Adding upstream version 4.99.4.upstream/4.99.4

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 535 insertions, 0 deletions

diff --git a/print-sll.c b/print-sll.c
new file mode 100644
index 0000000..eb8d620
--- /dev/null
+++ b/print-sll.c
@@ -0,0 +1,535 @@
+/*
+ * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997
+ *	The Regents of the University of California.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that: (1) source code distributions
+ * retain the above copyright notice and this paragraph in its entirety, (2)
+ * distributions including binary code include the above copyright notice and
+ * this paragraph in its entirety in the documentation or other materials
+ * provided with the distribution, and (3) all advertising materials mentioning
+ * features or use of this software display the following acknowledgement:
+ * ``This product includes software developed by the University of California,
+ * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
+ * the University nor the names of its contributors may be used to endorse
+ * or promote products derived from this software without specific prior
+ * written permission.
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+ */
+
+/* \summary: Linux cooked sockets capture printer */
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+#ifdef HAVE_NET_IF_H
+/*
+ * Include diag-control.h before <net/if.h>, which too defines a macro
+ * named ND_UNREACHABLE.
+ */
+#include "diag-control.h"
+#include <net/if.h>
+#endif
+
+#include "netdissect-stdinc.h"
+
+#define ND_LONGJMP_FROM_TCHECK
+#include "netdissect.h"
+#include "addrtoname.h"
+#include "ethertype.h"
+#include "extract.h"
+
+/*
+ * For captures on Linux cooked sockets, we construct a fake header
+ * that includes:
+ *
+ *	a 2-byte "packet type" which is one of:
+ *
+ *		LINUX_SLL_HOST		packet was sent to us
+ *		LINUX_SLL_BROADCAST	packet was broadcast
+ *		LINUX_SLL_MULTICAST	packet was multicast
+ *		LINUX_SLL_OTHERHOST	packet was sent to somebody else
+ *		LINUX_SLL_OUTGOING	packet was sent *by* us;
+ *
+ *	a 2-byte Ethernet protocol field;
+ *
+ *	a 2-byte link-layer type;
+ *
+ *	a 2-byte link-layer address length;
+ *
+ *	an 8-byte source link-layer address, whose actual length is
+ *	specified by the previous value.
+ *
+ * All fields except for the link-layer address are in network byte order.
+ *
+ * DO NOT change the layout of this structure, or change any of the
+ * LINUX_SLL_ values below.  If you must change the link-layer header
+ * for a "cooked" Linux capture, introduce a new DLT_ type (ask
+ * "tcpdump-workers@lists.tcpdump.org" for one, so that you don't give it
+ * a value that collides with a value already being used), and use the
+ * new header in captures of that type, so that programs that can
+ * handle DLT_LINUX_SLL captures will continue to handle them correctly
+ * without any change, and so that capture files with different headers
+ * can be told apart and programs that read them can dissect the
+ * packets in them.
+ *
+ * This structure, and the #defines below, must be the same in the
+ * libpcap and tcpdump versions of "sll.h".
+ */
+
+/*
+ * A DLT_LINUX_SLL fake link-layer header.
+ */
+#define SLL_HDR_LEN	16		/* total header length */
+#define SLL_ADDRLEN	8		/* length of address field */
+
+struct sll_header {
+	nd_uint16_t	sll_pkttype;	/* packet type */
+	nd_uint16_t	sll_hatype;	/* link-layer address type */
+	nd_uint16_t	sll_halen;	/* link-layer address length */
+	nd_byte		sll_addr[SLL_ADDRLEN];	/* link-layer address */
+	nd_uint16_t	sll_protocol;	/* protocol */
+};
+
+/*
+ * A DLT_LINUX_SLL2 fake link-layer header.
