epan/dissectors/packet-ethertype.c

   1 /* packet-ethertype.c
   2  * Routines for calling the right protocol for the ethertype.
   3  *
   4  * $Id$
   5  *
   6  * Gilbert Ramirez <gram@alumni.rice.edu>
   7  *
   8  * Wireshark - Network traffic analyzer
   9  * By Gerald Combs <gerald@wireshark.org>
  10  * Copyright 1998 Gerald Combs
  11  *
  12  * This program is free software; you can redistribute it and/or
  13  * modify it under the terms of the GNU General Public License
  14  * as published by the Free Software Foundation; either version 2
  15  * of the License, or (at your option) any later version.
  16  *
  17  * This program is distributed in the hope that it will be useful,
  18  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  19  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20  * GNU General Public License for more details.
  21  *
  22  * You should have received a copy of the GNU General Public License
  23  * along with this program; if not, write to the Free Software
  24  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
  25  */
  26
  27 #ifdef HAVE_CONFIG_H
  28 # include "config.h"
  29 #endif
  30
  31 #include <glib.h>
  32 #include <epan/packet.h>
  33 #include "packet-eth.h"
  34 #include "packet-frame.h"
  35 #include "packet-ip.h"
  36 #include "packet-ipv6.h"
  37 #include "packet-ipx.h"
  38 #include "packet-vlan.h"
  39 #include "packet-vines.h"
  40 #include <epan/etypes.h>
  41 #include <epan/ppptypes.h>
  42
  43 static dissector_table_t ethertype_dissector_table;
  44
  45 static dissector_handle_t data_handle;
  46
  47 const value_string etype_vals[] = {
  48     {ETHERTYPE_IP,                                      "IP"                            },
  49     {ETHERTYPE_IPv6,                            "IPv6"                          },
  50     {ETHERTYPE_WLCCP,                           "Cisco Wireless Lan Context Control Protocol"           },
  51     {ETHERTYPE_CENTRINO_PROMISC,        "IEEE 802.11 (Centrino promiscuous)" },
  52     {ETHERTYPE_XNS_IDP,                         "XNS Internet Datagram Protocol" },
  53     {ETHERTYPE_X25L3,                           "X.25 Layer 3"                  },
  54     {ETHERTYPE_ARP,                                     "ARP"                           },
  55     {ETHERTYPE_EPL_V1,                                  "EPL_V1"                                },
  56     {ETHERTYPE_REVARP,                          "RARP"                          },
  57     {ETHERTYPE_DEC_LB,                          "DEC LanBridge"                 },
  58     {ETHERTYPE_ATALK,                           "Appletalk"                     },
  59     {ETHERTYPE_SNA,                                     "SNA-over-Ethernet"             },
  60     {ETHERTYPE_AARP,                            "AARP"                          },
  61     {ETHERTYPE_IPX,                                     "Netware IPX/SPX"               },
  62     {ETHERTYPE_VINES_IP,                        "Vines IP"                      },
  63     {ETHERTYPE_VINES_ECHO,                      "Vines Echo"                    },
  64     {ETHERTYPE_TRAIN,                           "Netmon Train"                  },
  65     {ETHERTYPE_LOOP,                            "Loopback"                      }, /* Ethernet Loopback */
  66     {ETHERTYPE_FOUNDRY,                         "Foundry proprietary"           },
  67     {ETHERTYPE_WCP,                             "Wellfleet Compression Protocol" },
  68     {ETHERTYPE_STP,                             "Spanning Tree Protocol"        },
  69     {ETHERTYPE_ISMP,                            "Cabletron Interswitch Message Protocol" },
  70     {ETHERTYPE_ISMP_TBFLOOD,            "Cabletron SFVLAN 1.8 Tag-Based Flood" },
  71                                 /* for ISMP, see RFC 2641, RFC 2642, RFC 2643 */
  72     {ETHERTYPE_PPPOED,                          "PPPoE Discovery"               },
