Upgrade tcpdump to tcpdump-4.99.1
Test: make
Change-Id: I052ed8f5279c806e4d2ff925f581b71db3ac03c0
diff --git a/print-ether.c b/print-ether.c
index 01dd113..da95862 100644
--- a/print-ether.c
+++ b/print-ether.c
@@ -22,16 +22,32 @@
/* \summary: Ethernet printer */
#ifdef HAVE_CONFIG_H
-#include "config.h"
+#include <config.h>
#endif
-#include <netdissect-stdinc.h>
+#include "netdissect-stdinc.h"
+#define ND_LONGJMP_FROM_TCHECK
#include "netdissect.h"
#include "extract.h"
#include "addrtoname.h"
#include "ethertype.h"
-#include "ether.h"
+
+/*
+ * Structure of an Ethernet header.
+ */
+struct ether_header {
+ nd_mac_addr ether_dhost;
+ nd_mac_addr ether_shost;
+ nd_uint16_t ether_length_type;
+};
+
+/*
+ * Length of an Ethernet header; note that some compilers may pad
+ * "struct ether_header" to a multiple of 4 bytes, for example, so
+ * "sizeof (struct ether_header)" may not give the right answer.
+ */
+#define ETHER_HDRLEN 14
const struct tok ethertype_values[] = {
{ ETHERTYPE_IP, "IPv4" },
@@ -42,6 +58,7 @@
{ ETHERTYPE_8021Q9100, "802.1Q-9100" },
{ ETHERTYPE_8021QinQ, "802.1Q-QinQ" },
{ ETHERTYPE_8021Q9200, "802.1Q-9200" },
+ { ETHERTYPE_MACSEC, "802.1AE MACsec" },
{ ETHERTYPE_VMAN, "VMAN" },
{ ETHERTYPE_PUP, "PUP" },
{ ETHERTYPE_ARP, "ARP"},
@@ -72,6 +89,7 @@
{ ETHERTYPE_RRCP, "RRCP" },
{ ETHERTYPE_MS_NLB_HB, "MS NLB heartbeat" },
{ ETHERTYPE_JUMBO, "Jumbo" },
+ { ETHERTYPE_NSH, "NSH" },
{ ETHERTYPE_LOOPBACK, "Loopback" },
{ ETHERTYPE_ISO, "OSI" },
{ ETHERTYPE_GRE_ISO, "GRE-OSI" },
@@ -84,97 +102,220 @@
{ ETHERTYPE_GEONET, "GeoNet"},
{ ETHERTYPE_CALM_FAST, "CALM FAST"},
{ ETHERTYPE_AOE, "AoE" },
- { ETHERTYPE_MEDSA, "MEDSA" },
+ { ETHERTYPE_PTP, "PTP" },
+ { ETHERTYPE_ARISTA, "Arista Vendor Specific Protocol" },
{ 0, NULL}
};
-static inline void
-ether_hdr_print(netdissect_options *ndo,
- const u_char *bp, u_int length)
+static void
+ether_addresses_print(netdissect_options *ndo, const u_char *src,
+ const u_char *dst)
{
- register const struct ether_header *ep;
- uint16_t length_type;
+ ND_PRINT("%s > %s, ",
+ GET_ETHERADDR_STRING(src), GET_ETHERADDR_STRING(dst));
+}
- ep = (const struct ether_header *)bp;
-
- ND_PRINT((ndo, "%s > %s",
- etheraddr_string(ndo, ESRC(ep)),
- etheraddr_string(ndo, EDST(ep))));
-
- length_type = EXTRACT_16BITS(&ep->ether_length_type);
- if (!ndo->ndo_qflag) {
- if (length_type <= ETHERMTU) {
- ND_PRINT((ndo, ", 802.3"));
- length = length_type;
- } else
- ND_PRINT((ndo, ", ethertype %s (0x%04x)",
- tok2str(ethertype_values,"Unknown", length_type),
- length_type));
- } else {
- if (length_type <= ETHERMTU) {
- ND_PRINT((ndo, ", 802.3"));
- length = length_type;
- } else
- ND_PRINT((ndo, ", %s", tok2str(ethertype_values,"Unknown Ethertype (0x%04x)", length_type)));
- }
-
- ND_PRINT((ndo, ", length %u: ", length));
+static void
+ether_type_print(netdissect_options *ndo, uint16_t type)
+{
+ if (!ndo->ndo_qflag)
+ ND_PRINT("ethertype %s (0x%04x)",
+ tok2str(ethertype_values, "Unknown", type), type);
+ else
+ ND_PRINT("%s",
+ tok2str(ethertype_values, "Unknown Ethertype (0x%04x)", type));
}
/*
- * Print an Ethernet frame.
