epan/dissectors/packet-ethertype.c

   1 /* ethertype.c
   2  * Routines for calling the right protocol for the ethertype.
   3  *
   4  * $Id$
   5  *
   6  * Gilbert Ramirez <gram@alumni.rice.edu>
   7  *
   8  * Ethereal - Network traffic analyzer
   9  * By Gerald Combs <gerald@ethereal.com>
  10  * Copyright 1998 Gerald Combs
  11  *
  12  * This program is free software; you can redistribute it and/or
  13  * modify it under the terms of the GNU General Public License
  14  * as published by the Free Software Foundation; either version 2
  15  * of the License, or (at your option) any later version.
  16  *
  17  * This program is distributed in the hope that it will be useful,
  18  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  19  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20  * GNU General Public License for more details.
  21  *
  22  * You should have received a copy of the GNU General Public License
  23  * along with this program; if not, write to the Free Software
  24  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  25  */
  26
  27 #ifdef HAVE_CONFIG_H
  28 # include "config.h"
  29 #endif
  30
  31 #include <glib.h>
  32 #include <epan/packet.h>
  33 #include "packet-eth.h"
  34 #include "packet-frame.h"
  35 #include "packet-ip.h"
  36 #include "packet-ipv6.h"
  37 #include "packet-ipx.h"
  38 #include "packet-vlan.h"
  39 #include "packet-vines.h"
  40 #include "etypes.h"
  41 #include "ppptypes.h"
  42
  43 static dissector_table_t ethertype_dissector_table;
  44
  45 static dissector_handle_t data_handle;
  46
  47 const value_string etype_vals[] = {
  48     {ETHERTYPE_IP,              "IP"                            },
  49     {ETHERTYPE_IPv6,            "IPv6"                          },
  50     {ETHERTYPE_CENTRINO_PROMISC, "IEEE 802.11 (Centrino promiscuous)" },
  51     {ETHERTYPE_X25L3,           "X.25 Layer 3"                  },
  52     {ETHERTYPE_ARP,             "ARP"                           },
  53     {ETHERTYPE_REVARP,          "RARP"                          },
  54     {ETHERTYPE_DEC_LB,          "DEC LanBridge"                 },
  55     {ETHERTYPE_ATALK,           "Appletalk"                     },
  56     {ETHERTYPE_SNA,             "SNA-over-Ethernet"             },
  57     {ETHERTYPE_AARP,            "AARP"                          },
  58     {ETHERTYPE_IPX,             "Netware IPX/SPX"               },
  59     {ETHERTYPE_VINES_IP,        "Vines IP"                      },
  60     {ETHERTYPE_VINES_ECHO,      "Vines Echo"                    },
  61     {ETHERTYPE_TRAIN,           "Netmon Train"                  },
  62     {ETHERTYPE_LOOP,            "Loopback"                      }, /* Ethernet Loopback */
  63     {ETHERTYPE_WCP,             "Wellfleet Compression Protocol" },
  64     {ETHERTYPE_ISMP,            "Cabletron Interswitch Message Protocol" },
  65     {ETHERTYPE_ISMP_TBFLOOD,    "Cabletron SFVLAN 1.8 Tag-Based Flood" },
  66                                 /* for ISMP, see RFC 2641, RFC 2642, RFC 2643 */
  67     {ETHERTYPE_PPPOED,          "PPPoE Discovery"               },
  68     {ETHERTYPE_PPPOES,          "PPPoE Session"                 },
  69     {ETHERTYPE_INTEL_ANS,       "Intel ANS probe"               },
  70     {ETHERTYPE_MS_NLB_HEARTBEAT,        "MS NLB heartbeat"      },
  71     {ETHERTYPE_VLAN,            "802.1Q Virtual LAN"            },
  72     {ETHERTYPE_EAPOL,           "802.1X Authentication"         },
  73     {ETHERTYPE_RSN_PREAUTH,     "802.11i Pre-Authentication"    },
  74     {ETHERTYPE_MPLS,            "MPLS label switched packet"    },
  75     {ETHERTYPE_MPLS_MULTI,      "MPLS multicast label switched packet" },
  76     {ETHERTYPE_3C_NBP_DGRAM,    "3Com NBP Datagram"             },
  77     {ETHERTYPE_DEC,             "DEC proto"                     },
  78     {ETHERTYPE_DNA_DL,          "DEC DNA Dump/Load"             },
  79     {ETHERTYPE_DNA_RC,          "DEC DNA Remote Console"        },
  80     {ETHERTYPE_DNA_RT,          "DEC DNA Routing"               },
  81     {ETHERTYPE_LAT,             "DEC LAT"                       },
  82     {ETHERTYPE_DEC_DIAG,        "DEC Diagnostics"               },
  83     {ETHERTYPE_DEC_CUST,        "DEC Customer use"              },
  84     {ETHERTYPE_DEC_SCA,         "DEC LAVC/SCA"                  },
  85     {ETHERTYPE_ETHBRIDGE,       "Transparent Ethernet bridging" },
  86     {ETHERTYPE_CGMP,            "Cisco Group Management Protocol" },
  87     {ETHERTYPE_SLOW_PROTOCOLS,  "Slow Protocols"                },
  88     {ETHERTYPE_RTNET,           "RTNET Protocol"                },
  89     {ETHERTYPE_RTCFG,           "RTCFG Protocol"                },
  90     {ETHERTYPE_PROFINET,        "PROFInet"                },
  91
  92     /*
  93      * NDISWAN on Windows translates Ethernet frames from higher-level
  94      * protocols into PPP frames to hand to the PPP driver, and translates
  95      * PPP frames from the PPP driver to hand to the higher-level protocols.