+ */
+#define SLL2_HDR_LEN	20		/* total header length */
+
+struct sll2_header {
+	nd_uint16_t	sll2_protocol;		/* protocol */
+	nd_uint16_t	sll2_reserved_mbz;	/* reserved - must be zero */
+	nd_uint32_t	sll2_if_index;		/* 1-based interface index */
+	nd_uint16_t	sll2_hatype;		/* link-layer address type */
+	nd_uint8_t	sll2_pkttype;		/* packet type */
+	nd_uint8_t	sll2_halen;		/* link-layer address length */
+	nd_byte		sll2_addr[SLL_ADDRLEN];	/* link-layer address */
+};
+
+/*
+ * The LINUX_SLL_ values for "sll_pkttype"; these correspond to the
+ * PACKET_ values on Linux, but are defined here so that they're
+ * available even on systems other than Linux, and so that they
+ * don't change even if the PACKET_ values change.
+ */
+#define LINUX_SLL_HOST		0
+#define LINUX_SLL_BROADCAST	1
+#define LINUX_SLL_MULTICAST	2
+#define LINUX_SLL_OTHERHOST	3
+#define LINUX_SLL_OUTGOING	4
+
+/*
+ * The LINUX_SLL_ values for "sll_protocol"; these correspond to the
+ * ETH_P_ values on Linux, but are defined here so that they're
+ * available even on systems other than Linux.  We assume, for now,
+ * that the ETH_P_ values won't change in Linux; if they do, then:
+ *
+ *	if we don't translate them in "pcap-linux.c", capture files
+ *	won't necessarily be readable if captured on a system that
+ *	defines ETH_P_ values that don't match these values;
+ *
+ *	if we do translate them in "pcap-linux.c", that makes life
+ *	unpleasant for the BPF code generator, as the values you test
+ *	for in the kernel aren't the values that you test for when
+ *	reading a capture file, so the fixup code run on BPF programs
+ *	handed to the kernel ends up having to do more work.
+ *
+ * Add other values here as necessary, for handling packet types that
+ * might show up on non-Ethernet, non-802.x networks.  (Not all the ones
+ * in the Linux "if_ether.h" will, I suspect, actually show up in
+ * captures.)
+ */
+#define LINUX_SLL_P_802_3	0x0001	/* Novell 802.3 frames without 802.2 LLC header */
+#define LINUX_SLL_P_802_2	0x0004	/* 802.2 frames (not D/I/X Ethernet) */
+
+static const struct tok sll_pkttype_values[] = {
+    { LINUX_SLL_HOST, "In" },
+    { LINUX_SLL_BROADCAST, "B" },
+    { LINUX_SLL_MULTICAST, "M" },
+    { LINUX_SLL_OTHERHOST, "P" },
+    { LINUX_SLL_OUTGOING, "Out" },
+    { 0, NULL}
+};
+
+static void
+sll_print(netdissect_options *ndo, const struct sll_header *sllp, u_int length)
+{
+	u_short ether_type;
+
+	ndo->ndo_protocol = "sll";
+        ND_PRINT("%3s ",
+		 tok2str(sll_pkttype_values,"?",GET_BE_U_2(sllp->sll_pkttype)));
+
+	/*
+	 * XXX - check the link-layer address type value?
+	 * For now, we just assume 6 means Ethernet.
+	 * XXX - print others as strings of hex?
+	 */
+	if (GET_BE_U_2(sllp->sll_halen) == MAC_ADDR_LEN)
+		ND_PRINT("%s ", GET_ETHERADDR_STRING(sllp->sll_addr));
+
+	if (!ndo->ndo_qflag) {
+		ether_type = GET_BE_U_2(sllp->sll_protocol);
+
+		if (ether_type <= MAX_ETHERNET_LENGTH_VAL) {
+			/*
+			 * Not an Ethernet type; what type is it?
+			 */
+			switch (ether_type) {
+
+			case LINUX_SLL_P_802_3:
+				/*
+				 * Ethernet_802.3 IPX frame.
+				 */
+				ND_PRINT("802.3");
+				break;
+
+			case LINUX_SLL_P_802_2:
+				/*
+				 * 802.2.
