1 /* 2 * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 2000 3 * The Regents of the University of California. All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that: (1) source code distributions 7 * retain the above copyright notice and this paragraph in its entirety, (2) 8 * distributions including binary code include the above copyright notice and 9 * this paragraph in its entirety in the documentation or other materials 10 * provided with the distribution, and (3) all advertising materials mentioning 11 * features or use of this software display the following acknowledgement: 12 * ``This product includes software developed by the University of California, 13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of 14 * the University nor the names of its contributors may be used to endorse 15 * or promote products derived from this software without specific prior 16 * written permission. 17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED 18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF 19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 20 */ 21 22 /* \summary: Ethernet printer */ 23 24 #ifdef HAVE_CONFIG_H 25 #include <config.h> 26 #endif 27 28 #include "netdissect-stdinc.h" 29 30 #define ND_LONGJMP_FROM_TCHECK 31 #include "netdissect.h" 32 #include "extract.h" 33 #include "addrtoname.h" 34 #include "ethertype.h" 35 36 /* 37 * Structure of an Ethernet header. 38 */ 39 struct ether_header { 40 nd_mac_addr ether_dhost; 41 nd_mac_addr ether_shost; 42 nd_uint16_t ether_length_type; 43 }; 44 45 /* 46 * Length of an Ethernet header; note that some compilers may pad 47 * "struct ether_header" to a multiple of 4 bytes, for example, so 48 * "sizeof (struct ether_header)" may not give the right answer. 49 */ 50 #define ETHER_HDRLEN 14 51 52 const struct tok ethertype_values[] = { 53 { ETHERTYPE_IP, "IPv4" }, 54 { ETHERTYPE_MPLS, "MPLS unicast" }, 55 { ETHERTYPE_MPLS_MULTI, "MPLS multicast" }, 56 { ETHERTYPE_IPV6, "IPv6" }, 57 { ETHERTYPE_8021Q, "802.1Q" }, 58 { ETHERTYPE_8021Q9100, "802.1Q-9100" }, 59 { ETHERTYPE_8021QinQ, "802.1Q-QinQ" }, 60 { ETHERTYPE_8021Q9200, "802.1Q-9200" }, 61 { ETHERTYPE_MACSEC, "802.1AE MACsec" }, 62 { ETHERTYPE_VMAN, "VMAN" }, 63 { ETHERTYPE_PUP, "PUP" }, 64 { ETHERTYPE_ARP, "ARP"}, 65 { ETHERTYPE_REVARP, "Reverse ARP"}, 66 { ETHERTYPE_NS, "NS" }, 67 { ETHERTYPE_SPRITE, "Sprite" }, 68 { ETHERTYPE_TRAIL, "Trail" }, 69 { ETHERTYPE_MOPDL, "MOP DL" }, 70 { ETHERTYPE_MOPRC, "MOP RC" }, 71 { ETHERTYPE_DN, "DN" }, 72 { ETHERTYPE_LAT, "LAT" }, 73 { ETHERTYPE_SCA, "SCA" }, 74 { ETHERTYPE_TEB, "TEB" }, 75 { ETHERTYPE_LANBRIDGE, "Lanbridge" }, 76 { ETHERTYPE_DECDNS, "DEC DNS" }, 77 { ETHERTYPE_DECDTS, "DEC DTS" }, 78 { ETHERTYPE_VEXP, "VEXP" }, 79 { ETHERTYPE_VPROD, "VPROD" }, 80 { ETHERTYPE_ATALK, "Appletalk" }, 81 { ETHERTYPE_AARP, "Appletalk ARP" }, 82 { ETHERTYPE_IPX, "IPX" }, 83 { ETHERTYPE_PPP, "PPP" }, 84 { ETHERTYPE_MPCP, "MPCP" }, 85 { ETHERTYPE_SLOW, "Slow Protocols" }, 86 { ETHERTYPE_PPPOED, "PPPoE D" }, 87 { ETHERTYPE_PPPOES, "PPPoE S" }, 88 { ETHERTYPE_EAPOL, "EAPOL" }, 89 { ETHERTYPE_RRCP, "RRCP" }, 