- * This might be encapsulated within another frame; we might be passed
- * a pointer to a function that can print header information for that
- * frame's protocol, and an argument to pass to that function.
+ * Common code for printing Ethernet frames.
*
- * FIXME: caplen can and should be derived from ndo->ndo_snapend and p.
+ * It can handle Ethernet headers with extra tag information inserted
+ * after the destination and source addresses, as is inserted by some
+ * switch chips, and extra encapsulation header information before
+ * printing Ethernet header information (such as a LANE ID for ATM LANE).
*/
-u_int
-ether_print(netdissect_options *ndo,
- const u_char *p, u_int length, u_int caplen,
- void (*print_encap_header)(netdissect_options *ndo, const u_char *), const u_char *encap_header_arg)
+static u_int
+ether_common_print(netdissect_options *ndo, const u_char *p, u_int length,
+ u_int caplen,
+ void (*print_switch_tag)(netdissect_options *ndo, const u_char *),
+ u_int switch_tag_len,
+ void (*print_encap_header)(netdissect_options *ndo, const u_char *),
+ const u_char *encap_header_arg)
{
- const struct ether_header *ep;
+ const struct ether_header *ehp;
u_int orig_length;
- u_short length_type;
u_int hdrlen;
+ u_short length_type;
+ int printed_length;
int llc_hdrlen;
struct lladdr_info src, dst;
- if (caplen < ETHER_HDRLEN) {
- ND_PRINT((ndo, "[|ether]"));
- return (caplen);
+ if (caplen < ETHER_HDRLEN + switch_tag_len) {
+ nd_print_trunc(ndo);
+ return caplen;
}
- if (length < ETHER_HDRLEN) {
- ND_PRINT((ndo, "[|ether]"));
- return (length);
+ if (length < ETHER_HDRLEN + switch_tag_len) {
+ nd_print_trunc(ndo);
+ return length;
}
- if (ndo->ndo_eflag) {
- if (print_encap_header != NULL)
- (*print_encap_header)(ndo, encap_header_arg);
- ether_hdr_print(ndo, p, length);
- }
+ if (print_encap_header != NULL)
+ (*print_encap_header)(ndo, encap_header_arg);
+
orig_length = length;
- length -= ETHER_HDRLEN;
- caplen -= ETHER_HDRLEN;
- ep = (const struct ether_header *)p;
- p += ETHER_HDRLEN;
- hdrlen = ETHER_HDRLEN;
-
- src.addr = ESRC(ep);
- src.addr_string = etheraddr_string;
- dst.addr = EDST(ep);
- dst.addr_string = etheraddr_string;
- length_type = EXTRACT_16BITS(&ep->ether_length_type);
-
-recurse:
/*
- * Is it (gag) an 802.3 encapsulation?
+ * Get the source and destination addresses, skip past them,
+ * and print them if we're printing the link-layer header.
*/
- if (length_type <= ETHERMTU) {
- /* Try to print the LLC-layer header & higher layers */
+ ehp = (const struct ether_header *)p;
+ src.addr = ehp->ether_shost;
+ src.addr_string = etheraddr_string;
+ dst.addr = ehp->ether_dhost;
+ dst.addr_string = etheraddr_string;
+
+ length -= 2*MAC_ADDR_LEN;
+ caplen -= 2*MAC_ADDR_LEN;
+ p += 2*MAC_ADDR_LEN;
+ hdrlen = 2*MAC_ADDR_LEN;
+
+ if (ndo->ndo_eflag)
+ ether_addresses_print(ndo, src.addr, dst.addr);
+
+ /*
+ * Print the switch tag, if we have one, and skip past it.
