1 /*
2  * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997
3  *	The Regents of the University of California.  All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that: (1) source code distributions
7  * retain the above copyright notice and this paragraph in its entirety, (2)
8  * distributions including binary code include the above copyright notice and
9  * this paragraph in its entirety in the documentation or other materials
10  * provided with the distribution, and (3) all advertising materials mentioning
11  * features or use of this software display the following acknowledgement:
12  * ``This product includes software developed by the University of California,
13  * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14  * the University nor the names of its contributors may be used to endorse
15  * or promote products derived from this software without specific prior
16  * written permission.
17  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
20  */
21 
22 /* \summary: Linux cooked sockets capture printer */
23 
24 #ifdef HAVE_CONFIG_H
25 #include <config.h>
26 #endif
27 
28 #ifdef HAVE_NET_IF_H
29 #include <net/if.h>
30 #endif
31 
32 #include "netdissect-stdinc.h"
33 
34 #define ND_LONGJMP_FROM_TCHECK
35 #include "netdissect.h"
36 #include "addrtoname.h"
37 #include "ethertype.h"
38 #include "extract.h"
39 
40 /*
41  * For captures on Linux cooked sockets, we construct a fake header
42  * that includes:
43  *
44  *	a 2-byte "packet type" which is one of:
45  *
46  *		LINUX_SLL_HOST		packet was sent to us
47  *		LINUX_SLL_BROADCAST	packet was broadcast
48  *		LINUX_SLL_MULTICAST	packet was multicast
49  *		LINUX_SLL_OTHERHOST	packet was sent to somebody else
50  *		LINUX_SLL_OUTGOING	packet was sent *by* us;
51  *
52  *	a 2-byte Ethernet protocol field;
53  *
54  *	a 2-byte link-layer type;
55  *
56  *	a 2-byte link-layer address length;
57  *
58  *	an 8-byte source link-layer address, whose actual length is
59  *	specified by the previous value.
60  *
61  * All fields except for the link-layer address are in network byte order.
62  *
63  * DO NOT change the layout of this structure, or change any of the
64  * LINUX_SLL_ values below.  If you must change the link-layer header
65  * for a "cooked" Linux capture, introduce a new DLT_ type (ask
66  * "tcpdump-workers@lists.tcpdump.org" for one, so that you don't give it
67  * a value that collides with a value already being used), and use the
68  * new header in captures of that type, so that programs that can
69  * handle DLT_LINUX_SLL captures will continue to handle them correctly
70  * without any change, and so that capture files with different headers
71  * can be told apart and programs that read them can dissect the
72  * packets in them.
73  *
74  * This structure, and the #defines below, must be the same in the
75  * libpcap and tcpdump versions of "sll.h".
76  */
77 
78 /*
79  * A DLT_LINUX_SLL fake link-layer header.
80  */
81 #define SLL_HDR_LEN	16		/* total header length */
82 #define SLL_ADDRLEN	8		/* length of address field */
83 
84 struct sll_header {
85 	nd_uint16_t	sll_pkttype;	/* packet type */
86 	nd_uint16_t	sll_hatype;	/* link-layer address type */
87 	nd_uint16_t	sll_halen;	/* link-layer address length */
88 	nd_byte		sll_addr[SLL_ADDRLEN];	/* link-layer address */
89 	nd_uint16_t	sll_protocol;	/* protocol */
90 };
91 
92 /*
93  * A DLT_LINUX_SLL2 fake link-layer header.
94  */
95 #define SLL2_HDR_LEN	20		/* total header length */
96 
97 struct sll2_header {
98 	nd_uint16_t	sll2_protocol;		/* protocol */
99 	nd_uint16_t	sll2_reserved_mbz;	/* reserved - must be zero */
100 	nd_uint32_t	sll2_if_index;		/* 1-based interface index */
101 	nd_uint16_t	sll2_hatype;		/* link-layer address type */
102 	nd_uint8_t	sll2_pkttype;		/* packet type */
103 	nd_uint8_t	sll2_halen;		/* link-layer address length */
104 	nd_byte		sll2_addr[SLL_ADDRLEN];	/* link-layer address */
105 };
106 
107 /*
108  * The LINUX_SLL_ values for "sll_pkttype"; these correspond to the
109  * PACKET_ values on Linux, but are defined here so that they're
110  * available even on systems other than Linux, and so that they
111  * don't change even if the PACKET_ values change.
