1/*
2 * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 2000
3 *	The Regents of the University of California.  All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
16 * written permission.
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
20 */
21
22/* \summary: Ethernet printer */
23
24#ifdef HAVE_CONFIG_H
25#include <config.h>
26#endif
27
28#include "netdissect-stdinc.h"
29
30#define ND_LONGJMP_FROM_TCHECK
31#include "netdissect.h"
32#include "extract.h"
33#include "addrtoname.h"
34#include "ethertype.h"
35
36/*
37 * Structure of an Ethernet header.
38 */
39struct	ether_header {
40	nd_mac_addr	ether_dhost;
41	nd_mac_addr	ether_shost;
42	nd_uint16_t	ether_length_type;
43};
44
45/*
46 * Length of an Ethernet header; note that some compilers may pad
47 * "struct ether_header" to a multiple of 4 bytes, for example, so
48 * "sizeof (struct ether_header)" may not give the right answer.
49 */
50#define ETHER_HDRLEN		14
51
52const struct tok ethertype_values[] = {
53    { ETHERTYPE_IP,		"IPv4" },
54    { ETHERTYPE_MPLS,		"MPLS unicast" },
55    { ETHERTYPE_MPLS_MULTI,	"MPLS multicast" },
56    { ETHERTYPE_IPV6,		"IPv6" },
57    { ETHERTYPE_8021Q,		"802.1Q" },
58    { ETHERTYPE_8021Q9100,	"802.1Q-9100" },
59    { ETHERTYPE_8021QinQ,	"802.1Q-QinQ" },
60    { ETHERTYPE_8021Q9200,	"802.1Q-9200" },
61    { ETHERTYPE_MACSEC,		"802.1AE MACsec" },
62    { ETHERTYPE_VMAN,		"VMAN" },
63    { ETHERTYPE_PUP,            "PUP" },
64    { ETHERTYPE_ARP,            "ARP"},
65    { ETHERTYPE_REVARP,         "Reverse ARP"},
66    { ETHERTYPE_NS,             "NS" },
67    { ETHERTYPE_SPRITE,         "Sprite" },
68    { ETHERTYPE_TRAIL,          "Trail" },
69    { ETHERTYPE_MOPDL,          "MOP DL" },
70    { ETHERTYPE_MOPRC,          "MOP RC" },
71    { ETHERTYPE_DN,             "DN" },
72    { ETHERTYPE_LAT,            "LAT" },
73    { ETHERTYPE_SCA,            "SCA" },
74    { ETHERTYPE_TEB,            "TEB" },
75    { ETHERTYPE_LANBRIDGE,      "Lanbridge" },
76    { ETHERTYPE_DECDNS,         "DEC DNS" },
77    { ETHERTYPE_DECDTS,         "DEC DTS" },
78    { ETHERTYPE_VEXP,           "VEXP" },
79    { ETHERTYPE_VPROD,          "VPROD" },
80    { ETHERTYPE_ATALK,          "Appletalk" },
81    { ETHERTYPE_AARP,           "Appletalk ARP" },
82    { ETHERTYPE_IPX,            "IPX" },
83    { ETHERTYPE_PPP,            "PPP" },
84    { ETHERTYPE_MPCP,           "MPCP" },
85    { ETHERTYPE_SLOW,           "Slow Protocols" },
86    { ETHERTYPE_PPPOED,         "PPPoE D" },
87    { ETHERTYPE_PPPOES,         "PPPoE S" },
88    { ETHERTYPE_EAPOL,          "EAPOL" },
89    { ETHERTYPE_REALTEK,        "Realtek protocols" },
90    { ETHERTYPE_MS_NLB_HB,      "MS NLB heartbeat" },
91    { ETHERTYPE_JUMBO,          "Jumbo" },
92    { ETHERTYPE_NSH,            "NSH" },
93    { ETHERTYPE_LOOPBACK,       "Loopback" },
94    { ETHERTYPE_ISO,            "OSI" },
95    { ETHERTYPE_GRE_ISO,        "GRE-OSI" },
96    { ETHERTYPE_CFM_OLD,        "CFM (old)" },
97    { ETHERTYPE_CFM,            "CFM" },
98    { ETHERTYPE_IEEE1905_1,     "IEEE1905.1" },