  96      *
  97      * Apparently the PPP driver, on at least some versions of Windows,
  98      * passes frames for internal-to-PPP protocols up through NDISWAN;
  99      * the protocol type field appears to be passed through unchanged
 100      * (unlike what's done with, for example, the protocol type field
 101      * for IP, which is mapped from its PPP value to its Ethernet value).
 102      *
 103      * This means that we may see, on Ethernet captures, frames for
 104      * protocols internal to PPP, so we list as "Ethernet" protocol
 105      * types the PPP protocol types we've seen.
 106      */
 107     {PPP_IPCP,                  "PPP IP Control Protocol" },
 108     {PPP_LCP,                   "PPP Link Control Protocol" },
 109     {PPP_PAP,                   "PPP Password Authentication Protocol" },
 110     {PPP_CCP,                   "PPP Compression Control Protocol" },
 111     {0,                         NULL                            } };
 112
 113 static void add_dix_trailer(proto_tree *fh_tree, int trailer_id, tvbuff_t *tvb,
 114     tvbuff_t *next_tvb, int offset_after_etype, guint length_before,
 115     gint fcs_len);
 116
 117 void
 118 capture_ethertype(guint16 etype, const guchar *pd, int offset, int len,
 119                   packet_counts *ld)
 120 {
 121   switch (etype) {
 122     case ETHERTYPE_ARP:
 123       ld->arp++;
 124       break;
 125     case ETHERTYPE_IP:
 126       capture_ip(pd, offset, len, ld);
 127       break;
 128     case ETHERTYPE_IPv6:
 129       capture_ipv6(pd, offset, len, ld);
 130       break;
 131     case ETHERTYPE_IPX:
 132       capture_ipx(ld);
 133       break;
 134     case ETHERTYPE_VLAN:
 135       capture_vlan(pd, offset, len, ld);
 136       break;
 137     case ETHERTYPE_VINES_IP:
 138     case ETHERTYPE_VINES_ECHO:
 139       capture_vines(ld);
 140       break;
 141     default:
 142       ld->other++;
 143       break;
 144   }
 145 }
 146
 147 void
 148 ethertype(guint16 etype, tvbuff_t *tvb, int offset_after_etype,
 149                 packet_info *pinfo, proto_tree *tree, proto_tree *fh_tree,
 150                 int etype_id, int trailer_id, int fcs_len)
 151 {
 152         char                    *description;
 153         tvbuff_t                *next_tvb;
 154         guint                   length_before;
 155         volatile gboolean       dissector_found;
 156         const char              *saved_proto;
 157
 158         /* Add the Ethernet type to the protocol tree */
 159         if (tree) {
 160                 proto_tree_add_uint(fh_tree, etype_id, tvb,
 161                     offset_after_etype - 2, 2, etype);
 162         }
 163
 164         /* Tvbuff for the payload after the Ethernet type. */
 165         next_tvb = tvb_new_subset(tvb, offset_after_etype, -1, -1);
 166
 167         pinfo->ethertype = etype;
 168
 169         /* Remember how much data there is in it. */
 170         length_before = tvb_reported_length(next_tvb);
 171
 172         /* Look for sub-dissector, and call it if found.
