packet-bpdu.c

   1 /* packet-bpdu.c
   2  * Routines for BPDU (Spanning Tree Protocol) disassembly
   3  *
   4  * $Id: packet-bpdu.c,v 1.26 2001/06/18 02:17:45 guy Exp $
   5  *
   6  * Copyright 1999 Christophe Tronche <ch.tronche@computer.org>
   7  *
   8  * Ethereal - Network traffic analyzer
   9  * By Gerald Combs <gerald@ethereal.com>
  10  * Copyright 1998 Gerald Combs
  11  *
  12  *
  13  * This program is free software; you can redistribute it and/or
  14  * modify it under the terms of the GNU General Public License
  15  * as published by the Free Software Foundation; either version 2
  16  * of the License, or (at your option) any later version.
  17  *
  18  * This program is distributed in the hope that it will be useful,
  19  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  20  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  21  * GNU General Public License for more details.
  22  *
  23  * You should have received a copy of the GNU General Public License
  24  * along with this program; if not, write to the Free Software
  25  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  26  */
  27
  28 #ifdef HAVE_CONFIG_H
  29 # include "config.h"
  30 #endif
  31
  32 #ifdef HAVE_SYS_TYPES_H
  33 # include <sys/types.h>
  34 #endif
  35
  36 #ifdef HAVE_NETINET_IN_H
  37 # include <netinet/in.h>
  38 #endif
  39
  40 #include <stdio.h>
  41 #include <string.h>
  42 #include <glib.h>
  43 #include "packet.h"
  44 #include "llcsaps.h"
  45 #include "ppptypes.h"
  46 #include "resolv.h"
  47
  48 /* Offsets of fields within a BPDU */
  49
  50 #define BPDU_IDENTIFIER          0
  51 #define BPDU_VERSION_IDENTIFIER  2
  52 #define BPDU_TYPE                3
  53 #define BPDU_FLAGS               4
  54 #define BPDU_ROOT_IDENTIFIER     5
  55 #define BPDU_ROOT_PATH_COST     13
  56 #define BPDU_BRIDGE_IDENTIFIER  17
  57 #define BPDU_PORT_IDENTIFIER    25
  58 #define BPDU_MESSAGE_AGE        27
  59 #define BPDU_MAX_AGE            29
  60 #define BPDU_HELLO_TIME         31
  61 #define BPDU_FORWARD_DELAY      33
  62
  63 static int proto_bpdu = -1;
  64 static int hf_bpdu_proto_id = -1;
  65 static int hf_bpdu_version_id = -1;
  66 static int hf_bpdu_type = -1;
  67 static int hf_bpdu_flags = -1;
  68 static int hf_bpdu_root_mac = -1;
  69 static int hf_bpdu_root_cost = -1;
  70 static int hf_bpdu_bridge_mac = -1;
  71 static int hf_bpdu_port_id = -1;
  72 static int hf_bpdu_msg_age = -1;
  73 static int hf_bpdu_max_age = -1;
  74 static int hf_bpdu_hello_time = -1;
  75 static int hf_bpdu_forward_delay = -1;
  76
  77 static gint ett_bpdu = -1;
  78
  79 static dissector_handle_t gvrp_handle;
  80
  81 static void
  82 dissect_bpdu(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) {
  83       guint16 protocol_identifier;
  84       guint8  protocol_version_identifier;
  85       guint8  bpdu_type;
  86       guint8  flags;
  87       guint16 root_identifier_bridge_priority;
  88       const guint8  *root_identifier_mac;
  89       gchar   *root_identifier_mac_str;
  90       guint32 root_path_cost;
  91       guint16 bridge_identifier_bridge_priority;
  92       const guint8  *bridge_identifier_mac;
  93       gchar   *bridge_identifier_mac_str;
  94       guint16 port_identifier;
  95       double message_age;
  96       double max_age;
  97       double hello_time;
  98       double forward_delay;
  99
 100       proto_tree *bpdu_tree;
 101       proto_item *ti;
 102
 103       /* GARP application frames require special interpretation of the
 104          destination address field; otherwise, they will be mistaken as
 105          BPDU frames.
 106          Fortunately, they can be recognized by checking the first 6 octets
 107          of the destination address, which are in the range from
 108          01-80-C2-00-00-20 to 01-80-C2-00-00-2F.