+ */
+ if (print_switch_tag != NULL)
+ (*print_switch_tag)(ndo, p);
+
+ length -= switch_tag_len;
+ caplen -= switch_tag_len;
+ p += switch_tag_len;
+ hdrlen += switch_tag_len;
+
+ /*
+ * Get the length/type field, skip past it, and print it
+ * if we're printing the link-layer header.
+ */
+recurse:
+ length_type = GET_BE_U_2(p);
+
+ length -= 2;
+ caplen -= 2;
+ p += 2;
+ hdrlen += 2;
+
+ /*
+ * Process 802.1AE MACsec headers.
+ */
+ printed_length = 0;
+ if (length_type == ETHERTYPE_MACSEC) {
+ /*
+ * MACsec, aka IEEE 802.1AE-2006
+ * Print the header, and try to print the payload if it's not encrypted
+ */
+ if (ndo->ndo_eflag) {
+ ether_type_print(ndo, length_type);
+ ND_PRINT(", length %u: ", orig_length);
+ printed_length = 1;
+ }
+
+ int ret = macsec_print(ndo, &p, &length, &caplen, &hdrlen,
+ &src, &dst);
+
+ if (ret == 0) {
+ /* Payload is encrypted; print it as raw data. */
+ if (!ndo->ndo_suppress_default_print)
+ ND_DEFAULTPRINT(p, caplen);
+ return hdrlen;
+ } else if (ret > 0) {
+ /* Problem printing the header; just quit. */
+ return ret;
+ } else {
+ /*
+ * Keep processing type/length fields.
+ */
+ length_type = GET_BE_U_2(p);
+
+ length -= 2;
+ caplen -= 2;
+ p += 2;
+ hdrlen += 2;
+ }
+ }
+
+ /*
+ * Process VLAN tag types.
+ */
+ while (length_type == ETHERTYPE_8021Q ||
+ length_type == ETHERTYPE_8021Q9100 ||
+ length_type == ETHERTYPE_8021Q9200 ||
+ length_type == ETHERTYPE_8021QinQ) {
+ /*
+ * It has a VLAN tag.
+ * Print VLAN information, and then go back and process
+ * the enclosed type field.
+ */
+ if (caplen < 4) {
+ ndo->ndo_protocol = "vlan";
+ nd_print_trunc(ndo);
+ return hdrlen + caplen;
+ }
+ if (length < 4) {
+ ndo->ndo_protocol = "vlan";
+ nd_print_trunc(ndo);
+ return hdrlen + length;
+ }
+ if (ndo->ndo_eflag) {
+ uint16_t tag = GET_BE_U_2(p);
+
+ ether_type_print(ndo, length_type);
+ if (!printed_length) {
+ ND_PRINT(", length %u: ", orig_length);
+ printed_length = 1;
+ } else
+ ND_PRINT(", ");
+ ND_PRINT("%s, ", ieee8021q_tci_string(tag));
+ }
+
+ length_type = GET_BE_U_2(p + 2);
+ p += 4;
+ length -= 4;
+ caplen -= 4;
+ hdrlen += 4;
+ }
+
+ /*
+ * We now have the final length/type field.
+ */
+ if (length_type <= MAX_ETHERNET_LENGTH_VAL) {
+ /*
+ * It's a length field, containing the length of the
+ * remaining payload; use it as such, as long as
+ * it's not too large (bigger than the actual payload).
+ */
+ if (length_type < length) {
+ length = length_type;
+ if (caplen > length)
+ caplen = length;
+ }
+
+ /*
+ * Cut off the snapshot length to the end of the
+ * payload.
+ */
+ nd_push_snapend(ndo, p + length);
+
+ if (ndo->ndo_eflag) {
+ ND_PRINT("802.3");
+ if (!printed_length)
+ ND_PRINT(", length %u: ", length);
+ }
+
+ /*
+ * An LLC header follows the length. Print that and
+ * higher layers.
+ */
llc_hdrlen = llc_print(ndo, p, length, caplen, &src, &dst);
if (llc_hdrlen < 0) {
/* packet type not known, print raw packet */
@@ -183,42 +324,13 @@
llc_hdrlen = -llc_hdrlen;
}
hdrlen += llc_hdrlen;
- } else if (length_type == ETHERTYPE_8021Q ||
- length_type == ETHERTYPE_8021Q9100 ||
- length_type == ETHERTYPE_8021Q9200 ||
- length_type == ETHERTYPE_8021QinQ) {
- /*
- * Print VLAN information, and then go back and process
- * the enclosed type field.