90 { ETHERTYPE_MS_NLB_HB, "MS NLB heartbeat" }, 91 { ETHERTYPE_JUMBO, "Jumbo" }, 92 { ETHERTYPE_NSH, "NSH" }, 93 { ETHERTYPE_LOOPBACK, "Loopback" }, 94 { ETHERTYPE_ISO, "OSI" }, 95 { ETHERTYPE_GRE_ISO, "GRE-OSI" }, 96 { ETHERTYPE_CFM_OLD, "CFM (old)" }, 97 { ETHERTYPE_CFM, "CFM" }, 98 { ETHERTYPE_IEEE1905_1, "IEEE1905.1" }, 99 { ETHERTYPE_LLDP, "LLDP" }, 100 { ETHERTYPE_TIPC, "TIPC"}, 101 { ETHERTYPE_GEONET_OLD, "GeoNet (old)"}, 102 { ETHERTYPE_GEONET, "GeoNet"}, 103 { ETHERTYPE_CALM_FAST, "CALM FAST"}, 104 { ETHERTYPE_AOE, "AoE" }, 105 { ETHERTYPE_PTP, "PTP" }, 106 { ETHERTYPE_ARISTA, "Arista Vendor Specific Protocol" }, 107 { 0, NULL} 108 }; 109 110 static void 111 ether_addresses_print(netdissect_options *ndo, const u_char *src, 112 const u_char *dst) 113 { 114 ND_PRINT("%s > %s, ", 115 GET_ETHERADDR_STRING(src), GET_ETHERADDR_STRING(dst)); 116 } 117 118 static void 119 ether_type_print(netdissect_options *ndo, uint16_t type) 120 { 121 if (!ndo->ndo_qflag) 122 ND_PRINT("ethertype %s (0x%04x)", 123 tok2str(ethertype_values, "Unknown", type), type); 124 else 125 ND_PRINT("%s", 126 tok2str(ethertype_values, "Unknown Ethertype (0x%04x)", type)); 127 } 128 129 /* 130 * Common code for printing Ethernet frames. 131 * 132 * It can handle Ethernet headers with extra tag information inserted 133 * after the destination and source addresses, as is inserted by some 134 * switch chips, and extra encapsulation header information before 135 * printing Ethernet header information (such as a LANE ID for ATM LANE). 136 */ 137 static u_int 138 ether_common_print(netdissect_options *ndo, const u_char *p, u_int length, 139 u_int caplen, 140 void (*print_switch_tag)(netdissect_options *ndo, const u_char *), 141 u_int switch_tag_len, 142 void (*print_encap_header)(netdissect_options *ndo, const u_char *), 143 const u_char *encap_header_arg) 144 { 145 const struct ether_header *ehp; 146 u_int orig_length; 147 u_int hdrlen; 148 u_short length_type; 149 int printed_length; 150 int llc_hdrlen; 151 struct lladdr_info src, dst; 152 153 if (caplen < ETHER_HDRLEN + switch_tag_len) { 154 nd_print_trunc(ndo); 155 return caplen; 156 } 157 if (length < ETHER_HDRLEN + switch_tag_len) { 158 nd_print_trunc(ndo); 159 return length; 160 } 161 162 if (print_encap_header != NULL) 163 (*print_encap_header)(ndo, encap_header_arg); 164 165 orig_length = length; 166 167 /* 168 * Get the source and destination addresses, skip past them, 169 * and print them if we're printing the link-layer header. 170 */ 171 ehp = (const struct ether_header *)p; 172 src.addr = ehp->ether_shost; 173 src.addr_string = etheraddr_string; 174 dst.addr = ehp->ether_dhost; 175 dst.addr_string = etheraddr_string; 176 177 length -= 2*MAC_ADDR_LEN; 178 caplen -= 2*MAC_ADDR_LEN; 179 p += 2*MAC_ADDR_LEN; 180 hdrlen = 2*MAC_ADDR_LEN; 181 182 if (ndo->ndo_eflag) 183 ether_addresses_print(ndo, src.addr, dst.addr); 184 185 /* 186 * Print the switch tag, if we have one, and skip past it. 187 */ 188 if (print_switch_tag != NULL) 189 (*print_switch_tag)(ndo, p); 190 191 length -= switch_tag_len; 192 caplen -= switch_tag_len; 193 p += switch_tag_len; 194 hdrlen += switch_tag_len; 195 196 /* 197 * Get the length/type field, skip past it, and print it 198 * if we're printing the link-layer header. 