112  */
113 #define LINUX_SLL_HOST		0
114 #define LINUX_SLL_BROADCAST	1
115 #define LINUX_SLL_MULTICAST	2
116 #define LINUX_SLL_OTHERHOST	3
117 #define LINUX_SLL_OUTGOING	4
118 
119 /*
120  * The LINUX_SLL_ values for "sll_protocol"; these correspond to the
121  * ETH_P_ values on Linux, but are defined here so that they're
122  * available even on systems other than Linux.  We assume, for now,
123  * that the ETH_P_ values won't change in Linux; if they do, then:
124  *
125  *	if we don't translate them in "pcap-linux.c", capture files
126  *	won't necessarily be readable if captured on a system that
127  *	defines ETH_P_ values that don't match these values;
128  *
129  *	if we do translate them in "pcap-linux.c", that makes life
130  *	unpleasant for the BPF code generator, as the values you test
131  *	for in the kernel aren't the values that you test for when
132  *	reading a capture file, so the fixup code run on BPF programs
133  *	handed to the kernel ends up having to do more work.
134  *
135  * Add other values here as necessary, for handling packet types that
136  * might show up on non-Ethernet, non-802.x networks.  (Not all the ones
137  * in the Linux "if_ether.h" will, I suspect, actually show up in
138  * captures.)
139  */
140 #define LINUX_SLL_P_802_3	0x0001	/* Novell 802.3 frames without 802.2 LLC header */
141 #define LINUX_SLL_P_802_2	0x0004	/* 802.2 frames (not D/I/X Ethernet) */
142 
143 static const struct tok sll_pkttype_values[] = {
144     { LINUX_SLL_HOST, "In" },
145     { LINUX_SLL_BROADCAST, "B" },
146     { LINUX_SLL_MULTICAST, "M" },
147     { LINUX_SLL_OTHERHOST, "P" },
148     { LINUX_SLL_OUTGOING, "Out" },
149     { 0, NULL}
150 };
151 
152 static void
sll_print(netdissect_options * ndo,const struct sll_header * sllp,u_int length)153 sll_print(netdissect_options *ndo, const struct sll_header *sllp, u_int length)
154 {
155 	u_short ether_type;
156 
157 	ndo->ndo_protocol = "sll";
158         ND_PRINT("%3s ",
159 		 tok2str(sll_pkttype_values,"?",GET_BE_U_2(sllp->sll_pkttype)));
160 
161 	/*
162 	 * XXX - check the link-layer address type value?
163 	 * For now, we just assume 6 means Ethernet.
164 	 * XXX - print others as strings of hex?
165 	 */
166 	if (GET_BE_U_2(sllp->sll_halen) == MAC_ADDR_LEN)
167 		ND_PRINT("%s ", GET_ETHERADDR_STRING(sllp->sll_addr));
168 
169 	if (!ndo->ndo_qflag) {
170 		ether_type = GET_BE_U_2(sllp->sll_protocol);
171 
172 		if (ether_type <= MAX_ETHERNET_LENGTH_VAL) {
173 			/*
174 			 * Not an Ethernet type; what type is it?
175 			 */
176 			switch (ether_type) {
177 
178 			case LINUX_SLL_P_802_3:
179 				/*
180 				 * Ethernet_802.3 IPX frame.
181 				 */
182 				ND_PRINT("802.3");
183 				break;
184 
185 			case LINUX_SLL_P_802_2:
186 				/*
187 				 * 802.2.
188 				 */
189 				ND_PRINT("802.2");
190 				break;
191 
192 			default:
193 				/*
194 				 * What is it?