- */
- if (caplen < 4) {
- ND_PRINT((ndo, "[|vlan]"));
- return (hdrlen + caplen);
- }
- if (length < 4) {
- ND_PRINT((ndo, "[|vlan]"));
- return (hdrlen + length);
- }
- if (ndo->ndo_eflag) {
- uint16_t tag = EXTRACT_16BITS(p);
-
- ND_PRINT((ndo, "%s, ", ieee8021q_tci_string(tag)));
- }
-
- length_type = EXTRACT_16BITS(p + 2);
- if (ndo->ndo_eflag && length_type > ETHERMTU)
- ND_PRINT((ndo, "ethertype %s, ", tok2str(ethertype_values,"0x%04x", length_type)));
- p += 4;
- length -= 4;
- caplen -= 4;
- hdrlen += 4;
- goto recurse;
+ nd_pop_packet_info(ndo);
} else if (length_type == ETHERTYPE_JUMBO) {
/*
- * Alteon jumbo frames.
+ * It's a type field, with the type for Alteon jumbo frames.
* See
*
- * http://tools.ietf.org/html/draft-ietf-isis-ext-eth-01
+ * https://tools.ietf.org/html/draft-ietf-isis-ext-eth-01
*
* which indicates that, following the type field,
* there's an LLC header and payload.
@@ -232,20 +344,103 @@
llc_hdrlen = -llc_hdrlen;
}
hdrlen += llc_hdrlen;
+ } else if (length_type == ETHERTYPE_ARISTA) {
+ if (caplen < 2) {
+ ND_PRINT("[|arista]");
+ return hdrlen + caplen;
+ }
+ if (length < 2) {
+ ND_PRINT("[|arista]");
+ return hdrlen + length;
+ }
+ ether_type_print(ndo, length_type);
+ ND_PRINT(", length %u: ", orig_length);
+ int bytesConsumed = arista_ethertype_print(ndo, p, length);
+ if (bytesConsumed > 0) {
+ p += bytesConsumed;
+ length -= bytesConsumed;
+ caplen -= bytesConsumed;
+ hdrlen += bytesConsumed;
+ goto recurse;
+ } else {
+ /* subtype/version not known, print raw packet */
+ if (!ndo->ndo_eflag && length_type > MAX_ETHERNET_LENGTH_VAL) {
+ ether_addresses_print(ndo, src.addr, dst.addr);
+ ether_type_print(ndo, length_type);
+ ND_PRINT(", length %u: ", orig_length);
+ }
+ if (!ndo->ndo_suppress_default_print)
+ ND_DEFAULTPRINT(p, caplen);
+ }
} else {
+ /*
+ * It's a type field with some other value.
+ */
+ if (ndo->ndo_eflag) {
+ ether_type_print(ndo, length_type);
+ if (!printed_length)
+ ND_PRINT(", length %u: ", orig_length);
+ else
+ ND_PRINT(", ");
+ }
if (ethertype_print(ndo, length_type, p, length, caplen, &src, &dst) == 0) {
/* type not known, print raw packet */
if (!ndo->ndo_eflag) {
- if (print_encap_header != NULL)
- (*print_encap_header)(ndo, encap_header_arg);
- ether_hdr_print(ndo, (const u_char *)ep, orig_length);
+ /*
+ * We didn't print the full link-layer
+ * header, as -e wasn't specified, so
+ * print only the source and destination
+ * MAC addresses and the final Ethernet
+ * type.
+ */
+ ether_addresses_print(ndo, src.addr, dst.addr);
+ ether_type_print(ndo, length_type);
+ ND_PRINT(", length %u: ", orig_length);
}
if (!ndo->ndo_suppress_default_print)
ND_DEFAULTPRINT(p, caplen);
}
}
- return (hdrlen);
+ return hdrlen;
+}
+
+/*
+ * Print an Ethernet frame while specyfing a non-standard Ethernet header
+ * length.
+ * This might be encapsulated within another frame; we might be passed
+ * a pointer to a function that can print header information for that
+ * frame's protocol, and an argument to pass to that function.