+				 */
+				ND_PRINT("802.2");
+				break;
+
+			default:
+				/*
+				 * What is it?
+				 */
+				ND_PRINT("ethertype Unknown (0x%04x)",
+				    ether_type);
+				break;
+			}
+		} else {
+			ND_PRINT("ethertype %s (0x%04x)",
+			    tok2str(ethertype_values, "Unknown", ether_type),
+			    ether_type);
+		}
+		ND_PRINT(", length %u: ", length);
+	}
+}
+
+/*
+ * This is the top level routine of the printer.  'p' points to the
+ * Linux "cooked capture" header of the packet, 'h->ts' is the timestamp,
+ * 'h->len' is the length of the packet off the wire, and 'h->caplen'
+ * is the number of bytes actually captured.
+ */
+void
+sll_if_print(netdissect_options *ndo, const struct pcap_pkthdr *h, const u_char *p)
+{
+	u_int caplen = h->caplen;
+	u_int length = h->len;
+	const struct sll_header *sllp;
+	u_short hatype;
+	u_short ether_type;
+	int llc_hdrlen;
+	u_int hdrlen;
+
+	ndo->ndo_protocol = "sll";
+	ND_TCHECK_LEN(p, SLL_HDR_LEN);
+
+	sllp = (const struct sll_header *)p;
+
+	if (ndo->ndo_eflag)
+		sll_print(ndo, sllp, length);
+
+	/*
+	 * Go past the cooked-mode header.
+	 */
+	length -= SLL_HDR_LEN;
+	caplen -= SLL_HDR_LEN;
+	p += SLL_HDR_LEN;
+	hdrlen = SLL_HDR_LEN;
+
+	hatype = GET_BE_U_2(sllp->sll_hatype);
+	switch (hatype) {
+
+	case 803:
+		/*
+		 * This is an packet with a radiotap header;
+		 * just dissect the payload as such.
+		 */
+		ndo->ndo_ll_hdr_len += SLL_HDR_LEN;
+		ndo->ndo_ll_hdr_len += ieee802_11_radio_print(ndo, p, length, caplen);
+		return;
+	}
+	ether_type = GET_BE_U_2(sllp->sll_protocol);
+
+recurse:
+	/*
+	 * Is it (gag) an 802.3 encapsulation, or some non-Ethernet
+	 * packet type?
+	 */
+	if (ether_type <= MAX_ETHERNET_LENGTH_VAL) {
+		/*
+		 * Yes - what type is it?
+		 */
+		switch (ether_type) {
+
+		case LINUX_SLL_P_802_3:
+			/*
+			 * Ethernet_802.3 IPX frame.
+			 */
+			ipx_print(ndo, p, length);
+			break;
+
+		case LINUX_SLL_P_802_2:
+			/*
+			 * 802.2.
+			 * Try to print the LLC-layer header & higher layers.
+			 */
+			llc_hdrlen = llc_print(ndo, p, length, caplen, NULL, NULL);
+			if (llc_hdrlen < 0)
+				goto unknown;	/* unknown LLC type */
+			hdrlen += llc_hdrlen;
+			break;
+
+		default:
+			/*FALLTHROUGH*/
+
+		unknown:
+			/* packet type not known, print raw packet */
+			if (!ndo->ndo_suppress_default_print)
+				ND_DEFAULTPRINT(p, caplen);
+			break;
+		}
+	} else if (ether_type == ETHERTYPE_8021Q) {
+		/*
+		 * Print VLAN information, and then go back and process
+		 * the enclosed type field.