195 				 */
196 				ND_PRINT("ethertype Unknown (0x%04x)",
197 				    ether_type);
198 				break;
199 			}
200 		} else {
201 			ND_PRINT("ethertype %s (0x%04x)",
202 			    tok2str(ethertype_values, "Unknown", ether_type),
203 			    ether_type);
204 		}
205 		ND_PRINT(", length %u: ", length);
206 	}
207 }
208 
209 /*
210  * This is the top level routine of the printer.  'p' points to the
211  * Linux "cooked capture" header of the packet, 'h->ts' is the timestamp,
212  * 'h->len' is the length of the packet off the wire, and 'h->caplen'
213  * is the number of bytes actually captured.
214  */
215 void
sll_if_print(netdissect_options * ndo,const struct pcap_pkthdr * h,const u_char * p)216 sll_if_print(netdissect_options *ndo, const struct pcap_pkthdr *h, const u_char *p)
217 {
218 	u_int caplen = h->caplen;
219 	u_int length = h->len;
220 	const struct sll_header *sllp;
221 	u_short hatype;
222 	u_short ether_type;
223 	int llc_hdrlen;
224 	u_int hdrlen;
225 
226 	ndo->ndo_protocol = "sll";
227 	ND_TCHECK_LEN(p, SLL_HDR_LEN);
228 
229 	sllp = (const struct sll_header *)p;
230 
231 	if (ndo->ndo_eflag)
232 		sll_print(ndo, sllp, length);
233 
234 	/*
235 	 * Go past the cooked-mode header.
236 	 */
237 	length -= SLL_HDR_LEN;
238 	caplen -= SLL_HDR_LEN;
239 	p += SLL_HDR_LEN;
240 	hdrlen = SLL_HDR_LEN;
241 
242 	hatype = GET_BE_U_2(sllp->sll_hatype);
243 	switch (hatype) {
244 
245 	case 803:
246 		/*
247 		 * This is an packet with a radiotap header;
248 		 * just dissect the payload as such.
249 		 */
250 		ndo->ndo_ll_hdr_len += SLL_HDR_LEN;
251 		ndo->ndo_ll_hdr_len += ieee802_11_radio_print(ndo, p, length, caplen);
252 		return;
253 	}
254 	ether_type = GET_BE_U_2(sllp->sll_protocol);
255 
256 recurse:
257 	/*
258 	 * Is it (gag) an 802.3 encapsulation, or some non-Ethernet
259 	 * packet type?
260 	 */
261 	if (ether_type <= MAX_ETHERNET_LENGTH_VAL) {
262 		/*
263 		 * Yes - what type is it?
264 		 */
265 		switch (ether_type) {
266 
267 		case LINUX_SLL_P_802_3:
268 			/*
269 			 * Ethernet_802.3 IPX frame.
270 			 */
271 			ipx_print(ndo, p, length);
272 			break;
273 
274 		case LINUX_SLL_P_802_2:
275 			/*
276 			 * 802.2.
277 			 * Try to print the LLC-layer header & higher layers.
278 			 */
279 			llc_hdrlen = llc_print(ndo, p, length, caplen, NULL, NULL);
280 			if (llc_hdrlen < 0)
281 				goto unknown;	/* unknown LLC type */
282 			hdrlen += llc_hdrlen;
283 			break;
284 
285 		default:
286 			/*FALLTHROUGH*/
287 
288 		unknown:
289 			/* packet type not known, print raw packet */
290 			if (!ndo->ndo_suppress_default_print)
291 				ND_DEFAULTPRINT(p, caplen);
292 			break;
293 		}
294 	} else if (ether_type == ETHERTYPE_8021Q) {
295 		/*
296 		 * Print VLAN information, and then go back and process
297 		 * the enclosed type field.