+ *
+ * FIXME: caplen can and should be derived from ndo->ndo_snapend and p.
+ */
+u_int
+ether_switch_tag_print(netdissect_options *ndo, const u_char *p, u_int length,
+ u_int caplen,
+ void (*print_switch_tag)(netdissect_options *, const u_char *),
+ u_int switch_tag_len)
+{
+ return ether_common_print(ndo, p, length, caplen, print_switch_tag,
+ switch_tag_len, NULL, NULL);
+}
+
+/*
+ * Print an Ethernet frame.
+ * This might be encapsulated within another frame; we might be passed
+ * a pointer to a function that can print header information for that
+ * frame's protocol, and an argument to pass to that function.
+ *
+ * FIXME: caplen can and should be derived from ndo->ndo_snapend and p.
+ */
+u_int
+ether_print(netdissect_options *ndo,
+ const u_char *p, u_int length, u_int caplen,
+ void (*print_encap_header)(netdissect_options *ndo, const u_char *),
+ const u_char *encap_header_arg)
+{
+ ndo->ndo_protocol = "ether";
+ return ether_common_print(ndo, p, length, caplen, NULL, 0,
+ print_encap_header, encap_header_arg);
}
/*
@@ -254,11 +449,13 @@
* of the packet off the wire, and 'h->caplen' is the number
* of bytes actually captured.
*/
-u_int
+void
ether_if_print(netdissect_options *ndo, const struct pcap_pkthdr *h,
- const u_char *p)
+ const u_char *p)
{
- return (ether_print(ndo, p, h->len, h->caplen, NULL, NULL));
+ ndo->ndo_protocol = "ether";
+ ndo->ndo_ll_hdr_len +=
+ ether_print(ndo, p, h->len, h->caplen, NULL, NULL);
}
/*
@@ -270,20 +467,20 @@
* This is for DLT_NETANALYZER, which has a 4-byte pseudo-header
* before the Ethernet header.
*/
-u_int
+void
netanalyzer_if_print(netdissect_options *ndo, const struct pcap_pkthdr *h,
- const u_char *p)
+ const u_char *p)
{
/*
* Fail if we don't have enough data for the Hilscher pseudo-header.
*/
- if (h->len < 4 || h->caplen < 4) {
- ND_PRINT((ndo, "[|netanalyzer]"));
- return (h->caplen);
- }
+ ndo->ndo_protocol = "netanalyzer";
+ ND_TCHECK_LEN(p, 4);
/* Skip the pseudo-header. */
- return (4 + ether_print(ndo, p + 4, h->len - 4, h->caplen - 4, NULL, NULL));
+ ndo->ndo_ll_hdr_len += 4;
+ ndo->ndo_ll_hdr_len +=
+ ether_print(ndo, p + 4, h->len - 4, h->caplen - 4, NULL, NULL);
}
/*
@@ -296,22 +493,22 @@
* pseudo-header, a 7-byte Ethernet preamble, and a 1-byte Ethernet SOF
* before the Ethernet header.
*/
-u_int
+void
netanalyzer_transparent_if_print(netdissect_options *ndo,
- const struct pcap_pkthdr *h,
- const u_char *p)
+ const struct pcap_pkthdr *h,
+ const u_char *p)
{
/*
* Fail if we don't have enough data for the Hilscher pseudo-header,
* preamble, and SOF.