99    { ETHERTYPE_LLDP,           "LLDP" },
100    { ETHERTYPE_TIPC,           "TIPC"},
101    { ETHERTYPE_GEONET_OLD,     "GeoNet (old)"},
102    { ETHERTYPE_GEONET,         "GeoNet"},
103    { ETHERTYPE_CALM_FAST,      "CALM FAST"},
104    { ETHERTYPE_AOE,            "AoE" },
105    { ETHERTYPE_PTP,            "PTP" },
106    { ETHERTYPE_ARISTA,         "Arista Vendor Specific Protocol" },
107    { 0, NULL}
108};
109
110static void
111ether_addresses_print(netdissect_options *ndo, const u_char *src,
112		      const u_char *dst)
113{
114	ND_PRINT("%s > %s, ",
115		 GET_ETHERADDR_STRING(src), GET_ETHERADDR_STRING(dst));
116}
117
118static void
119ether_type_print(netdissect_options *ndo, uint16_t type)
120{
121	if (!ndo->ndo_qflag)
122		ND_PRINT("ethertype %s (0x%04x)",
123			 tok2str(ethertype_values, "Unknown", type), type);
124	else
125		ND_PRINT("%s",
126			 tok2str(ethertype_values, "Unknown Ethertype (0x%04x)", type));
127}
128
129/*
130 * Common code for printing Ethernet frames.
131 *
132 * It can handle Ethernet headers with extra tag information inserted
133 * after the destination and source addresses, as is inserted by some
134 * switch chips, and extra encapsulation header information before
135 * printing Ethernet header information (such as a LANE ID for ATM LANE).
136 */
137static u_int
138ether_common_print(netdissect_options *ndo, const u_char *p, u_int length,
139    u_int caplen,
140    void (*print_switch_tag)(netdissect_options *ndo, const u_char *),
141    u_int switch_tag_len,
142    void (*print_encap_header)(netdissect_options *ndo, const u_char *),
143    const u_char *encap_header_arg)
144{
145	const struct ether_header *ehp;
146	u_int orig_length;
147	u_int hdrlen;
148	u_short length_type;
149	int printed_length;
150	int llc_hdrlen;
151	struct lladdr_info src, dst;
152
153	if (length < caplen) {
154		ND_PRINT("[length %u < caplen %u]", length, caplen);
155		nd_print_invalid(ndo);
156		return length;
157	}
158	if (caplen < ETHER_HDRLEN + switch_tag_len) {
159		nd_print_trunc(ndo);
160		return caplen;
161	}
162
163	if (print_encap_header != NULL)
164		(*print_encap_header)(ndo, encap_header_arg);
165
166	orig_length = length;
167
168	/*
169	 * Get the source and destination addresses, skip past them,
170	 * and print them if we're printing the link-layer header.
171	 */
172	ehp = (const struct ether_header *)p;
173	src.addr = ehp->ether_shost;
174	src.addr_string = etheraddr_string;
175	dst.addr = ehp->ether_dhost;
176	dst.addr_string = etheraddr_string;
177
178	length -= 2*MAC_ADDR_LEN;
179	caplen -= 2*MAC_ADDR_LEN;
180	p += 2*MAC_ADDR_LEN;
181	hdrlen = 2*MAC_ADDR_LEN;
182
183	if (ndo->ndo_eflag)
184		ether_addresses_print(ndo, src.addr, dst.addr);
185
186	/*
187	 * Print the switch tag, if we have one, and skip past it.
188	 */
189	if (print_switch_tag != NULL)
190		(*print_switch_tag)(ndo, p);
191
192	length -= switch_tag_len;
193	caplen -= switch_tag_len;
194	p += switch_tag_len;
195	hdrlen += switch_tag_len;
196
197	/*
198	 * Get the length/type field, skip past it, and print it
199	 * if we're printing the link-layer header.