 173            Catch exceptions, so that if the reported length of "next_tvb"
 174            was reduced by some dissector before an exception was thrown,
 175            we can still put in an item for the trailer. */
 176         saved_proto = pinfo->current_proto;
 177         TRY {
 178                 dissector_found = dissector_try_port(ethertype_dissector_table,
 179                     etype, next_tvb, pinfo, tree);
 180         }
 181         CATCH(BoundsError) {
 182                 /* Somebody threw BoundsError, which means that:
 183
 184                      1) a dissector was found, so we don't need to
 185                         dissect the payload as data or update the
 186                         protocol or info columns;
 187
 188                      2) dissecting the payload found that the packet was
 189                         cut off by a snapshot length before the end of
 190                         the payload.  The trailer comes after the payload,
 191                         so *all* of the trailer is cut off, and we'll
 192                         just get another BoundsError if we add the trailer.
 193
 194                    Therefore, we just rethrow the exception so it gets
 195                    reported; we don't dissect the trailer or do anything
 196                    else. */
 197                  RETHROW;
 198         }
 199         CATCH_ALL {
 200                 /* Somebody threw an exception other than BoundsError, which
 201                    means that a dissector was found, so we don't need to
 202                    dissect the payload as data or update the protocol or info
 203                    columns.  We just show the exception and then drive on
 204                    to show the trailer, after noting that a dissector was
 205                    found and restoring the protocol value that was in effect
 206                    before we called the subdissector. */
 207                 show_exception(next_tvb, pinfo, tree, EXCEPT_CODE);
 208                 dissector_found = TRUE;
 209                 pinfo->current_proto = saved_proto;
 210         }
 211         ENDTRY;
 212
 213         if (!dissector_found) {
 214                 /* No sub-dissector found.
 215                    Label rest of packet as "Data" */
 216                 call_dissector(data_handle,next_tvb, pinfo, tree);
 217
 218                 /* Label protocol */
 219                 switch (etype) {
 220
 221                 case ETHERTYPE_LOOP:
 222                         if (check_col(pinfo->cinfo, COL_PROTOCOL)) {
 223                                 col_add_fstr(pinfo->cinfo, COL_PROTOCOL, "LOOP");
 224                         }
 225                         break;
 226
 227                 default:
 228                         if (check_col(pinfo->cinfo, COL_PROTOCOL)) {
 229                                 col_add_fstr(pinfo->cinfo, COL_PROTOCOL, "0x%04x",
 230                                     etype);
 231                         }
 232                         break;
 233                 }
 234                 if (check_col(pinfo->cinfo, COL_INFO)) {
 235                         description = match_strval(etype, etype_vals);
 236                         if (description) {
 237                                 col_add_fstr(pinfo->cinfo, COL_INFO, "%s",
 238                                     description);
 239                         }
 240                 }
 241         }
 242
 243         add_dix_trailer(fh_tree, trailer_id, tvb, next_tvb, offset_after_etype,
 244             length_before, fcs_len);
 245 }
 246
 247 static void
 248 add_dix_trailer(proto_tree *fh_tree, int trailer_id, tvbuff_t *tvb,
 249     tvbuff_t *next_tvb, int offset_after_etype, guint length_before,
 250     gint fcs_len)
 251 {
 252         guint           length;
 253         tvbuff_t        *volatile trailer_tvb;
 254
 255         if (fh_tree == NULL)
 256                 return; /* we're not building a protocol tree */
 257
 258         if (trailer_id == -1)
 259                 return; /* our caller doesn't care about trailers */
 260
 261         /* OK, how much is there in that tvbuff now? */
 262         length = tvb_reported_length(next_tvb);
 263
 264         /* If there's less than there was before, what's left is
 265            a trailer. */
 266         if (length < length_before) {
 267                 /*
 268                  * Is any of the padding present in the tvbuff?
 269                  */
 270                 if (tvb_offset_exists(tvb, offset_after_etype + length)) {
 271                         /*
 272                          * Yes - create a tvbuff for the padding.
 273                          */
 274                         trailer_tvb = tvb_new_subset(tvb,
 275                             offset_after_etype + length, -1, -1);
 276                 } else {
 277                         /*
 278                          * No - don't bother showing the trailer.
 279                          * XXX - show a Short Frame indication?
 280                          */
 281                         trailer_tvb = NULL;
 282                 }
 283         } else
 284                 trailer_tvb = NULL;     /* no trailer */
 285
 286         add_ethernet_trailer(fh_tree, trailer_id, tvb, trailer_tvb, fcs_len);
 287 }
 288
 289 void
 290 proto_register_ethertype(void)
 291 {
 292         /* subdissector code */
 293         ethertype_dissector_table = register_dissector_table("ethertype",
 294             "Ethertype", FT_UINT16, BASE_HEX);
 295 }
 296
 297 void
 298 proto_reg_handoff_ethertype(void)
 299 {
 300         data_handle = find_dissector("data");
 301 }