*/
- if (h->len < 12 || h->caplen < 12) {
- ND_PRINT((ndo, "[|netanalyzer-transparent]"));
- return (h->caplen);
- }
+ ndo->ndo_protocol = "netanalyzer_transparent";
+ ND_TCHECK_LEN(p, 12);
/* Skip the pseudo-header, preamble, and SOF. */
- return (12 + ether_print(ndo, p + 12, h->len - 12, h->caplen - 12, NULL, NULL));
+ ndo->ndo_ll_hdr_len += 12;
+ ndo->ndo_ll_hdr_len +=
+ ether_print(ndo, p + 12, h->len - 12, h->caplen - 12, NULL, NULL);
}
/*
@@ -323,14 +520,14 @@
int
ethertype_print(netdissect_options *ndo,
- u_short ether_type, const u_char *p,
- u_int length, u_int caplen,
- const struct lladdr_info *src, const struct lladdr_info *dst)
+ u_short ether_type, const u_char *p,
+ u_int length, u_int caplen,
+ const struct lladdr_info *src, const struct lladdr_info *dst)
{
switch (ether_type) {
case ETHERTYPE_IP:
- ip_print(ndo, p, length);
+ ip_print(ndo, p, length);
return (1);
case ETHERTYPE_IPV6:
@@ -339,7 +536,7 @@
case ETHERTYPE_ARP:
case ETHERTYPE_REVARP:
- arp_print(ndo, p, length, caplen);
+ arp_print(ndo, p, length, caplen);
return (1);
case ETHERTYPE_DN:
@@ -348,7 +545,7 @@
case ETHERTYPE_ATALK:
if (ndo->ndo_vflag)
- ND_PRINT((ndo, "et1 "));
+ ND_PRINT("et1 ");
atalk_print(ndo, p, length);
return (1);
@@ -357,15 +554,19 @@
return (1);
case ETHERTYPE_IPX:
- ND_PRINT((ndo, "(NOV-ETHII) "));
+ ND_PRINT("(NOV-ETHII) ");
ipx_print(ndo, p, length);
return (1);
case ETHERTYPE_ISO:
if (length == 0 || caplen == 0) {
- ND_PRINT((ndo, " [|osi]"));
+ ndo->ndo_protocol = "isoclns";
+ nd_print_trunc(ndo);
return (1);
}
+ /* At least one byte is required */
+ /* FIXME: Reference for this byte? */
+ ND_TCHECK_LEN(p, 1);
isoclns_print(ndo, p + 1, length - 1);
return(1);
@@ -377,26 +578,26 @@
return (1);
case ETHERTYPE_EAPOL:
- eap_print(ndo, p, length);
+ eapol_print(ndo, p);
return (1);
case ETHERTYPE_RRCP:
- rrcp_print(ndo, p, length, src, dst);
+ rrcp_print(ndo, p, length, src, dst);
return (1);
case ETHERTYPE_PPP:
if (length) {
- ND_PRINT((ndo, ": "));
+ ND_PRINT(": ");
ppp_print(ndo, p, length);
}
return (1);
case ETHERTYPE_MPCP:
- mpcp_print(ndo, p, length);
+ mpcp_print(ndo, p, length);
return (1);
case ETHERTYPE_SLOW:
- slow_print(ndo, p, length);
+ slow_print(ndo, p, length);
return (1);
case ETHERTYPE_CFM:
@@ -408,9 +609,13 @@
lldp_print(ndo, p, length);
return (1);
- case ETHERTYPE_LOOPBACK:
+ case ETHERTYPE_NSH:
+ nsh_print(ndo, p, length);
+ return (1);
+
+ case ETHERTYPE_LOOPBACK:
loopback_print(ndo, p, length);
- return (1);
+ return (1);
case ETHERTYPE_MPLS:
case ETHERTYPE_MPLS_MULTI:
@@ -425,21 +630,21 @@
msnlb_print(ndo, p);
return (1);
- case ETHERTYPE_GEONET_OLD:
- case ETHERTYPE_GEONET:
- geonet_print(ndo, p, length, src);
- return (1);
+ case ETHERTYPE_GEONET_OLD:
+ case ETHERTYPE_GEONET:
+ geonet_print(ndo, p, length, src);
+ return (1);
- case ETHERTYPE_CALM_FAST:
- calm_fast_print(ndo, p, length, src);
- return (1);
+ case ETHERTYPE_CALM_FAST:
+ calm_fast_print(ndo, p, length, src);
+ return (1);
case ETHERTYPE_AOE:
aoe_print(ndo, p, length);
return (1);
- case ETHERTYPE_MEDSA:
- medsa_print(ndo, p, length, caplen, src, dst);
+ case ETHERTYPE_PTP:
+ ptp_print(ndo, p, length);
return (1);
case ETHERTYPE_LAT:
@@ -452,12 +657,3 @@
return (0);
}
}
-
-
-/*
- * Local Variables:
- * c-style: whitesmith
- * c-basic-offset: 8
- * End:
- */
-