+		 */
+		if (caplen < 4) {
+			ndo->ndo_protocol = "vlan";
+			nd_print_trunc(ndo);
+			ndo->ndo_ll_hdr_len += hdrlen + caplen;
+			return;
+		}
+	        if (ndo->ndo_eflag) {
+			uint16_t tag = GET_BE_U_2(p);
+
+			ND_PRINT("%s, ", ieee8021q_tci_string(tag));
+		}
+
+		ether_type = GET_BE_U_2(p + 2);
+		if (ether_type <= MAX_ETHERNET_LENGTH_VAL)
+			ether_type = LINUX_SLL_P_802_2;
+		if (!ndo->ndo_qflag) {
+			ND_PRINT("ethertype %s, ",
+			    tok2str(ethertype_values, "Unknown", ether_type));
+		}
+		p += 4;
+		length -= 4;
+		caplen -= 4;
+		hdrlen += 4;
+		goto recurse;
+	} else {
+		if (ethertype_print(ndo, ether_type, p, length, caplen, NULL, NULL) == 0) {
+			/* ether_type not known, print raw packet */
+			if (!ndo->ndo_eflag)
+				sll_print(ndo, sllp, length + SLL_HDR_LEN);
+			if (!ndo->ndo_suppress_default_print)
+				ND_DEFAULTPRINT(p, caplen);
+		}
+	}
+
+	ndo->ndo_ll_hdr_len += hdrlen;
+}
+
+static void
+sll2_print(netdissect_options *ndo, const struct sll2_header *sllp, u_int length)
+{
+	u_short ether_type;
+
+	ndo->ndo_protocol = "sll2";
+	ND_PRINT("ifindex %u ", GET_BE_U_4(sllp->sll2_if_index));
+
+	/*
+	 * XXX - check the link-layer address type value?
+	 * For now, we just assume 6 means Ethernet.
+	 * XXX - print others as strings of hex?
+	 */
+	if (GET_U_1(sllp->sll2_halen) == MAC_ADDR_LEN)
+		ND_PRINT("%s ", GET_ETHERADDR_STRING(sllp->sll2_addr));
+
+	if (!ndo->ndo_qflag) {
+		ether_type = GET_BE_U_2(sllp->sll2_protocol);
+
+		if (ether_type <= MAX_ETHERNET_LENGTH_VAL) {
+			/*
+			 * Not an Ethernet type; what type is it?
+			 */
+			switch (ether_type) {
+
+			case LINUX_SLL_P_802_3:
+				/*
+				 * Ethernet_802.3 IPX frame.
+				 */
+				ND_PRINT("802.3");
+				break;
+
+			case LINUX_SLL_P_802_2:
+				/*
+				 * 802.2.
+				 */
+				ND_PRINT("802.2");
+				break;
+
+			default:
+				/*
+				 * What is it?
+				 */
+				ND_PRINT("ethertype Unknown (0x%04x)",
+				    ether_type);
+				break;
+			}
+		} else {
+			ND_PRINT("ethertype %s (0x%04x)",
+			    tok2str(ethertype_values, "Unknown", ether_type),
+			    ether_type);
+		}
+		ND_PRINT(", length %u: ", length);
+	}
+}
+
+/*
+ * This is the top level routine of the printer.  'p' points to the
+ * Linux "cooked capture" header of the packet, 'h->ts' is the timestamp,
+ * 'h->len' is the length of the packet off the wire, and 'h->caplen'
+ * is the number of bytes actually captured.
+ */
+void
+sll2_if_print(netdissect_options *ndo, const struct pcap_pkthdr *h, const u_char *p)
+{
+	u_int caplen = h->caplen;
+	u_int length = h->len;
+	const struct sll2_header *sllp;
+	u_short hatype;
+	u_short ether_type;
+	int llc_hdrlen;
+	u_int hdrlen;
+#ifdef HAVE_NET_IF_H
+	uint32_t if_index;
+	char ifname[IF_NAMESIZE];
+#endif
+
+	ndo->ndo_protocol = "sll2";
+	ND_TCHECK_LEN(p, SLL2_HDR_LEN);
+
+	sllp = (const struct sll2_header *)p;
+#ifdef HAVE_NET_IF_H
+	if_index = GET_BE_U_4(sllp->sll2_if_index);
+	if (!if_indextoname(if_index, ifname))
+		strncpy(ifname, "?", 2);
+	ND_PRINT("%-5s ", ifname);
+#endif
+
+	ND_PRINT("%-3s ",
+		 tok2str(sll_pkttype_values, "?", GET_U_1(sllp->sll2_pkttype)));
+
+	if (ndo->ndo_eflag)
+		sll2_print(ndo, sllp, length);
+
+	/*
+	 * Go past the cooked-mode header.
