1*d881c474Schristos /* 2*d881c474Schristos * Copyright (c) 2016 Gerard Garcia <nouboh@gmail.com> 3*d881c474Schristos * Copyright (c) 2017 Red Hat, Inc. 4*d881c474Schristos * 5*d881c474Schristos * Redistribution and use in source and binary forms, with or without 6*d881c474Schristos * modification, are permitted provided that the following conditions 7*d881c474Schristos * are met: 8*d881c474Schristos * 9*d881c474Schristos * 1. Redistributions of source code must retain the above copyright 10*d881c474Schristos * notice, this list of conditions and the following disclaimer. 11*d881c474Schristos * 2. Redistributions in binary form must reproduce the above copyright 12*d881c474Schristos * notice, this list of conditions and the following disclaimer in 13*d881c474Schristos * the documentation and/or other materials provided with the 14*d881c474Schristos * distribution. 15*d881c474Schristos * 3. The names of the authors may not be used to endorse or promote 16*d881c474Schristos * products derived from this software without specific prior 17*d881c474Schristos * written permission. 18*d881c474Schristos * 19*d881c474Schristos * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR 20*d881c474Schristos * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED 21*d881c474Schristos * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 22*d881c474Schristos */ 23*d881c474Schristos 24*d881c474Schristos /* \summary: Linux vsock printer */ 25*d881c474Schristos 26*d881c474Schristos #include <config.h> 27*d881c474Schristos 28*d881c474Schristos #include "netdissect-stdinc.h" 29*d881c474Schristos #include <stddef.h> 30*d881c474Schristos 31*d881c474Schristos #include "netdissect.h" 32*d881c474Schristos #include "extract.h" 33*d881c474Schristos 34*d881c474Schristos enum af_vsockmon_transport { 35*d881c474Schristos AF_VSOCK_TRANSPORT_UNKNOWN = 0, 36*d881c474Schristos AF_VSOCK_TRANSPORT_NO_INFO = 1, /* No transport information */ 37*d881c474Schristos AF_VSOCK_TRANSPORT_VIRTIO = 2, /* Virtio transport header */ 38*d881c474Schristos }; 39*d881c474Schristos 40*d881c474Schristos static const struct tok vsock_transport[] = { 41*d881c474Schristos {AF_VSOCK_TRANSPORT_UNKNOWN, "UNKNOWN"}, 42*d881c474Schristos {AF_VSOCK_TRANSPORT_NO_INFO, "NO_INFO"}, 43*d881c474Schristos {AF_VSOCK_TRANSPORT_VIRTIO, "VIRTIO"}, 44*d881c474Schristos { 0, NULL } 45*d881c474Schristos }; 46*d881c474Schristos 47*d881c474Schristos enum af_vsockmon_op { 48*d881c474Schristos AF_VSOCK_OP_UNKNOWN = 0, 49*d881c474Schristos AF_VSOCK_OP_CONNECT = 1, 50*d881c474Schristos AF_VSOCK_OP_DISCONNECT = 2, 51*d881c474Schristos AF_VSOCK_OP_CONTROL = 3, 52*d881c474Schristos AF_VSOCK_OP_PAYLOAD = 4, 53*d881c474Schristos }; 54*d881c474Schristos 55*d881c474Schristos static const struct tok vsock_op[] = { 56*d881c474Schristos {AF_VSOCK_OP_UNKNOWN, "UNKNOWN"}, 57*d881c474Schristos {AF_VSOCK_OP_CONNECT, "CONNECT"}, 58*d881c474Schristos {AF_VSOCK_OP_DISCONNECT, "DISCONNECT"}, 59*d881c474Schristos {AF_VSOCK_OP_CONTROL, "CONTROL"}, 