  73     {ETHERTYPE_PPPOES,                          "PPPoE Session"                 },
  74     {ETHERTYPE_INTEL_ANS,                       "Intel ANS probe"               },
  75     {ETHERTYPE_MS_NLB_HEARTBEAT,        "MS NLB heartbeat"      },
  76     {ETHERTYPE_HOMEPLUG,                        "Homeplug"                      },
  77     {ETHERTYPE_VLAN,                            "802.1Q Virtual LAN"            },
  78     {ETHERTYPE_EAPOL,                           "802.1X Authentication"         },
  79     {ETHERTYPE_RSN_PREAUTH,                     "802.11i Pre-Authentication"    },
  80     {ETHERTYPE_MPLS,                            "MPLS label switched packet"    },
  81     {ETHERTYPE_MPLS_MULTI,                      "MPLS multicast label switched packet" },
  82     {ETHERTYPE_3C_NBP_DGRAM,            "3Com NBP Datagram"             },
  83     {ETHERTYPE_DEC,                                     "DEC proto"                     },
  84     {ETHERTYPE_DNA_DL,                          "DEC DNA Dump/Load"             },
  85     {ETHERTYPE_DNA_RC,                          "DEC DNA Remote Console"        },
  86     {ETHERTYPE_DNA_RT,                          "DEC DNA Routing"               },
  87     {ETHERTYPE_LAT,                                     "DEC LAT"                       },
  88     {ETHERTYPE_DEC_DIAG,                        "DEC Diagnostics"               },
  89     {ETHERTYPE_DEC_CUST,                        "DEC Customer use"              },
  90     {ETHERTYPE_DEC_SCA,                         "DEC LAVC/SCA"                  },
  91     {ETHERTYPE_DEC_LAST,                        "DEC LAST"                      },
  92     {ETHERTYPE_ETHBRIDGE,                       "Transparent Ethernet bridging" },
  93     {ETHERTYPE_CGMP,                            "Cisco Group Management Protocol" },
  94     {ETHERTYPE_MAC_CONTROL,                     "MAC Control"                   },
  95     {ETHERTYPE_SLOW_PROTOCOLS,          "Slow Protocols"                },
  96     {ETHERTYPE_RTMAC,                           "Real-Time Media Access Control" },
  97     {ETHERTYPE_RTCFG,                           "Real-Time Configuration Protocol" },
  98     {ETHERTYPE_CDMA2000_A10_UBS,        "CDMA2000 A10 Unstructured byte stream" },
  99     {ETHERTYPE_PROFINET,                        "PROFINET"                      },
 100     {ETHERTYPE_AOE,                                     "ATA over Ethernet"             },
 101     {ETHERTYPE_TELKONET,                                        "Telkonet powerline"    },
 102     {ETHERTYPE_EPL_V2,                          "ETHERNET Powerlink v2"                 },
 103     {ETHERTYPE_CSM_ENCAPS,                      "CSM_ENCAPS Protocol"             },
 104     {ETHERTYPE_IEEE802_OUI_EXTENDED, "IEEE 802a OUI Extended Ethertype" },
 105     {ETHERTYPE_IEC61850_GOOSE,          "IEC 61850/GOOSE" },
 106     {ETHERTYPE_IEC61850_GSE,            "IEC 61850/GSE management services" },
 107     {ETHERTYPE_IEC61850_SV,                     "IEC 61850/SV (Sampled Value Transmission" },
 108     {ETHERTYPE_TIPC,                            "Transparent Inter Process Communication" },
 109     {ETHERTYPE_LLDP,                            "802.1 Link Layer Discovery Protocol (LLDP)" },
 110     {ETHERTYPE_3GPP2,                           "CDMA2000 A10 3GPP2 Packet" },
 111     {ETHERTYPE_LLTD,                    "Link Layer Topology Discovery (LLTD)" },
 112     {ETHERTYPE_COBRANET,                "Cirrus Cobranet Packet" },
 113     {ETHERTYPE_NSRP,                    "Juniper Netscreen Redundant Protocol" },
 114     /*
 115      * NDISWAN on Windows translates Ethernet frames from higher-level
 116      * protocols into PPP frames to hand to the PPP driver, and translates
 117      * PPP frames from the PPP driver to hand to the higher-level protocols.