200	 */
201recurse:
202	length_type = GET_BE_U_2(p);
203
204	length -= 2;
205	caplen -= 2;
206	p += 2;
207	hdrlen += 2;
208
209	/*
210	 * Process 802.1AE MACsec headers.
211	 */
212	printed_length = 0;
213	if (length_type == ETHERTYPE_MACSEC) {
214		/*
215		 * MACsec, aka IEEE 802.1AE-2006
216		 * Print the header, and try to print the payload if it's not encrypted
217		 */
218		if (ndo->ndo_eflag) {
219			ether_type_print(ndo, length_type);
220			ND_PRINT(", length %u: ", orig_length);
221			printed_length = 1;
222		}
223
224		int ret = macsec_print(ndo, &p, &length, &caplen, &hdrlen,
225				       &src, &dst);
226
227		if (ret == 0) {
228			/* Payload is encrypted; print it as raw data. */
229			if (!ndo->ndo_suppress_default_print)
230				ND_DEFAULTPRINT(p, caplen);
231			return hdrlen;
232		} else if (ret > 0) {
233			/* Problem printing the header; just quit. */
234			return ret;
235		} else {
236			/*
237			 * Keep processing type/length fields.
238			 */
239			length_type = GET_BE_U_2(p);
240
241			ND_LCHECK_U(caplen, 2);
242			length -= 2;
243			caplen -= 2;
244			p += 2;
245			hdrlen += 2;
246		}
247	}
248
249	/*
250	 * Process VLAN tag types.
251	 */
252	while (length_type == ETHERTYPE_8021Q  ||
253		length_type == ETHERTYPE_8021Q9100 ||
254		length_type == ETHERTYPE_8021Q9200 ||
255		length_type == ETHERTYPE_8021QinQ) {
256		/*
257		 * It has a VLAN tag.
258		 * Print VLAN information, and then go back and process
259		 * the enclosed type field.
260		 */
261		if (caplen < 4) {
262			ndo->ndo_protocol = "vlan";
263			nd_print_trunc(ndo);
264			return hdrlen + caplen;
265		}
266		if (length < 4) {
267			ndo->ndo_protocol = "vlan";
268			nd_print_trunc(ndo);
269			return hdrlen + length;
270		}
271		if (ndo->ndo_eflag) {
272			uint16_t tag = GET_BE_U_2(p);
273
274			ether_type_print(ndo, length_type);
275			if (!printed_length) {
276				ND_PRINT(", length %u: ", orig_length);
277				printed_length = 1;
278			} else
279				ND_PRINT(", ");
280			ND_PRINT("%s, ", ieee8021q_tci_string(tag));
281		}
282
283		length_type = GET_BE_U_2(p + 2);
284		p += 4;
285		length -= 4;
286		caplen -= 4;
287		hdrlen += 4;
288	}
289
290	/*
291	 * We now have the final length/type field.
292	 */
293	if (length_type <= MAX_ETHERNET_LENGTH_VAL) {
294		/*
295		 * It's a length field, containing the length of the
296		 * remaining payload; use it as such, as long as
297		 * it's not too large (bigger than the actual payload).
298		 */
299		if (length_type < length) {
300			length = length_type;
301			if (caplen > length)
302				caplen = length;
303		}
304
305		/*
306		 * Cut off the snapshot length to the end of the
307		 * payload.
308		 */
309		if (!nd_push_snaplen(ndo, p, length)) {
310			(*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
311				"%s: can't push snaplen on buffer stack", __func__);
312		}
313
314		if (ndo->ndo_eflag) {
315			ND_PRINT("802.3");
316			if (!printed_length)
317				ND_PRINT(", length %u: ", length);
318		}
319
320		/*
321		 * An LLC header follows the length.  Print that and
322		 * higher layers.
