epan/dissectors/packet-ethertype.c

   1 /* packet-ethertype.c
   2  * Routines for calling the right protocol for the ethertype.
   3  *
   4  * $Id$
   5  *
   6  * Gilbert Ramirez <gram@alumni.rice.edu>
   7  *
   8  * Wireshark - Network traffic analyzer
   9  * By Gerald Combs <gerald@wireshark.org>
  10  * Copyright 1998 Gerald Combs
  11  *
  12  * This program is free software; you can redistribute it and/or
  13  * modify it under the terms of the GNU General Public License
  14  * as published by the Free Software Foundation; either version 2
  15  * of the License, or (at your option) any later version.
  16  *
  17  * This program is distributed in the hope that it will be useful,
  18  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  19  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20  * GNU General Public License for more details.
  21  *
  22  * You should have received a copy of the GNU General Public License
  23  * along with this program; if not, write to the Free Software
  24  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
  25  */
  26
  27 #ifdef HAVE_CONFIG_H
  28 # include "config.h"
  29 #endif
  30
  31 #include <glib.h>
  32 #include <epan/packet.h>
  33 #include "packet-eth.h"
  34 #include "packet-frame.h"
  35 #include "packet-ip.h"
  36 #include "packet-ipv6.h"
  37 #include "packet-ipx.h"
  38 #include "packet-vlan.h"
  39 #include "packet-ieee8021ah.h"
  40 #include "packet-vines.h"
  41 #include <epan/etypes.h>
  42 #include <epan/ppptypes.h>
  43
  44 static dissector_table_t ethertype_dissector_table;
  45
  46 static dissector_handle_t data_handle;
  47
  48 const value_string etype_vals[] = {
  49     {ETHERTYPE_IP,                                      "IP"                            },
  50     {ETHERTYPE_IPv6,                            "IPv6"                          },
  51     {ETHERTYPE_WLCCP,                           "Cisco Wireless Lan Context Control Protocol"           },
  52     {ETHERTYPE_CENTRINO_PROMISC,        "IEEE 802.11 (Centrino promiscuous)" },
  53     {ETHERTYPE_XNS_IDP,                         "XNS Internet Datagram Protocol" },
  54     {ETHERTYPE_X25L3,                           "X.25 Layer 3"                  },
  55     {ETHERTYPE_ARP,                                     "ARP"                           },
  56     {ETHERTYPE_WMX_M2M,                         "WiMax Mac-to-Mac"              },
  57     {ETHERTYPE_EPL_V1,                          "EPL_V1"                                },
  58     {ETHERTYPE_REVARP,                          "RARP"                          },
  59     {ETHERTYPE_DEC_LB,                          "DEC LanBridge"                 },
  60     {ETHERTYPE_ATALK,                           "Appletalk"                     },
  61     {ETHERTYPE_SNA,                                     "SNA-over-Ethernet"             },
  62     {ETHERTYPE_AARP,                            "AARP"                          },
  63     {ETHERTYPE_IPX,                                     "Netware IPX/SPX"               },
  64     {ETHERTYPE_VINES_IP,                        "Vines IP"                      },
  65     {ETHERTYPE_VINES_ECHO,                      "Vines Echo"                    },
  66     {ETHERTYPE_TRAIN,                           "Netmon Train"                  },
  67     {ETHERTYPE_LOOP,                            "Loopback"                      }, /* Ethernet Loopback */
  68     {ETHERTYPE_FOUNDRY,                         "Foundry proprietary"           },
  69     {ETHERTYPE_WCP,                                     "Wellfleet Compression Protocol" },
  70     {ETHERTYPE_STP,                                     "Spanning Tree Protocol"        },
  71     {ETHERTYPE_ISMP,                            "Cabletron Interswitch Message Protocol" },
  72     {ETHERTYPE_ISMP_TBFLOOD,            "Cabletron SFVLAN 1.8 Tag-Based Flood" },
  73                                 /* for ISMP, see RFC 2641, RFC 2642, RFC 2643 */
  74     {ETHERTYPE_PPPOED,                          "PPPoE Discovery"               },