60*d881c474Schristos {AF_VSOCK_OP_PAYLOAD, "PAYLOAD"}, 61*d881c474Schristos { 0, NULL } 62*d881c474Schristos }; 63*d881c474Schristos 64*d881c474Schristos enum virtio_vsock_type { 65*d881c474Schristos VIRTIO_VSOCK_TYPE_STREAM = 1, 66*d881c474Schristos }; 67*d881c474Schristos 68*d881c474Schristos static const struct tok virtio_type[] = { 69*d881c474Schristos {VIRTIO_VSOCK_TYPE_STREAM, "STREAM"}, 70*d881c474Schristos { 0, NULL } 71*d881c474Schristos }; 72*d881c474Schristos 73*d881c474Schristos enum virtio_vsock_op { 74*d881c474Schristos VIRTIO_VSOCK_OP_INVALID = 0, 75*d881c474Schristos VIRTIO_VSOCK_OP_REQUEST = 1, 76*d881c474Schristos VIRTIO_VSOCK_OP_RESPONSE = 2, 77*d881c474Schristos VIRTIO_VSOCK_OP_RST = 3, 78*d881c474Schristos VIRTIO_VSOCK_OP_SHUTDOWN = 4, 79*d881c474Schristos VIRTIO_VSOCK_OP_RW = 5, 80*d881c474Schristos VIRTIO_VSOCK_OP_CREDIT_UPDATE = 6, 81*d881c474Schristos VIRTIO_VSOCK_OP_CREDIT_REQUEST = 7, 82*d881c474Schristos }; 83*d881c474Schristos 84*d881c474Schristos static const struct tok virtio_op[] = { 85*d881c474Schristos {VIRTIO_VSOCK_OP_INVALID, "INVALID"}, 86*d881c474Schristos {VIRTIO_VSOCK_OP_REQUEST, "REQUEST"}, 87*d881c474Schristos {VIRTIO_VSOCK_OP_RESPONSE, "RESPONSE"}, 88*d881c474Schristos {VIRTIO_VSOCK_OP_RST, "RST"}, 89*d881c474Schristos {VIRTIO_VSOCK_OP_SHUTDOWN, "SHUTDOWN"}, 90*d881c474Schristos {VIRTIO_VSOCK_OP_RW, "RW"}, 91*d881c474Schristos {VIRTIO_VSOCK_OP_CREDIT_UPDATE, "CREDIT UPDATE"}, 92*d881c474Schristos {VIRTIO_VSOCK_OP_CREDIT_REQUEST, "CREDIT REQUEST"}, 93*d881c474Schristos { 0, NULL } 94*d881c474Schristos }; 95*d881c474Schristos 96*d881c474Schristos /* All fields are little-endian */ 97*d881c474Schristos 98*d881c474Schristos struct virtio_vsock_hdr { 99*d881c474Schristos nd_uint64_t src_cid; 100*d881c474Schristos nd_uint64_t dst_cid; 101*d881c474Schristos nd_uint32_t src_port; 102*d881c474Schristos nd_uint32_t dst_port; 103*d881c474Schristos nd_uint32_t len; 104*d881c474Schristos nd_uint16_t type; /* enum virtio_vsock_type */ 105*d881c474Schristos nd_uint16_t op; /* enum virtio_vsock_op */ 106*d881c474Schristos nd_uint32_t flags; 107*d881c474Schristos nd_uint32_t buf_alloc; 108*d881c474Schristos nd_uint32_t fwd_cnt; 109*d881c474Schristos }; 110*d881c474Schristos 111*d881c474Schristos struct af_vsockmon_hdr { 112*d881c474Schristos nd_uint64_t src_cid; 113*d881c474Schristos nd_uint64_t dst_cid; 114*d881c474Schristos nd_uint32_t src_port; 115*d881c474Schristos nd_uint32_t dst_port; 116*d881c474Schristos nd_uint16_t op; /* enum af_vsockmon_op */ 117*d881c474Schristos nd_uint16_t transport; /* enum af_vosckmon_transport */ 118*d881c474Schristos nd_uint16_t len; /* size of transport header */ 119*d881c474Schristos nd_uint8_t reserved[2]; 120*d881c474Schristos }; 121*d881c474Schristos 122*d881c474Schristos static void 123*d881c474Schristos vsock_virtio_hdr_print(netdissect_options *ndo, const struct virtio_vsock_hdr *hdr) 124*d881c474Schristos { 125*d881c474Schristos uint16_t u16_v; 126*d881c474Schristos uint32_t