199 */ 200 recurse: 201 length_type = GET_BE_U_2(p); 202 203 length -= 2; 204 caplen -= 2; 205 p += 2; 206 hdrlen += 2; 207 208 /* 209 * Process 802.1AE MACsec headers. 210 */ 211 printed_length = 0; 212 if (length_type == ETHERTYPE_MACSEC) { 213 /* 214 * MACsec, aka IEEE 802.1AE-2006 215 * Print the header, and try to print the payload if it's not encrypted 216 */ 217 if (ndo->ndo_eflag) { 218 ether_type_print(ndo, length_type); 219 ND_PRINT(", length %u: ", orig_length); 220 printed_length = 1; 221 } 222 223 int ret = macsec_print(ndo, &p, &length, &caplen, &hdrlen, 224 &src, &dst); 225 226 if (ret == 0) { 227 /* Payload is encrypted; print it as raw data. */ 228 if (!ndo->ndo_suppress_default_print) 229 ND_DEFAULTPRINT(p, caplen); 230 return hdrlen; 231 } else if (ret > 0) { 232 /* Problem printing the header; just quit. */ 233 return ret; 234 } else { 235 /* 236 * Keep processing type/length fields. 237 */ 238 length_type = GET_BE_U_2(p); 239 240 length -= 2; 241 caplen -= 2; 242 p += 2; 243 hdrlen += 2; 244 } 245 } 246 247 /* 248 * Process VLAN tag types. 249 */ 250 while (length_type == ETHERTYPE_8021Q || 251 length_type == ETHERTYPE_8021Q9100 || 252 length_type == ETHERTYPE_8021Q9200 || 253 length_type == ETHERTYPE_8021QinQ) { 254 /* 255 * It has a VLAN tag. 256 * Print VLAN information, and then go back and process 257 * the enclosed type field. 258 */ 259 if (caplen < 4) { 260 ndo->ndo_protocol = "vlan"; 261 nd_print_trunc(ndo); 262 return hdrlen + caplen; 263 } 264 if (length < 4) { 265 ndo->ndo_protocol = "vlan"; 266 nd_print_trunc(ndo); 267 return hdrlen + length; 268 } 269 if (ndo->ndo_eflag) { 270 uint16_t tag = GET_BE_U_2(p); 271 272 ether_type_print(ndo, length_type); 273 if (!printed_length) { 274 ND_PRINT(", length %u: ", orig_length); 275 printed_length = 1; 276 } else 277 ND_PRINT(", "); 278 ND_PRINT("%s, ", ieee8021q_tci_string(tag)); 279 } 280 281 length_type = GET_BE_U_2(p + 2); 282 p += 4; 283 length -= 4; 284 caplen -= 4; 285 hdrlen += 4; 286 } 287 288 /* 289 * We now have the final length/type field. 290 */ 291 if (length_type <= MAX_ETHERNET_LENGTH_VAL) { 292 /* 293 * It's a length field, containing the length of the 294 * remaining payload; use it as such, as long as 295 * it's not too large (bigger than the actual payload). 296 */ 297 if (length_type < length) { 298 length = length_type; 299 if (caplen > length) 300 caplen = length; 301 } 302 303 /* 304 * Cut off the snapshot length to the end of the 305 * payload. 306 */ 307 nd_push_snapend(ndo, p + length); 308 309 if (ndo->ndo_eflag) { 310 ND_PRINT("802.3"); 311 if (!printed_length) 312 ND_PRINT(", length %u: ", length); 313 } 314 315 /* 316 * An LLC header follows the length. Print that and 317 * higher layers. 