  75     {ETHERTYPE_PPPOES,                          "PPPoE Session"                 },
  76     {ETHERTYPE_INTEL_ANS,                       "Intel ANS probe"               },
  77     {ETHERTYPE_MS_NLB_HEARTBEAT,        "MS NLB heartbeat"      },
  78     {ETHERTYPE_HOMEPLUG,                        "Homeplug"                      },
  79     {ETHERTYPE_VLAN,                            "802.1Q Virtual LAN"            },
  80     {ETHERTYPE_IEEE_802_1AD,                    "802.1ad Provider Bridge (Q-in-Q)"},
  81     {ETHERTYPE_IEEE_802_1AH,                    "802.1ah Provider Backbone Bridge (mac-in-mac)"},
  82     {ETHERTYPE_EAPOL,                           "802.1X Authentication"         },
  83     {ETHERTYPE_RSN_PREAUTH,                     "802.11i Pre-Authentication"    },
  84     {ETHERTYPE_MPLS,                            "MPLS label switched packet"    },
  85     {ETHERTYPE_MPLS_MULTI,                      "MPLS multicast label switched packet" },
  86     {ETHERTYPE_3C_NBP_DGRAM,            "3Com NBP Datagram"             },
  87     {ETHERTYPE_DEC,                                     "DEC proto"                     },
  88     {ETHERTYPE_DNA_DL,                          "DEC DNA Dump/Load"             },
  89     {ETHERTYPE_DNA_RC,                          "DEC DNA Remote Console"        },
  90     {ETHERTYPE_DNA_RT,                          "DEC DNA Routing"               },
  91     {ETHERTYPE_LAT,                                     "DEC LAT"                       },
  92     {ETHERTYPE_DEC_DIAG,                        "DEC Diagnostics"               },
  93     {ETHERTYPE_DEC_CUST,                        "DEC Customer use"              },
  94     {ETHERTYPE_DEC_SCA,                         "DEC LAVC/SCA"                  },
  95     {ETHERTYPE_DEC_LAST,                        "DEC LAST"                      },
  96     {ETHERTYPE_ETHBRIDGE,                       "Transparent Ethernet bridging" },
  97     {ETHERTYPE_CGMP,                            "Cisco Group Management Protocol" },
  98     {ETHERTYPE_MAC_CONTROL,                     "MAC Control"                   },
  99     {ETHERTYPE_SLOW_PROTOCOLS,          "Slow Protocols"                },
 100     {ETHERTYPE_RTMAC,                           "Real-Time Media Access Control" },
 101     {ETHERTYPE_RTCFG,                           "Real-Time Configuration Protocol" },
 102     {ETHERTYPE_CDMA2000_A10_UBS,        "CDMA2000 A10 Unstructured byte stream" },
 103     {ETHERTYPE_PROFINET,                        "PROFINET"                      },
 104     {ETHERTYPE_AOE,                                     "ATA over Ethernet"             },
 105     {ETHERTYPE_TELKONET,                        "Telkonet powerline"    },
 106     {ETHERTYPE_EPL_V2,                          "ETHERNET Powerlink v2"                 },
 107     {ETHERTYPE_CSM_ENCAPS,                      "CSM_ENCAPS Protocol"             },
 108     {ETHERTYPE_IEEE802_OUI_EXTENDED, "IEEE 802a OUI Extended Ethertype" },
 109     {ETHERTYPE_IEC61850_GOOSE,          "IEC 61850/GOOSE" },
 110     {ETHERTYPE_IEC61850_GSE,            "IEC 61850/GSE management services" },
 111     {ETHERTYPE_IEC61850_SV,                     "IEC 61850/SV (Sampled Value Transmission" },
 112     {ETHERTYPE_TIPC,                            "Transparent Inter Process Communication" },
 113     {ETHERTYPE_LLDP,                            "802.1 Link Layer Discovery Protocol (LLDP)" },
 114     {ETHERTYPE_3GPP2,                           "CDMA2000 A10 3GPP2 Packet" },
 115     {ETHERTYPE_LLTD,                            "Link Layer Topology Discovery (LLTD)" },
 116     {ETHERTYPE_COBRANET,                        "Cirrus Cobranet Packet" },
 117     {ETHERTYPE_NSRP,                            "Juniper Netscreen Redundant Protocol" },
 118     /*
 119      * NDISWAN on Windows translates Ethernet frames from higher-level
 120      * protocols into PPP frames to hand to the PPP driver, and translates
 121      * PPP frames from the PPP driver to hand to the higher-level protocols.