u32_v; 127*d881c474Schristos 128*d881c474Schristos u32_v = GET_LE_U_4(hdr->len); 129*d881c474Schristos ND_PRINT("len %u", u32_v); 130*d881c474Schristos 131*d881c474Schristos u16_v = GET_LE_U_2(hdr->type); 132*d881c474Schristos ND_PRINT(", type %s", 133*d881c474Schristos tok2str(virtio_type, "Invalid type (%hu)", u16_v)); 134*d881c474Schristos 135*d881c474Schristos u16_v = GET_LE_U_2(hdr->op); 136*d881c474Schristos ND_PRINT(", op %s", 137*d881c474Schristos tok2str(virtio_op, "Invalid op (%hu)", u16_v)); 138*d881c474Schristos 139*d881c474Schristos u32_v = GET_LE_U_4(hdr->flags); 140*d881c474Schristos ND_PRINT(", flags %x", u32_v); 141*d881c474Schristos 142*d881c474Schristos u32_v = GET_LE_U_4(hdr->buf_alloc); 143*d881c474Schristos ND_PRINT(", buf_alloc %u", u32_v); 144*d881c474Schristos 145*d881c474Schristos u32_v = GET_LE_U_4(hdr->fwd_cnt); 146*d881c474Schristos ND_PRINT(", fwd_cnt %u", u32_v); 147*d881c474Schristos } 148*d881c474Schristos 149*d881c474Schristos /* 150*d881c474Schristos * This size had better fit in a u_int. 151*d881c474Schristos */ 152*d881c474Schristos static u_int 153*d881c474Schristos vsock_transport_hdr_size(uint16_t transport) 154*d881c474Schristos { 155*d881c474Schristos switch (transport) { 156*d881c474Schristos case AF_VSOCK_TRANSPORT_VIRTIO: 157*d881c474Schristos return (u_int)sizeof(struct virtio_vsock_hdr); 158*d881c474Schristos default: 159*d881c474Schristos return 0; 160*d881c474Schristos } 161*d881c474Schristos } 162*d881c474Schristos 163*d881c474Schristos /* Returns 0 on success, -1 on truncation */ 164*d881c474Schristos static int 165*d881c474Schristos vsock_transport_hdr_print(netdissect_options *ndo, uint16_t transport, 166*d881c474Schristos const u_char *p, const u_int caplen) 167*d881c474Schristos { 168*d881c474Schristos u_int transport_size = vsock_transport_hdr_size(transport); 169*d881c474Schristos const void *hdr; 170*d881c474Schristos 171*d881c474Schristos if (caplen < sizeof(struct af_vsockmon_hdr) + transport_size) { 172*d881c474Schristos return -1; 173*d881c474Schristos } 174*d881c474Schristos 175*d881c474Schristos hdr = p + sizeof(struct af_vsockmon_hdr); 176*d881c474Schristos switch (transport) { 177*d881c474Schristos case AF_VSOCK_TRANSPORT_VIRTIO: 178*d881c474Schristos ND_PRINT(" ("); 179*d881c474Schristos vsock_virtio_hdr_print(ndo, hdr); 180*d881c474Schristos ND_PRINT(")"); 181*d881c474Schristos break; 182*d881c474Schristos default: 183*d881c474Schristos break; 184*d881c474Schristos } 185*d881c474Schristos return 0; 186*d881c474Schristos } 187*d881c474Schristos 188*d881c474Schristos static void 189*d881c474Schristos vsock_hdr_print(netdissect_options *ndo, const u_char *p, const u_int caplen) 190*d881c474Schristos { 191*d881c474Schristos const struct af_vsockmon_hdr *hdr = (const struct af_vsockmon_hdr *)p; 192*d881c474Schristos uint16_t hdr_transport, hdr_op; 193*d881c474Schristos uint32_t hdr_src_port, hdr_dst_port; 194*d881c474Schristos uint64_t hdr_src_cid, hdr_dst_cid; 195*d881c474Schristos u_int