+	 */
+	length -= SLL2_HDR_LEN;
+	caplen -= SLL2_HDR_LEN;
+	p += SLL2_HDR_LEN;
+	hdrlen = SLL2_HDR_LEN;
+
+	hatype = GET_BE_U_2(sllp->sll2_hatype);
+	switch (hatype) {
+
+	case 803:
+		/*
+		 * This is an packet with a radiotap header;
+		 * just dissect the payload as such.
+		 */
+		ndo->ndo_ll_hdr_len += SLL2_HDR_LEN;
+		ndo->ndo_ll_hdr_len += ieee802_11_radio_print(ndo, p, length, caplen);
+		return;
+	}
+	ether_type = GET_BE_U_2(sllp->sll2_protocol);
+
+recurse:
+	/*
+	 * Is it (gag) an 802.3 encapsulation, or some non-Ethernet
+	 * packet type?
+	 */
+	if (ether_type <= MAX_ETHERNET_LENGTH_VAL) {
+		/*
+		 * Yes - what type is it?
+		 */
+		switch (ether_type) {
+
+		case LINUX_SLL_P_802_3:
+			/*
+			 * Ethernet_802.3 IPX frame.
+			 */
+			ipx_print(ndo, p, length);
+			break;
+
+		case LINUX_SLL_P_802_2:
+			/*
+			 * 802.2.
+			 * Try to print the LLC-layer header & higher layers.
+			 */
+			llc_hdrlen = llc_print(ndo, p, length, caplen, NULL, NULL);
+			if (llc_hdrlen < 0)
+				goto unknown;	/* unknown LLC type */
+			hdrlen += llc_hdrlen;
+			break;
+
+		default:
+			/*FALLTHROUGH*/
+
+		unknown:
+			/* packet type not known, print raw packet */
+			if (!ndo->ndo_suppress_default_print)
+				ND_DEFAULTPRINT(p, caplen);
+			break;
+		}
+	} else if (ether_type == ETHERTYPE_8021Q) {
+		/*
+		 * Print VLAN information, and then go back and process
+		 * the enclosed type field.
+		 */
+		if (caplen < 4) {
+			ndo->ndo_protocol = "vlan";
+			nd_print_trunc(ndo);
+			ndo->ndo_ll_hdr_len += hdrlen + caplen;
+			return;
+		}
+	        if (ndo->ndo_eflag) {
+			uint16_t tag = GET_BE_U_2(p);
+
+			ND_PRINT("%s, ", ieee8021q_tci_string(tag));
+		}
+
+		ether_type = GET_BE_U_2(p + 2);
+		if (ether_type <= MAX_ETHERNET_LENGTH_VAL)
+			ether_type = LINUX_SLL_P_802_2;
+		if (!ndo->ndo_qflag) {
+			ND_PRINT("ethertype %s, ",
+			    tok2str(ethertype_values, "Unknown", ether_type));
+		}
+		p += 4;
+		length -= 4;
+		caplen -= 4;
+		hdrlen += 4;
+		goto recurse;
+	} else {
+		if (ethertype_print(ndo, ether_type, p, length, caplen, NULL, NULL) == 0) {
+			/* ether_type not known, print raw packet */
+			if (!ndo->ndo_eflag)
+				sll2_print(ndo, sllp, length + SLL2_HDR_LEN);
+			if (!ndo->ndo_suppress_default_print)
+				ND_DEFAULTPRINT(p, caplen);
+		}
+	}
+
+	ndo->ndo_ll_hdr_len += hdrlen;
+}