xref: /openbsd-src/usr.sbin/tcpdump/print-ether.c (revision 91f110e064cd7c194e59e019b83bb7496c1c84d4)
1 /*	$OpenBSD: print-ether.c,v 1.27 2010/01/14 04:57:06 jsing Exp $	*/
2 
3 /*
4  * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997
5  *	The Regents of the University of California.  All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that: (1) source code distributions
9  * retain the above copyright notice and this paragraph in its entirety, (2)
10  * distributions including binary code include the above copyright notice and
11  * this paragraph in its entirety in the documentation or other materials
12  * provided with the distribution, and (3) all advertising materials mentioning
13  * features or use of this software display the following acknowledgement:
14  * ``This product includes software developed by the University of California,
15  * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
16  * the University nor the names of its contributors may be used to endorse
17  * or promote products derived from this software without specific prior
18  * written permission.
19  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
20  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
21  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
22  */
23 
24 #include <sys/param.h>
25 #include <sys/time.h>
26 #include <sys/socket.h>
27 
28 struct mbuf;
29 struct rtentry;
30 #include <net/if.h>
31 
32 #include <netinet/in.h>
33 #include <netinet/if_ether.h>
34 #include <netinet/in_systm.h>
35 #include <netinet/ip.h>
36 #include <netinet/ip_var.h>
37 #include <netinet/udp.h>
38 #include <netinet/udp_var.h>
39 #include <netinet/tcp.h>
40 
41 #include <stdio.h>
42 #include <pcap.h>
43 
44 #ifdef INET6
45 #include <netinet/ip6.h>
46 #endif
47 
48 #include "interface.h"
49 #include "addrtoname.h"
50 #include "ethertype.h"
51 #include "extract.h"
52 
53 const u_char *packetp;
54 const u_char *snapend;
55 
56 void ether_macctl(const u_char *, u_int);
57 
58 void
59 ether_print(register const u_char *bp, u_int length)
60 {
61 	register const struct ether_header *ep;
62 
63 	ep = (const struct ether_header *)bp;
64 	if (qflag) {
65 		TCHECK2(*ep, 12);
66 		(void)printf("%s %s %d: ",
67 			     etheraddr_string(ESRC(ep)),
68 			     etheraddr_string(EDST(ep)),
69 			     length);
70 	} else {
71 		TCHECK2(*ep, 14);
72 		(void)printf("%s %s %s %d: ",
73 			     etheraddr_string(ESRC(ep)),
74 			     etheraddr_string(EDST(ep)),
75 			     etherproto_string(ep->ether_type),
76 			     length);
77 	}
78 	return;
79 trunc:
80 	printf("[|ether] ");
81 }
82 
83 u_short extracted_ethertype;
84 
85 /*
86  * This is the top level routine of the printer.  'p' is the points
87  * to the ether header of the packet, 'tvp' is the timestamp,
88  * 'length' is the length of the packet off the wire, and 'caplen'
89  * is the number of bytes actually captured.
90  */
91 void
92 ether_if_print(u_char *user, const struct pcap_pkthdr *h, const u_char *p)
93 {
94 	u_int caplen = h->caplen;
95 	u_int length = h->len;
96 	struct ether_header *ep;
97 	u_short ether_type;
98 
99 	ts_print(&h->ts);
100 
101 	if (caplen < sizeof(struct ether_header)) {
102 		printf("[|ether]");
103 		goto out;
104 	}
105 
106 	/*
107 	 * Some printers want to get back at the ethernet addresses,
108 	 * and/or check that they're not walking off the end of the packet.
109 	 * Rather than pass them all the way down, we set these globals.
110 	 */
111 	packetp = p;
112 	snapend = p + caplen;
113 
114 	if (eflag)
115 		ether_print(p, length);
116 
117 	length -= sizeof(struct ether_header);
118 	caplen -= sizeof(struct ether_header);
119 	ep = (struct ether_header *)p;
120 	p += sizeof(struct ether_header);
121 
122 	ether_type = ntohs(ep->ether_type);
123 
124 	/*
125 	 * Is it (gag) an 802.3 encapsulation?
126 	 */
127 	extracted_ethertype = 0;
128 	if (ether_type <= ETHERMTU) {
129 		/* Try to print the LLC-layer header & higher layers */
130 		if (llc_print(p, length, caplen, ESRC(ep), EDST(ep)) == 0) {
131 			/* ether_type not known, print raw packet */
132 			if (!eflag)
133 				ether_print((u_char *)ep, length);
134 			if (extracted_ethertype) {
135 				printf("(LLC %s) ",
136 			       etherproto_string(htons(extracted_ethertype)));
137 			}
138 			if (!xflag && !qflag) {
139 				if (eflag)
140 					default_print(packetp,
141 					    snapend - packetp);
142 				else
143 					default_print(p, caplen);
144 			}
145 		}
146 	} else if (ether_encap_print(ether_type, p, length, caplen) == 0) {
147 		/* ether_type not known, print raw packet */
148 		if (!eflag)
149 			ether_print((u_char *)ep, length + sizeof(*ep));
150 		if (!xflag && !qflag) {
151 			if (eflag)
152 				default_print(packetp, snapend - packetp);
153 			else
154 				default_print(p, caplen);
155 		}
156 	}
157 	if (xflag) {
158 		if (eflag)
159 			default_print(packetp, snapend - packetp);
160 		else
161 			default_print(p, caplen);
162 	}
163  out:
164 	putchar('\n');
165 }
166 
167 /*
168  * Prints the packet encapsulated in an Ethernet data segment
169  * (or an equivalent encapsulation), given the Ethernet type code.