 122      *
 123      * Apparently the PPP driver, on at least some versions of Windows,
 124      * passes frames for internal-to-PPP protocols up through NDISWAN;
 125      * the protocol type field appears to be passed through unchanged
 126      * (unlike what's done with, for example, the protocol type field
 127      * for IP, which is mapped from its PPP value to its Ethernet value).
 128      *
 129      * This means that we may see, on Ethernet captures, frames for
 130      * protocols internal to PPP, so we list as "Ethernet" protocol
 131      * types the PPP protocol types we've seen.
 132      */
 133     {PPP_IPCP,                  "PPP IP Control Protocol" },
 134     {PPP_LCP,                   "PPP Link Control Protocol" },
 135     {PPP_PAP,                   "PPP Password Authentication Protocol" },
 136     {PPP_CCP,                   "PPP Compression Control Protocol" },
 137     {ETHERTYPE_LLT,             "Veritas Low Latency Transport (not officially registered)"},
 138     {ETHERTYPE_CFM,             "IEEE 802.1ag Connectivity Fault Management (CFM) protocol" },
 139     {ETHERTYPE_FCOE,    "Fibre Channel over Ethernet" },
 140         {ETHERTYPE_PTP,         "PTPv2 over Ethernet (IEEE1588)"},
 141     {0,                         NULL                            } };
 142
 143 static void add_dix_trailer(proto_tree *fh_tree, int trailer_id, tvbuff_t *tvb,
 144     tvbuff_t *next_tvb, int offset_after_etype, guint length_before,
 145     gint fcs_len);
 146
 147 void
 148 capture_ethertype(guint16 etype, const guchar *pd, int offset, int len,
 149                   packet_counts *ld)
 150 {
 151   switch (etype) {
 152     case ETHERTYPE_ARP:
 153       ld->arp++;
 154       break;
 155     case ETHERTYPE_IP:
 156       capture_ip(pd, offset, len, ld);
 157       break;
 158     case ETHERTYPE_IPv6:
 159       capture_ipv6(pd, offset, len, ld);
 160       break;
 161     case ETHERTYPE_IPX:
 162       capture_ipx(ld);
 163       break;
 164     case ETHERTYPE_VLAN:
 165       capture_vlan(pd, offset, len, ld);
 166       break;
 167     case ETHERTYPE_IEEE_802_1AD:
 168     case ETHERTYPE_IEEE_802_1AH:
 169       capture_ieee8021ah(pd, offset, len, ld);
 170       break;
 171     case ETHERTYPE_VINES_IP:
 172     case ETHERTYPE_VINES_ECHO:
 173       capture_vines(ld);
 174       break;
 175     default:
 176       ld->other++;
 177       break;
 178   }
 179 }
 180
 181 void
 182 ethertype(guint16 etype, tvbuff_t *tvb, int offset_after_etype,
 183                 packet_info *pinfo, proto_tree *tree, proto_tree *fh_tree,
 184                 int etype_id, int trailer_id, int fcs_len)
 185 {
 186         const char              *description;
 187         tvbuff_t                *next_tvb;
 188         guint                   length_before;
 189         volatile gboolean       dissector_found = FALSE;
 190         const char              *saved_proto;
 191
 192         /* Add the Ethernet type to the protocol tree */
 193         if (tree) {
 194                 proto_tree_add_uint(fh_tree, etype_id, tvb,
 195                     offset_after_etype - 2, 2, etype);
 196         }
 197
 198         /* Tvbuff for the payload after the Ethernet type. */
 199         next_tvb = tvb_new_subset(tvb, offset_after_etype, -1, -1);
 200
 201         pinfo->ethertype = etype;
 202
 203         /* Remember how much data there is in it. */
 204         length_before = tvb_reported_length(next_tvb);
 205
 206         /* Look for sub-dissector, and call it if found.