318 */ 319 llc_hdrlen = llc_print(ndo, p, length, caplen, &src, &dst); 320 if (llc_hdrlen < 0) { 321 /* packet type not known, print raw packet */ 322 if (!ndo->ndo_suppress_default_print) 323 ND_DEFAULTPRINT(p, caplen); 324 llc_hdrlen = -llc_hdrlen; 325 } 326 hdrlen += llc_hdrlen; 327 nd_pop_packet_info(ndo); 328 } else if (length_type == ETHERTYPE_JUMBO) { 329 /* 330 * It's a type field, with the type for Alteon jumbo frames. 331 * See 332 * 333 * https://tools.ietf.org/html/draft-ietf-isis-ext-eth-01 334 * 335 * which indicates that, following the type field, 336 * there's an LLC header and payload. 337 */ 338 /* Try to print the LLC-layer header & higher layers */ 339 llc_hdrlen = llc_print(ndo, p, length, caplen, &src, &dst); 340 if (llc_hdrlen < 0) { 341 /* packet type not known, print raw packet */ 342 if (!ndo->ndo_suppress_default_print) 343 ND_DEFAULTPRINT(p, caplen); 344 llc_hdrlen = -llc_hdrlen; 345 } 346 hdrlen += llc_hdrlen; 347 } else if (length_type == ETHERTYPE_ARISTA) { 348 if (caplen < 2) { 349 ND_PRINT("[|arista]"); 350 return hdrlen + caplen; 351 } 352 if (length < 2) { 353 ND_PRINT("[|arista]"); 354 return hdrlen + length; 355 } 356 ether_type_print(ndo, length_type); 357 ND_PRINT(", length %u: ", orig_length); 358 int bytesConsumed = arista_ethertype_print(ndo, p, length); 359 if (bytesConsumed > 0) { 360 p += bytesConsumed; 361 length -= bytesConsumed; 362 caplen -= bytesConsumed; 363 hdrlen += bytesConsumed; 364 goto recurse; 365 } else { 366 /* subtype/version not known, print raw packet */ 367 if (!ndo->ndo_eflag && length_type > MAX_ETHERNET_LENGTH_VAL) { 368 ether_addresses_print(ndo, src.addr, dst.addr); 369 ether_type_print(ndo, length_type); 370 ND_PRINT(", length %u: ", orig_length); 371 } 372 if (!ndo->ndo_suppress_default_print) 373 ND_DEFAULTPRINT(p, caplen); 374 } 375 } else { 376 /* 377 * It's a type field with some other value. 378 */ 379 if (ndo->ndo_eflag) { 380 ether_type_print(ndo, length_type); 381 if (!printed_length) 382 ND_PRINT(", length %u: ", orig_length); 383 else 384 ND_PRINT(", "); 385 } 386 if (ethertype_print(ndo, length_type, p, length, caplen, &src, &dst) == 0) { 387 /* type not known, print raw packet */ 388 if (!ndo->ndo_eflag) { 389 /* 390 * We didn't print the full link-layer 391 * header, as -e wasn't specified, so 392 * print only the source and destination 393 * MAC addresses and the final Ethernet 394 * type. 395 */ 396 ether_addresses_print(ndo, src.addr, dst.addr); 397 ether_type_print(ndo, length_type); 398 ND_PRINT(", length %u: ", orig_length); 399 } 400 401 if (!ndo->ndo_suppress_default_print) 402 ND_DEFAULTPRINT(p, caplen); 403 } 404 } 405 return hdrlen; 406 } 407 408 /* 409 * Print an Ethernet frame while specyfing a non-standard Ethernet header 410 * length. 411 * This might be encapsulated within another frame; we might be passed 412 * a pointer to a function that can print header information for that 413 * frame's protocol, and an argument to pass to that function. 414 * 415 * FIXME: caplen can and should be derived from ndo->ndo_snapend and p. 416 */ 417 u_int 418 ether_switch_tag_print(netdissect_options *ndo, const u_char *p, u_int length, 419 u_int caplen, 420 void (*print_switch_tag)(netdissect_options *, const u_char *), 421 u_int switch_tag_len) 422 { 423 return ether_common_print(ndo, p, length, caplen, print_switch_tag, 424 switch_tag_len, NULL, NULL); 425 } 426 427 /* 428 * Print an Ethernet frame. 