323		 */
324		llc_hdrlen = llc_print(ndo, p, length, caplen, &src, &dst);
325		if (llc_hdrlen < 0) {
326			/* packet type not known, print raw packet */
327			if (!ndo->ndo_suppress_default_print)
328				ND_DEFAULTPRINT(p, caplen);
329			llc_hdrlen = -llc_hdrlen;
330		}
331		hdrlen += llc_hdrlen;
332		nd_pop_packet_info(ndo);
333	} else if (length_type == ETHERTYPE_JUMBO) {
334		/*
335		 * It's a type field, with the type for Alteon jumbo frames.
336		 * See
337		 *
338		 *	https://tools.ietf.org/html/draft-ietf-isis-ext-eth-01
339		 *
340		 * which indicates that, following the type field,
341		 * there's an LLC header and payload.
342		 */
343		/* Try to print the LLC-layer header & higher layers */
344		llc_hdrlen = llc_print(ndo, p, length, caplen, &src, &dst);
345		if (llc_hdrlen < 0) {
346			/* packet type not known, print raw packet */
347			if (!ndo->ndo_suppress_default_print)
348				ND_DEFAULTPRINT(p, caplen);
349			llc_hdrlen = -llc_hdrlen;
350		}
351		hdrlen += llc_hdrlen;
352	} else if (length_type == ETHERTYPE_ARISTA) {
353		if (caplen < 2) {
354			ND_PRINT("[|arista]");
355			return hdrlen + caplen;
356		}
357		if (length < 2) {
358			ND_PRINT("[|arista]");
359			return hdrlen + length;
360		}
361		ether_type_print(ndo, length_type);
362		ND_PRINT(", length %u: ", orig_length);
363		int bytesConsumed = arista_ethertype_print(ndo, p, length);
364		if (bytesConsumed > 0) {
365			p += bytesConsumed;
366			length -= bytesConsumed;
367			caplen -= bytesConsumed;
368			hdrlen += bytesConsumed;
369			goto recurse;
370		} else {
371			/* subtype/version not known, print raw packet */
372			if (!ndo->ndo_eflag && length_type > MAX_ETHERNET_LENGTH_VAL) {
373				ether_addresses_print(ndo, src.addr, dst.addr);
374				ether_type_print(ndo, length_type);
375				ND_PRINT(", length %u: ", orig_length);
376			}
377			 if (!ndo->ndo_suppress_default_print)
378				 ND_DEFAULTPRINT(p, caplen);
379		}
380	} else {
381		/*
382		 * It's a type field with some other value.
383		 */
384		if (ndo->ndo_eflag) {
385			ether_type_print(ndo, length_type);
386			if (!printed_length)
387				ND_PRINT(", length %u: ", orig_length);
388			else
389				ND_PRINT(", ");
390		}
391		if (ethertype_print(ndo, length_type, p, length, caplen, &src, &dst) == 0) {
392			/* type not known, print raw packet */
393			if (!ndo->ndo_eflag) {
394				/*
395				 * We didn't print the full link-layer
396				 * header, as -e wasn't specified, so
397				 * print only the source and destination
398				 * MAC addresses and the final Ethernet
399				 * type.
400				 */
401				ether_addresses_print(ndo, src.addr, dst.addr);
402				ether_type_print(ndo, length_type);
403				ND_PRINT(", length %u: ", orig_length);
404			}
405
406			if (!ndo->ndo_suppress_default_print)
407				ND_DEFAULTPRINT(p, caplen);
408		}
409	}
410invalid:
411	return hdrlen;
412}
413
414/*
415 * Print an Ethernet frame while specyfing a non-standard Ethernet header
416 * length.
417 * This might be encapsulated within another frame; we might be passed
418 * a pointer to a function that can print header information for that
419 * frame's protocol, and an argument to pass to that function.
420 *
421 * FIXME: caplen can and should be derived from ndo->ndo_snapend and p.
422 */
423u_int
424ether_switch_tag_print(netdissect_options *ndo, const u_char *p, u_int length,
425    u_int caplen,
426    void (*print_switch_tag)(netdissect_options *, const u_char *),
427    u_int switch_tag_len)
428{
429	return ether_common_print(ndo, p, length, caplen, print_switch_tag,
430				  switch_tag_len, NULL, NULL);
431}
432
433/*
434 * Print an Ethernet frame.