170  *
171  * Returns non-zero if it can do so, zero if the ethertype is unknown.
172  *
173  * Stuffs the ether type into a global for the benefit of lower layers
174  * that might want to know what it is.
175  */
176 
177 int
178 ether_encap_print(u_short ethertype, const u_char *p,
179     u_int length, u_int caplen)
180 {
181 recurse:
182 	extracted_ethertype = ethertype;
183 
184 	switch (ethertype) {
185 
186 	case ETHERTYPE_IP:
187 		ip_print(p, length);
188 		return (1);
189 
190 #ifdef INET6
191 	case ETHERTYPE_IPV6:
192 		ip6_print(p, length);
193 		return (1);
194 #endif /*INET6*/
195 
196 	case ETHERTYPE_ARP:
197 	case ETHERTYPE_REVARP:
198 		arp_print(p, length, caplen);
199 		return (1);
200 
201 	case ETHERTYPE_DN:
202 		decnet_print(p, length, caplen);
203 		return (1);
204 
205 	case ETHERTYPE_ATALK:
206 		if (vflag)
207 			fputs("et1 ", stdout);
208 		atalk_print_llap(p, length);
209 		return (1);
210 
211 	case ETHERTYPE_AARP:
212 		aarp_print(p, length);
213 		return (1);
214 
215 	case ETHERTYPE_8021Q:
216 		printf("802.1Q ");
217 	case ETHERTYPE_QINQ:
218 		if (ethertype == ETHERTYPE_QINQ)
219 			printf("QinQ s");
220 		printf("vid %d pri %d%s",
221 		       ntohs(*(unsigned short*)p)&0xFFF,
222 		       ntohs(*(unsigned short*)p)>>13,
223 		       (ntohs(*(unsigned short*)p)&0x1000) ? " cfi " : " ");
224 		ethertype = ntohs(*(unsigned short*)(p+2));
225 		p += 4;
226 		length -= 4;
227 		caplen -= 4;
228 		if (ethertype > ETHERMTU)
229 			goto recurse;
230 
231 		extracted_ethertype = 0;
232 
233 		if (llc_print(p, length, caplen, p-18, p-12) == 0) {
234 			/* ether_type not known, print raw packet */
235 			if (!eflag)
236 				ether_print(p-18, length+4);
237 			if (extracted_ethertype) {
238 				printf("(LLC %s) ",
239 				etherproto_string(htons(extracted_ethertype)));
240 			}
241 			if (!xflag && !qflag)
242 				default_print(p-18, caplen+4);
243 		}
244 		return (1);
245 
246 #ifdef PPP
247 	case ETHERTYPE_PPPOEDISC:
248 	case ETHERTYPE_PPPOE:
249 		pppoe_if_print(ethertype, p, length, caplen);
250 		return (1);
251 #endif
252 
253 	case ETHERTYPE_FLOWCONTROL:
254 		ether_macctl(p, length);
255 		return (1);
256 
257 	case ETHERTYPE_MPLS:
258 	case ETHERTYPE_MPLS_MCAST:
259 		mpls_print(p, length);
260 		return (1);
261 
262 	case ETHERTYPE_LLDP:
263 		lldp_print(p, length);
264 		return (1);
265 
266 	case ETHERTYPE_SLOW:
267 		slow_print(p, length);
268 		return (1);
269 
270 	case ETHERTYPE_LAT:
271 	case ETHERTYPE_SCA:
272 	case ETHERTYPE_MOPRC:
273 	case ETHERTYPE_MOPDL:
274 		/* default_print for now */
275 	default:
276 		return (0);
277 	}
278 }
279 
280 void
281 ether_macctl(const u_char *p, u_int length)
282 {
283 	printf("MACCTL");
284 
285 	if (length < 2)
286 		goto trunc;
287 	if (EXTRACT_16BITS(p) == 0x0001) {
288 		u_int plen;
289 
290 		printf(" PAUSE");
291 
292 		length -= 2;
293 		p += 2;
294 		if (length < 2)
295 			goto trunc;
296 		plen = 512 * EXTRACT_16BITS(p);
297 		printf(" quanta %u", plen);
298 	} else {
299 		printf(" unknown-opcode(0x%04x)", EXTRACT_16BITS(p));
300 	}
301 	return;
302 
303 trunc:
304 	printf("[|MACCTL]");
305 }
306