429 * This might be encapsulated within another frame; we might be passed 430 * a pointer to a function that can print header information for that 431 * frame's protocol, and an argument to pass to that function. 432 * 433 * FIXME: caplen can and should be derived from ndo->ndo_snapend and p. 434 */ 435 u_int 436 ether_print(netdissect_options *ndo, 437 const u_char *p, u_int length, u_int caplen, 438 void (*print_encap_header)(netdissect_options *ndo, const u_char *), 439 const u_char *encap_header_arg) 440 { 441 ndo->ndo_protocol = "ether"; 442 return ether_common_print(ndo, p, length, caplen, NULL, 0, 443 print_encap_header, encap_header_arg); 444 } 445 446 /* 447 * This is the top level routine of the printer. 'p' points 448 * to the ether header of the packet, 'h->len' is the length 449 * of the packet off the wire, and 'h->caplen' is the number 450 * of bytes actually captured. 451 */ 452 void 453 ether_if_print(netdissect_options *ndo, const struct pcap_pkthdr *h, 454 const u_char *p) 455 { 456 ndo->ndo_protocol = "ether"; 457 ndo->ndo_ll_hdr_len += 458 ether_print(ndo, p, h->len, h->caplen, NULL, NULL); 459 } 460 461 /* 462 * This is the top level routine of the printer. 'p' points 463 * to the ether header of the packet, 'h->len' is the length 464 * of the packet off the wire, and 'h->caplen' is the number 465 * of bytes actually captured. 466 * 467 * This is for DLT_NETANALYZER, which has a 4-byte pseudo-header 468 * before the Ethernet header. 469 */ 470 void 471 netanalyzer_if_print(netdissect_options *ndo, const struct pcap_pkthdr *h, 472 const u_char *p) 473 { 474 /* 475 * Fail if we don't have enough data for the Hilscher pseudo-header. 476 */ 477 ndo->ndo_protocol = "netanalyzer"; 478 ND_TCHECK_LEN(p, 4); 479 480 /* Skip the pseudo-header. */ 481 ndo->ndo_ll_hdr_len += 4; 482 ndo->ndo_ll_hdr_len += 483 ether_print(ndo, p + 4, h->len - 4, h->caplen - 4, NULL, NULL); 484 } 485 486 /* 487 * This is the top level routine of the printer. 'p' points 488 * to the ether header of the packet, 'h->len' is the length 489 * of the packet off the wire, and 'h->caplen' is the number 490 * of bytes actually captured. 491 * 492 * This is for DLT_NETANALYZER_TRANSPARENT, which has a 4-byte 493 * pseudo-header, a 7-byte Ethernet preamble, and a 1-byte Ethernet SOF 494 * before the Ethernet header. 495 */ 496 void 497 netanalyzer_transparent_if_print(netdissect_options *ndo, 498 const struct pcap_pkthdr *h, 499 const u_char *p) 500 { 501 /* 502 * Fail if we don't have enough data for the Hilscher pseudo-header, 503 * preamble, and SOF. 504 */ 505 ndo->ndo_protocol = "netanalyzer_transparent"; 506 ND_TCHECK_LEN(p, 12); 507 508 /* Skip the pseudo-header, preamble, and SOF. */ 509 ndo->ndo_ll_hdr_len += 12; 510 ndo->ndo_ll_hdr_len += 511 ether_print(ndo, p + 12, h->len - 12, h->caplen - 12, NULL, NULL); 512 } 513 514 /* 515 * Prints the packet payload, given an Ethernet type code for the payload's 516 * protocol. 