298 		 */
299 		if (caplen < 4) {
300 			ndo->ndo_protocol = "vlan";
301 			nd_print_trunc(ndo);
302 			ndo->ndo_ll_hdr_len += hdrlen + caplen;
303 			return;
304 		}
305 	        if (ndo->ndo_eflag) {
306 			uint16_t tag = GET_BE_U_2(p);
307 
308 			ND_PRINT("%s, ", ieee8021q_tci_string(tag));
309 		}
310 
311 		ether_type = GET_BE_U_2(p + 2);
312 		if (ether_type <= MAX_ETHERNET_LENGTH_VAL)
313 			ether_type = LINUX_SLL_P_802_2;
314 		if (!ndo->ndo_qflag) {
315 			ND_PRINT("ethertype %s, ",
316 			    tok2str(ethertype_values, "Unknown", ether_type));
317 		}
318 		p += 4;
319 		length -= 4;
320 		caplen -= 4;
321 		hdrlen += 4;
322 		goto recurse;
323 	} else {
324 		if (ethertype_print(ndo, ether_type, p, length, caplen, NULL, NULL) == 0) {
325 			/* ether_type not known, print raw packet */
326 			if (!ndo->ndo_eflag)
327 				sll_print(ndo, sllp, length + SLL_HDR_LEN);
328 			if (!ndo->ndo_suppress_default_print)
329 				ND_DEFAULTPRINT(p, caplen);
330 		}
331 	}
332 
333 	ndo->ndo_ll_hdr_len += hdrlen;
334 }
335 
336 static void
sll2_print(netdissect_options * ndo,const struct sll2_header * sllp,u_int length)337 sll2_print(netdissect_options *ndo, const struct sll2_header *sllp, u_int length)
338 {
339 	u_short ether_type;
340 
341 	ndo->ndo_protocol = "sll2";
342 	ND_PRINT("ifindex %u ", GET_BE_U_4(sllp->sll2_if_index));
343 
344 	/*
345 	 * XXX - check the link-layer address type value?
346 	 * For now, we just assume 6 means Ethernet.
347 	 * XXX - print others as strings of hex?
348 	 */
349 	if (GET_U_1(sllp->sll2_halen) == MAC_ADDR_LEN)
350 		ND_PRINT("%s ", GET_ETHERADDR_STRING(sllp->sll2_addr));
351 
352 	if (!ndo->ndo_qflag) {
353 		ether_type = GET_BE_U_2(sllp->sll2_protocol);
354 
355 		if (ether_type <= MAX_ETHERNET_LENGTH_VAL) {
356 			/*
357 			 * Not an Ethernet type; what type is it?
358 			 */
359 			switch (ether_type) {
360 
361 			case LINUX_SLL_P_802_3:
362 				/*
363 				 * Ethernet_802.3 IPX frame.
364 				 */
365 				ND_PRINT("802.3");
366 				break;
367 
368 			case LINUX_SLL_P_802_2:
369 				/*
370 				 * 802.2.
371 				 */
372 				ND_PRINT("802.2");
373 				break;
374 
375 			default:
376 				/*
377 				 * What is it?
378 				 */
379 				ND_PRINT("ethertype Unknown (0x%04x)",
380 				    ether_type);
381 				break;
382 			}
383 		} else {
384 			ND_PRINT("ethertype %s (0x%04x)",
385 			    tok2str(ethertype_values, "Unknown", ether_type),
386 			    ether_type);
387 		}
388 		ND_PRINT(", length %u: ", length);
389 	}
390 }
391 
392 /*
393  * This is the top level routine of the printer.  'p' points to the
394  * Linux "cooked capture" header of the packet, 'h->ts' is the timestamp,
395  * 'h->len' is the length of the packet off the wire, and 'h->caplen'
396  * is the number of bytes actually captured.
397  */
398 void
sll2_if_print(netdissect_options * ndo,const struct pcap_pkthdr * h,const u_char * p)399 sll2_if_print(netdissect_options *ndo, const struct pcap_pkthdr *h, const u_char *p)
400 {
401 	u_int caplen = h->caplen;
402 	u_int length = h->len;
403 	const struct sll2_header *sllp;
404 	u_short hatype;
405 	u_short ether_type;
406 	int llc_hdrlen;
407 	u_int hdrlen;
408 #ifdef HAVE_NET_IF_H
409 	uint32_t if_index;
410 	char ifname[IF_NAMESIZE];
411 #endif
412 
413 	ndo->ndo_protocol = "sll2";
414 	ND_TCHECK_LEN(p, SLL2_HDR_LEN);
415 
416 	sllp = (const struct sll2_header *)p;
417 #ifdef HAVE_NET_IF_H
418 	if_index = GET_BE_U_4(sllp->sll2_if_index);
419 	if (!if_indextoname(if_index, ifname))
420 		strncpy(ifname, "?", 2);
421 	ND_PRINT("%-5s ", ifname);
422 #endif
423 
424 	ND_PRINT("%-3s ",
425 		 tok2str(sll_pkttype_values, "?", GET_U_1(sllp->sll2_pkttype)));
426 
427 	if (ndo->ndo_eflag)
428 		sll2_print(ndo, sllp, length);
429 
430 	/*
431 	 * Go past the cooked-mode header.
