndo_qflag) {
511 ND_PRINT("ethertype %s, ",
512 tok2str(ethertype_values, "Unknown", ether_type));
513 }
514 p += 4;
515 length -= 4;
516 caplen -= 4;
517 hdrlen += 4;
518 goto recurse;
519 } else {
520 if (ethertype_print(ndo, ether_type, p, length, caplen, NULL, NULL) == 0) {
521 /* ether_type not known, print raw packet */
522 if (!ndo->ndo_eflag)
523 sll2_print(ndo, sllp, length + SLL2_HDR_LEN);
524 if (!ndo->ndo_suppress_default_print)
525 ND_DEFAULTPRINT(p, caplen);
526 }
527 }
528
529 ndo->ndo_ll_hdr_len += hdrlen;
530 }
531