517 * 518 * Returns non-zero if it can do so, zero if the ethertype is unknown. 519 */ 520 521 int 522 ethertype_print(netdissect_options *ndo, 523 u_short ether_type, const u_char *p, 524 u_int length, u_int caplen, 525 const struct lladdr_info *src, const struct lladdr_info *dst) 526 { 527 switch (ether_type) { 528 529 case ETHERTYPE_IP: 530 ip_print(ndo, p, length); 531 return (1); 532 533 case ETHERTYPE_IPV6: 534 ip6_print(ndo, p, length); 535 return (1); 536 537 case ETHERTYPE_ARP: 538 case ETHERTYPE_REVARP: 539 arp_print(ndo, p, length, caplen); 540 return (1); 541 542 case ETHERTYPE_DN: 543 decnet_print(ndo, p, length, caplen); 544 return (1); 545 546 case ETHERTYPE_ATALK: 547 if (ndo->ndo_vflag) 548 ND_PRINT("et1 "); 549 atalk_print(ndo, p, length); 550 return (1); 551 552 case ETHERTYPE_AARP: 553 aarp_print(ndo, p, length); 554 return (1); 555 556 case ETHERTYPE_IPX: 557 ND_PRINT("(NOV-ETHII) "); 558 ipx_print(ndo, p, length); 559 return (1); 560 561 case ETHERTYPE_ISO: 562 if (length == 0 || caplen == 0) { 563 ndo->ndo_protocol = "isoclns"; 564 nd_print_trunc(ndo); 565 return (1); 566 } 567 /* At least one byte is required */ 568 /* FIXME: Reference for this byte? */ 569 ND_TCHECK_LEN(p, 1); 570 isoclns_print(ndo, p + 1, length - 1); 571 return(1); 572 573 case ETHERTYPE_PPPOED: 574 case ETHERTYPE_PPPOES: 575 case ETHERTYPE_PPPOED2: 576 case ETHERTYPE_PPPOES2: 577 pppoe_print(ndo, p, length); 578 return (1); 579 580 case ETHERTYPE_EAPOL: 581 eapol_print(ndo, p); 582 return (1); 583 584 case ETHERTYPE_RRCP: 585 rrcp_print(ndo, p, length, src, dst); 586 return (1); 587 588 case ETHERTYPE_PPP: 589 if (length) { 590 ND_PRINT(": "); 591 ppp_print(ndo, p, length); 592 } 593 return (1); 594 595 case ETHERTYPE_MPCP: 596 mpcp_print(ndo, p, length); 597 return (1); 598 599 case ETHERTYPE_SLOW: 600 slow_print(ndo, p, length); 601 return (1); 602 603 case ETHERTYPE_CFM: 604 case ETHERTYPE_CFM_OLD: 605 cfm_print(ndo, p, length); 606 return (1); 607 608 case ETHERTYPE_LLDP: 609 lldp_print(ndo, p, length); 610 return (1); 611 612 case ETHERTYPE_NSH: 613 nsh_print(ndo, p, length); 614 return (1); 615 616 case ETHERTYPE_LOOPBACK: 617 loopback_print(ndo, p, length); 618 return (1); 619 620 case ETHERTYPE_MPLS: 621 case ETHERTYPE_MPLS_MULTI: 622 mpls_print(ndo, p, length); 623 return (1); 624 625 case ETHERTYPE_TIPC: 626 tipc_print(ndo, p, length, caplen); 627 return (1); 628 629 case ETHERTYPE_MS_NLB_HB: 630 msnlb_print(ndo, p); 631 return (1); 632 633 case ETHERTYPE_GEONET_OLD: 634 case ETHERTYPE_GEONET: 635 geonet_print(ndo, p, length, src); 636 return (1); 637 638 case ETHERTYPE_CALM_FAST: 639 calm_fast_print(ndo, p, length, src); 640 return (1); 641 642 case ETHERTYPE_AOE: 643 aoe_print(ndo, p, length); 644 return (1); 645 646 case ETHERTYPE_PTP: 647 ptp_print(ndo, p, length); 648 return (1); 649 650 case ETHERTYPE_LAT: 651 case ETHERTYPE_SCA: 652 case ETHERTYPE_MOPRC: 653 case ETHERTYPE_MOPDL: 654 case ETHERTYPE_IEEE1905_1: 655 /* default_print for now */ 656 default: 657 return (0); 658 } 659 } 660