432 	 */
433 	length -= SLL2_HDR_LEN;
434 	caplen -= SLL2_HDR_LEN;
435 	p += SLL2_HDR_LEN;
436 	hdrlen = SLL2_HDR_LEN;
437 
438 	hatype = GET_BE_U_2(sllp->sll2_hatype);
439 	switch (hatype) {
440 
441 	case 803:
442 		/*
443 		 * This is an packet with a radiotap header;
444 		 * just dissect the payload as such.
445 		 */
446 		ndo->ndo_ll_hdr_len += SLL2_HDR_LEN;
447 		ndo->ndo_ll_hdr_len += ieee802_11_radio_print(ndo, p, length, caplen);
448 		return;
449 	}
450 	ether_type = GET_BE_U_2(sllp->sll2_protocol);
451 
452 recurse:
453 	/*
454 	 * Is it (gag) an 802.3 encapsulation, or some non-Ethernet
455 	 * packet type?
456 	 */
457 	if (ether_type <= MAX_ETHERNET_LENGTH_VAL) {
458 		/*
459 		 * Yes - what type is it?
460 		 */
461 		switch (ether_type) {
462 
463 		case LINUX_SLL_P_802_3:
464 			/*
465 			 * Ethernet_802.3 IPX frame.
466 			 */
467 			ipx_print(ndo, p, length);
468 			break;
469 
470 		case LINUX_SLL_P_802_2:
471 			/*
472 			 * 802.2.
473 			 * Try to print the LLC-layer header & higher layers.
474 			 */
475 			llc_hdrlen = llc_print(ndo, p, length, caplen, NULL, NULL);
476 			if (llc_hdrlen < 0)
477 				goto unknown;	/* unknown LLC type */
478 			hdrlen += llc_hdrlen;
479 			break;
480 
481 		default:
482 			/*FALLTHROUGH*/
483 
484 		unknown:
485 			/* packet type not known, print raw packet */
486 			if (!ndo->ndo_suppress_default_print)
487 				ND_DEFAULTPRINT(p, caplen);
488 			break;
489 		}
490 	} else if (ether_type == ETHERTYPE_8021Q) {
491 		/*
492 		 * Print VLAN information, and then go back and process
493 		 * the enclosed type field.
494 		 */
495 		if (caplen < 4) {
496 			ndo->ndo_protocol = "vlan";
497 			nd_print_trunc(ndo);
498 			ndo->ndo_ll_hdr_len += hdrlen + caplen;
499 			return;
500 		}
501 	        if (ndo->ndo_eflag) {
502 			uint16_t tag = GET_BE_U_2(p);
503 
504 			ND_PRINT("%s, ", ieee8021q_tci_string(tag));
505 		}
506 
507 		ether_type = GET_BE_U_2(p + 2);
508 		if (ether_type <= MAX_ETHERNET_LENGTH_VAL)
509 			ether_type = LINUX_SLL_P_802_2;
510 		if (!ndo->ndo_qflag) {
511 			ND_PRINT("ethertype %s, ",
512 			    tok2str(ethertype_values, "Unknown", ether_type));
513 		}
514 		p += 4;
515 		length -= 4;
516 		caplen -= 4;
517 		hdrlen += 4;
518 		goto recurse;
519 	} else {
520 		if (ethertype_print(ndo, ether_type, p, length, caplen, NULL, NULL) == 0) {
521 			/* ether_type not known, print raw packet */
522 			if (!ndo->ndo_eflag)
523 				sll2_print(ndo, sllp, length + SLL2_HDR_LEN);
524 			if (!ndo->ndo_suppress_default_print)
525 				ND_DEFAULTPRINT(p, caplen);
526 		}
527 	}
528 
529 	ndo->ndo_ll_hdr_len += hdrlen;
530 }
531