 118      *
 119      * Apparently the PPP driver, on at least some versions of Windows,
 120      * passes frames for internal-to-PPP protocols up through NDISWAN;
 121      * the protocol type field appears to be passed through unchanged
 122      * (unlike what's done with, for example, the protocol type field
 123      * for IP, which is mapped from its PPP value to its Ethernet value).
 124      *
 125      * This means that we may see, on Ethernet captures, frames for
 126      * protocols internal to PPP, so we list as "Ethernet" protocol
 127      * types the PPP protocol types we've seen.
 128      */
 129     {PPP_IPCP,                  "PPP IP Control Protocol" },
 130     {PPP_LCP,                   "PPP Link Control Protocol" },
 131     {PPP_PAP,                   "PPP Password Authentication Protocol" },
 132     {PPP_CCP,                   "PPP Compression Control Protocol" },
 133     {ETHERTYPE_LLT,             "Veritas Low Latency Transport (not officially registered)"},
 134     {0,                         NULL                            } };
 135
 136 static void add_dix_trailer(proto_tree *fh_tree, int trailer_id, tvbuff_t *tvb,
 137     tvbuff_t *next_tvb, int offset_after_etype, guint length_before,
 138     gint fcs_len);
 139
 140 void
 141 capture_ethertype(guint16 etype, const guchar *pd, int offset, int len,
 142                   packet_counts *ld)
 143 {
 144   switch (etype) {
 145     case ETHERTYPE_ARP:
 146       ld->arp++;
 147       break;
 148     case ETHERTYPE_IP:
 149       capture_ip(pd, offset, len, ld);
 150       break;
 151     case ETHERTYPE_IPv6:
 152       capture_ipv6(pd, offset, len, ld);
 153       break;
 154     case ETHERTYPE_IPX:
 155       capture_ipx(ld);
 156       break;
 157     case ETHERTYPE_VLAN:
 158       capture_vlan(pd, offset, len, ld);
 159       break;
 160     case ETHERTYPE_VINES_IP:
 161     case ETHERTYPE_VINES_ECHO:
 162       capture_vines(ld);
 163       break;
 164     default:
 165       ld->other++;
 166       break;
 167   }
 168 }
 169
 170 void
 171 ethertype(guint16 etype, tvbuff_t *tvb, int offset_after_etype,
 172                 packet_info *pinfo, proto_tree *tree, proto_tree *fh_tree,
 173                 int etype_id, int trailer_id, int fcs_len)
 174 {
 175         const char              *description;
 176         tvbuff_t                *next_tvb;
 177         guint                   length_before;
 178         volatile gboolean       dissector_found = FALSE;
 179         const char              *saved_proto;
 180
 181         /* Add the Ethernet type to the protocol tree */
 182         if (tree) {
 183                 proto_tree_add_uint(fh_tree, etype_id, tvb,
 184                     offset_after_etype - 2, 2, etype);
 185         }
 186
 187         /* Tvbuff for the payload after the Ethernet type. */
 188         next_tvb = tvb_new_subset(tvb, offset_after_etype, -1, -1);
 189
 190         pinfo->ethertype = etype;
 191
 192         /* Remember how much data there is in it. */
 193         length_before = tvb_reported_length(next_tvb);
 194
 195         /* Look for sub-dissector, and call it if found.
 196            Catch exceptions, so that if the reported length of "next_tvb"
 197            was reduced by some dissector before an exception was thrown,
 198            we can still put in an item for the trailer. */
 199         saved_proto = pinfo->current_proto;
 200         TRY {
 201                 dissector_found = dissector_try_port(ethertype_dissector_table,
 202                     etype, next_tvb, pinfo, tree);
 203         }
 204         CATCH(BoundsError) {
 205                 /* Somebody threw BoundsError, which means that:
 206
 207                      1) a dissector was found, so we don't need to
 208                         dissect the payload as data or update the
 209                         protocol or info columns;
 210
 211                      2) dissecting the payload found that the packet was
 212                         cut off by a snapshot length before the end of
 213                         the payload.  The trailer comes after the payload,
 214                         so *all* of the trailer is cut off, and we'll
 215                         just get another BoundsError if we add the trailer.