435 * This might be encapsulated within another frame; we might be passed
436 * a pointer to a function that can print header information for that
437 * frame's protocol, and an argument to pass to that function.
438 *
439 * FIXME: caplen can and should be derived from ndo->ndo_snapend and p.
440 */
441u_int
442ether_print(netdissect_options *ndo,
443	    const u_char *p, u_int length, u_int caplen,
444	    void (*print_encap_header)(netdissect_options *ndo, const u_char *),
445	    const u_char *encap_header_arg)
446{
447	ndo->ndo_protocol = "ether";
448	return ether_common_print(ndo, p, length, caplen, NULL, 0,
449				  print_encap_header, encap_header_arg);
450}
451
452/*
453 * This is the top level routine of the printer.  'p' points
454 * to the ether header of the packet, 'h->len' is the length
455 * of the packet off the wire, and 'h->caplen' is the number
456 * of bytes actually captured.
457 */
458void
459ether_if_print(netdissect_options *ndo, const struct pcap_pkthdr *h,
460	       const u_char *p)
461{
462	ndo->ndo_protocol = "ether";
463	ndo->ndo_ll_hdr_len +=
464		ether_print(ndo, p, h->len, h->caplen, NULL, NULL);
465}
466
467/*
468 * This is the top level routine of the printer.  'p' points
469 * to the ether header of the packet, 'h->len' is the length
470 * of the packet off the wire, and 'h->caplen' is the number
471 * of bytes actually captured.
472 *
473 * This is for DLT_NETANALYZER, which has a 4-byte pseudo-header
474 * before the Ethernet header.
475 */
476void
477netanalyzer_if_print(netdissect_options *ndo, const struct pcap_pkthdr *h,
478		     const u_char *p)
479{
480	/*
481	 * Fail if we don't have enough data for the Hilscher pseudo-header.
482	 */
483	ndo->ndo_protocol = "netanalyzer";
484	ND_TCHECK_LEN(p, 4);
485
486	/* Skip the pseudo-header. */
487	ndo->ndo_ll_hdr_len += 4;
488	ndo->ndo_ll_hdr_len +=
489		ether_print(ndo, p + 4, h->len - 4, h->caplen - 4, NULL, NULL);
490}
491
492/*
493 * This is the top level routine of the printer.  'p' points
494 * to the ether header of the packet, 'h->len' is the length
495 * of the packet off the wire, and 'h->caplen' is the number
496 * of bytes actually captured.
497 *
498 * This is for DLT_NETANALYZER_TRANSPARENT, which has a 4-byte
499 * pseudo-header, a 7-byte Ethernet preamble, and a 1-byte Ethernet SOF
500 * before the Ethernet header.
501 */
502void
503netanalyzer_transparent_if_print(netdissect_options *ndo,
504				 const struct pcap_pkthdr *h,
505				 const u_char *p)
506{
507	/*
508	 * Fail if we don't have enough data for the Hilscher pseudo-header,
509	 * preamble, and SOF.
510	 */
511	ndo->ndo_protocol = "netanalyzer_transparent";
512	ND_TCHECK_LEN(p, 12);
513
514	/* Skip the pseudo-header, preamble, and SOF. */
515	ndo->ndo_ll_hdr_len += 12;
516	ndo->ndo_ll_hdr_len +=
517		ether_print(ndo, p + 12, h->len - 12, h->caplen - 12, NULL, NULL);
518}
519
520/*
521 * Prints the packet payload, given an Ethernet type code for the payload's
522 * protocol.
523 *
524 * Returns non-zero if it can do so, zero if the ethertype is unknown.