total_hdr_size; 196*d881c474Schristos int ret = 0; 197*d881c474Schristos 198*d881c474Schristos hdr_transport = GET_LE_U_2(hdr->transport); 199*d881c474Schristos ND_PRINT("%s", 200*d881c474Schristos tok2str(vsock_transport, "Invalid transport (%u)", 201*d881c474Schristos hdr_transport)); 202*d881c474Schristos 203*d881c474Schristos /* If verbose level is more than 0 print transport details */ 204*d881c474Schristos if (ndo->ndo_vflag) { 205*d881c474Schristos ret = vsock_transport_hdr_print(ndo, hdr_transport, p, caplen); 206*d881c474Schristos if (ret == 0) 207*d881c474Schristos ND_PRINT("\n\t"); 208*d881c474Schristos } else 209*d881c474Schristos ND_PRINT(" "); 210*d881c474Schristos 211*d881c474Schristos hdr_src_cid = GET_LE_U_8(hdr->src_cid); 212*d881c474Schristos hdr_dst_cid = GET_LE_U_8(hdr->dst_cid); 213*d881c474Schristos hdr_src_port = GET_LE_U_4(hdr->src_port); 214*d881c474Schristos hdr_dst_port = GET_LE_U_4(hdr->dst_port); 215*d881c474Schristos hdr_op = GET_LE_U_2(hdr->op); 216*d881c474Schristos ND_PRINT("%" PRIu64 ".%u > %" PRIu64 ".%u %s, length %u", 217*d881c474Schristos hdr_src_cid, hdr_src_port, 218*d881c474Schristos hdr_dst_cid, hdr_dst_port, 219*d881c474Schristos tok2str(vsock_op, " invalid op (%u)", hdr_op), 220*d881c474Schristos caplen); 221*d881c474Schristos 222*d881c474Schristos if (ret < 0) 223*d881c474Schristos goto trunc; 224*d881c474Schristos 225*d881c474Schristos /* If debug level is more than 1 print payload contents */ 226*d881c474Schristos /* This size had better fit in a u_int */ 227*d881c474Schristos total_hdr_size = (u_int)sizeof(struct af_vsockmon_hdr) + 228*d881c474Schristos vsock_transport_hdr_size(hdr_transport); 229*d881c474Schristos if (ndo->ndo_vflag > 1 && hdr_op == AF_VSOCK_OP_PAYLOAD) { 230*d881c474Schristos if (caplen > total_hdr_size) { 231*d881c474Schristos const u_char *payload = p + total_hdr_size; 232*d881c474Schristos 233*d881c474Schristos ND_PRINT("\n"); 234*d881c474Schristos print_unknown_data(ndo, payload, "\t", 235*d881c474Schristos caplen - total_hdr_size); 236*d881c474Schristos } else 237*d881c474Schristos goto trunc; 238*d881c474Schristos } 239*d881c474Schristos return; 240*d881c474Schristos 241*d881c474Schristos trunc: 242*d881c474Schristos nd_print_trunc(ndo); 243*d881c474Schristos } 244*d881c474Schristos 245*d881c474Schristos void 246*d881c474Schristos vsock_if_print(netdissect_options *ndo, const struct pcap_pkthdr *h, 247*d881c474Schristos const u_char *cp) 248*d881c474Schristos { 249*d881c474Schristos u_int caplen = h->caplen; 250*d881c474Schristos 251*d881c474Schristos ndo->ndo_protocol = "vsock"; 252*d881c474Schristos 253*d881c474Schristos if (caplen < sizeof(struct af_vsockmon_hdr)) { 254*d881c474Schristos nd_print_trunc(ndo); 255*d881c474Schristos ndo->ndo_ll_hdr_len += caplen; 256*d881c474Schristos return; 257*d881c474Schristos } 258*d881c474Schristos ndo->ndo_ll_hdr_len += sizeof(struct af_vsockmon_hdr); 259*d881c474Schristos vsock_hdr_print(ndo, cp, caplen); 260*d881c474Schristos } 261