 216
 217                    Therefore, we just rethrow the exception so it gets
 218                    reported; we don't dissect the trailer or do anything
 219                    else. */
 220                  RETHROW;
 221         }
 222         CATCH(OutOfMemoryError) {
 223                  RETHROW;
 224         }
 225         CATCH_ALL {
 226                 /* Somebody threw an exception other than BoundsError, which
 227                    means that a dissector was found, so we don't need to
 228                    dissect the payload as data or update the protocol or info
 229                    columns.  We just show the exception and then drive on
 230                    to show the trailer, after noting that a dissector was
 231                    found and restoring the protocol value that was in effect
 232                    before we called the subdissector. */
 233                 show_exception(next_tvb, pinfo, tree, EXCEPT_CODE, GET_MESSAGE);
 234                 dissector_found = TRUE;
 235                 pinfo->current_proto = saved_proto;
 236         }
 237         ENDTRY;
 238
 239         if (!dissector_found) {
 240                 /* No sub-dissector found.
 241                    Label rest of packet as "Data" */
 242                 call_dissector(data_handle,next_tvb, pinfo, tree);
 243
 244                 /* Label protocol */
 245                 if (check_col(pinfo->cinfo, COL_PROTOCOL)) {
 246                         col_add_fstr(pinfo->cinfo, COL_PROTOCOL, "0x%04x",
 247                             etype);
 248                 }
 249                 if (check_col(pinfo->cinfo, COL_INFO)) {
 250                         description = match_strval(etype, etype_vals);
 251                         if (description) {
 252                                 col_add_fstr(pinfo->cinfo, COL_INFO, "%s",
 253                                     description);
 254                         }
 255                 }
 256         }
 257
 258         add_dix_trailer(fh_tree, trailer_id, tvb, next_tvb, offset_after_etype,
 259             length_before, fcs_len);
 260 }
 261
 262 static void
 263 add_dix_trailer(proto_tree *fh_tree, int trailer_id, tvbuff_t *tvb,
 264     tvbuff_t *next_tvb, int offset_after_etype, guint length_before,
 265     gint fcs_len)
 266 {
 267         guint           length;
 268         tvbuff_t        *volatile trailer_tvb;
 269
 270         if (fh_tree == NULL)
 271                 return; /* we're not building a protocol tree */
 272
 273         if (trailer_id == -1)
 274                 return; /* our caller doesn't care about trailers */
 275
 276         /* OK, how much is there in that tvbuff now? */
 277         length = tvb_reported_length(next_tvb);
 278
 279         /* If there's less than there was before, what's left is
 280            a trailer. */
 281         if (length < length_before) {
 282                 /*
 283                  * Is any of the padding present in the tvbuff?
 284                  */
 285                 if (tvb_offset_exists(tvb, offset_after_etype + length)) {
 286                         /*
 287                          * Yes - create a tvbuff for the padding.
 288                          */
 289                         trailer_tvb = tvb_new_subset(tvb,
 290                             offset_after_etype + length, -1, -1);
 291                 } else {
 292                         /*
 293                          * No - don't bother showing the trailer.
 294                          * XXX - show a Short Frame indication?
 295                          */
 296                         trailer_tvb = NULL;
 297                 }
 298         } else
 299                 trailer_tvb = NULL;     /* no trailer */
 300
 301         add_ethernet_trailer(fh_tree, trailer_id, tvb, trailer_tvb, fcs_len);
 302 }
 303
 304 void
 305 proto_register_ethertype(void)
 306 {
 307         /* subdissector code */
 308         ethertype_dissector_table = register_dissector_table("ethertype",
 309             "Ethertype", FT_UINT16, BASE_HEX);
 310 }
 311
 312 void
 313 proto_reg_handoff_ethertype(void)
 314 {
 315         data_handle = find_dissector("data");
 316 }