525 */
526
527int
528ethertype_print(netdissect_options *ndo,
529		u_short ether_type, const u_char *p,
530		u_int length, u_int caplen,
531		const struct lladdr_info *src, const struct lladdr_info *dst)
532{
533	switch (ether_type) {
534
535	case ETHERTYPE_IP:
536		ip_print(ndo, p, length);
537		return (1);
538
539	case ETHERTYPE_IPV6:
540		ip6_print(ndo, p, length);
541		return (1);
542
543	case ETHERTYPE_ARP:
544	case ETHERTYPE_REVARP:
545		arp_print(ndo, p, length, caplen);
546		return (1);
547
548	case ETHERTYPE_DN:
549		decnet_print(ndo, p, length, caplen);
550		return (1);
551
552	case ETHERTYPE_ATALK:
553		if (ndo->ndo_vflag)
554			ND_PRINT("et1 ");
555		atalk_print(ndo, p, length);
556		return (1);
557
558	case ETHERTYPE_AARP:
559		aarp_print(ndo, p, length);
560		return (1);
561
562	case ETHERTYPE_IPX:
563		ND_PRINT("(NOV-ETHII) ");
564		ipx_print(ndo, p, length);
565		return (1);
566
567	case ETHERTYPE_ISO:
568		if (length == 0 || caplen == 0) {
569			ndo->ndo_protocol = "isoclns";
570			nd_print_trunc(ndo);
571			return (1);
572		}
573		/* At least one byte is required */
574		/* FIXME: Reference for this byte? */
575		ND_TCHECK_LEN(p, 1);
576		isoclns_print(ndo, p + 1, length - 1);
577		return(1);
578
579	case ETHERTYPE_PPPOED:
580	case ETHERTYPE_PPPOES:
581	case ETHERTYPE_PPPOED2:
582	case ETHERTYPE_PPPOES2:
583		pppoe_print(ndo, p, length);
584		return (1);
585
586	case ETHERTYPE_EAPOL:
587		eapol_print(ndo, p);
588		return (1);
589
590	case ETHERTYPE_REALTEK:
591		rtl_print(ndo, p, length, src, dst);
592		return (1);
593
594	case ETHERTYPE_PPP:
595		if (length) {
596			ND_PRINT(": ");
597			ppp_print(ndo, p, length);
598		}
599		return (1);
600
601	case ETHERTYPE_MPCP:
602		mpcp_print(ndo, p, length);
603		return (1);
604
605	case ETHERTYPE_SLOW:
606		slow_print(ndo, p, length);
607		return (1);
608
609	case ETHERTYPE_CFM:
610	case ETHERTYPE_CFM_OLD:
611		cfm_print(ndo, p, length);
612		return (1);
613
614	case ETHERTYPE_LLDP:
615		lldp_print(ndo, p, length);
616		return (1);
617
618	case ETHERTYPE_NSH:
619		nsh_print(ndo, p, length);
620		return (1);
621
622	case ETHERTYPE_LOOPBACK:
623		loopback_print(ndo, p, length);
624		return (1);
625
626	case ETHERTYPE_MPLS:
627	case ETHERTYPE_MPLS_MULTI:
628		mpls_print(ndo, p, length);
629		return (1);
630
631	case ETHERTYPE_TIPC:
632		tipc_print(ndo, p, length, caplen);
633		return (1);
634
635	case ETHERTYPE_MS_NLB_HB:
636		msnlb_print(ndo, p);
637		return (1);
638
639	case ETHERTYPE_GEONET_OLD:
640	case ETHERTYPE_GEONET:
641		geonet_print(ndo, p, length, src);
642		return (1);
643
644	case ETHERTYPE_CALM_FAST:
645		calm_fast_print(ndo, p, length, src);
646		return (1);
647
648	case ETHERTYPE_AOE:
649		aoe_print(ndo, p, length);
650		return (1);
651
652	case ETHERTYPE_PTP:
653		ptp_print(ndo, p, length);
654		return (1);
655
656	case ETHERTYPE_LAT:
657	case ETHERTYPE_SCA:
658	case ETHERTYPE_MOPRC:
659	case ETHERTYPE_MOPDL:
660	case ETHERTYPE_IEEE1905_1:
661		/* default_print for now */
662	default:
663		return (0);
664	}
665}
666