 207            Catch exceptions, so that if the reported length of "next_tvb"
 208            was reduced by some dissector before an exception was thrown,
 209            we can still put in an item for the trailer. */
 210         saved_proto = pinfo->current_proto;
 211         TRY {
 212                 dissector_found = dissector_try_port(ethertype_dissector_table,
 213                     etype, next_tvb, pinfo, tree);
 214         }
 215         CATCH(BoundsError) {
 216                 /* Somebody threw BoundsError, which means that:
 217
 218                      1) a dissector was found, so we don't need to
 219                         dissect the payload as data or update the
 220                         protocol or info columns;
 221
 222                      2) dissecting the payload found that the packet was
 223                         cut off by a snapshot length before the end of
 224                         the payload.  The trailer comes after the payload,
 225                         so *all* of the trailer is cut off, and we'll
 226                         just get another BoundsError if we add the trailer.
 227
 228                    Therefore, we just rethrow the exception so it gets
 229                    reported; we don't dissect the trailer or do anything
 230                    else. */
 231                  RETHROW;
 232         }
 233         CATCH(OutOfMemoryError) {
 234                  RETHROW;
 235         }
 236         CATCH_ALL {
 237                 /* Somebody threw an exception other than BoundsError, which
 238                    means that a dissector was found, so we don't need to
 239                    dissect the payload as data or update the protocol or info
 240                    columns.  We just show the exception and then drive on
 241                    to show the trailer, after noting that a dissector was
 242                    found and restoring the protocol value that was in effect
 243                    before we called the subdissector. */
 244                 show_exception(next_tvb, pinfo, tree, EXCEPT_CODE, GET_MESSAGE);
 245                 dissector_found = TRUE;
 246                 pinfo->current_proto = saved_proto;
 247         }
 248         ENDTRY;
 249
 250         if (!dissector_found) {
 251                 /* No sub-dissector found.
 252                    Label rest of packet as "Data" */
 253                 call_dissector(data_handle,next_tvb, pinfo, tree);
 254
 255                 /* Label protocol */
 256                 if (check_col(pinfo->cinfo, COL_PROTOCOL)) {
 257                         col_add_fstr(pinfo->cinfo, COL_PROTOCOL, "0x%04x",
 258                             etype);
 259                 }
 260                 if (check_col(pinfo->cinfo, COL_INFO)) {
 261                         description = match_strval(etype, etype_vals);
 262                         if (description) {
 263                                 col_add_fstr(pinfo->cinfo, COL_INFO, "%s",
 264                                     description);
 265                         }
 266                 }
 267         }
 268
 269         add_dix_trailer(fh_tree, trailer_id, tvb, next_tvb, offset_after_etype,
 270             length_before, fcs_len);
 271 }
 272
 273 static void
 274 add_dix_trailer(proto_tree *fh_tree, int trailer_id, tvbuff_t *tvb,
 275     tvbuff_t *next_tvb, int offset_after_etype, guint length_before,
 276     gint fcs_len)
 277 {
 278         guint           length;
 279         tvbuff_t        *volatile trailer_tvb;
 280
 281         if (fh_tree == NULL)
 282                 return; /* we're not building a protocol tree */
 283
 284         if (trailer_id == -1)
 285                 return; /* our caller doesn't care about trailers */
 286
 287         /* OK, how much is there in that tvbuff now? */
 288         length = tvb_reported_length(next_tvb);
 289
 290         /* If there's less than there was before, what's left is
 291            a trailer. */
 292         if (length < length_before) {
 293                 /*
 294                  * Is any of the padding present in the tvbuff?
 295                  */
 296                 if (tvb_offset_exists(tvb, offset_after_etype + length)) {
 297                         /*
 298                          * Yes - create a tvbuff for the padding.
 299                          */
 300                         trailer_tvb = tvb_new_subset(tvb,
 301                             offset_after_etype + length, -1, -1);
 302                 } else {
 303                         /*
 304                          * No - don't bother showing the trailer.
 305                          * XXX - show a Short Frame indication?
 306                          */
 307                         trailer_tvb = NULL;
 308                 }
 309         } else
 310                 trailer_tvb = NULL;     /* no trailer */
 311
 312         add_ethernet_trailer(fh_tree, trailer_id, tvb, trailer_tvb, fcs_len);
 313 }
 314
 315 void
 316 proto_register_ethertype(void)
 317 {
 318         /* subdissector code */
 319         ethertype_dissector_table = register_dissector_table("ethertype",
 320             "Ethertype", FT_UINT16, BASE_HEX);
 321 }
 322
 323 void
 324 proto_reg_handoff_ethertype(void)
 325 {
 326         data_handle = find_dissector("data");
 327 }