 109
 110          Yes - we *do* need to check the destination address type;
 111          on Linux cooked captures, there *is* no destination address,
 112          so it's AT_NONE. */
 113       if (pinfo->dl_dst.type == AT_ETHER &&
 114           pinfo->dl_dst.data[0] == 0x01 && pinfo->dl_dst.data[1] == 0x80 &&
 115           pinfo->dl_dst.data[2] == 0xC2 && pinfo->dl_dst.data[3] == 0x00 &&
 116           pinfo->dl_dst.data[4] == 0x00 && ((pinfo->dl_dst.data[5] & 0x20) == 0x20)) {
 117
 118             protocol_identifier = tvb_get_ntohs(tvb, BPDU_IDENTIFIER);
 119
 120             switch (pinfo->dl_dst.data[5]) {
 121
 122             case 0x20:
 123                   /* Future expansion for GMRP */
 124                   break;
 125
 126             case 0x21:
 127                   /* for GVRP */
 128                   call_dissector(gvrp_handle, tvb, pinfo, tree);
 129                   return;
 130             }
 131
 132             pinfo->current_proto = "GARP";
 133
 134             if (check_col(pinfo->fd, COL_PROTOCOL)) {
 135                     col_set_str(pinfo->fd, COL_PROTOCOL, "GARP");
 136                     /* Generic Attribute Registration Protocol */
 137             }
 138
 139             if (check_col(pinfo->fd, COL_INFO)) {
 140                     col_add_fstr(pinfo->fd, COL_INFO,
 141                         "Unknown GARP application (0x%02X)",
 142                         pinfo->dl_dst.data[5]);
 143             }
 144
 145             return;
 146       }
 147
 148       if (check_col(pinfo->fd, COL_PROTOCOL)) {
 149             col_set_str(pinfo->fd, COL_PROTOCOL, "STP"); /* Spanning Tree Protocol */
 150       }
 151       if (check_col(pinfo->fd, COL_INFO)) {
 152             col_clear(pinfo->fd, COL_INFO);
 153       }
 154
 155       bpdu_type = tvb_get_guint8(tvb, BPDU_TYPE);
 156       if (bpdu_type == 0) {
 157             flags = tvb_get_guint8(tvb, BPDU_FLAGS);
 158             root_identifier_bridge_priority = tvb_get_ntohs(tvb,
 159                 BPDU_ROOT_IDENTIFIER);
 160             root_identifier_mac = tvb_get_ptr(tvb, BPDU_ROOT_IDENTIFIER + 2, 6);
 161             root_identifier_mac_str = ether_to_str(root_identifier_mac);
 162             root_path_cost = tvb_get_ntohl(tvb, BPDU_ROOT_PATH_COST);
 163             port_identifier = tvb_get_ntohs(tvb, BPDU_PORT_IDENTIFIER);
 164       } else {
 165             /* Squelch GCC complaints. */
 166             flags = 0;
 167             root_identifier_bridge_priority = 0;
 168             root_identifier_mac = NULL;
 169             root_identifier_mac_str = NULL;
 170             root_path_cost = 0;
 171             port_identifier = 0;
 172       }
 173
 174       if (check_col(pinfo->fd, COL_INFO)) {
 175             if (bpdu_type == 0)
 176                   col_add_fstr(pinfo->fd, COL_INFO, "Conf. %sRoot = %d/%s  Cost = %d  Port = 0x%04x",
 177                                flags & 0x1 ? "TC + " : "",
 178                                root_identifier_bridge_priority, root_identifier_mac_str, root_path_cost,
 179                                port_identifier);
 180             else if (bpdu_type == 0x80)
 181                   col_add_fstr(pinfo->fd, COL_INFO, "Topology Change Notification");
 182       }
 183
 184       if (tree) {
 185             ti = proto_tree_add_protocol_format(tree, proto_bpdu, tvb, 0, 35,
 186                                 "Spanning Tree Protocol");
 187             bpdu_tree = proto_item_add_subtree(ti, ett_bpdu);
 188
 189             protocol_identifier = tvb_get_ntohs(tvb, BPDU_IDENTIFIER);
 190             proto_tree_add_uint_format(bpdu_tree, hf_bpdu_proto_id, tvb,
 191                                        BPDU_IDENTIFIER, 2,
 192                                        protocol_identifier,
 193                                        "Protocol Identifier: 0x%04x (%s)",
 194                                        protocol_identifier,
 195                                        protocol_identifier == 0 ?
 196                                        "Spanning Tree" : "Unknown Protocol");
 197
 198             protocol_version_identifier = tvb_get_guint8(tvb, BPDU_VERSION_IDENTIFIER);
 199             proto_tree_add_uint(bpdu_tree, hf_bpdu_version_id, tvb,
 200                                 BPDU_VERSION_IDENTIFIER, 1,
 201                                 protocol_version_identifier);
 202             if (protocol_version_identifier != 0)
 203                   proto_tree_add_text(bpdu_tree, tvb, BPDU_VERSION_IDENTIFIER, 1,
 204                   "   (Warning: this version of Ethereal only knows about version = 0)");
 205             proto_tree_add_uint_format(bpdu_tree, hf_bpdu_type, tvb,
 206                                        BPDU_TYPE, 1,
 207                                        bpdu_type,
 208                                        "BPDU Type: 0x%02x (%s)",
 209                                        bpdu_type,
 210                                        bpdu_type == 0 ? "Configuration" :
 211                                        bpdu_type == 0x80 ? "Topology Change Notification" : "Unknown");
 212
 213             if (bpdu_type != 0) {
 214               dissect_data(tvb, BPDU_TYPE + 1, pinfo, tree);
 215               return;
 216             }
 217
 218             bridge_identifier_bridge_priority = tvb_get_ntohs(tvb, BPDU_BRIDGE_IDENTIFIER);
 219             bridge_identifier_mac = tvb_get_ptr(tvb, BPDU_BRIDGE_IDENTIFIER + 2, 6);
 220             bridge_identifier_mac_str = ether_to_str(bridge_identifier_mac);
 221             message_age = tvb_get_ntohs(tvb, BPDU_MESSAGE_AGE) / 256.0;
 222             max_age = tvb_get_ntohs(tvb, BPDU_MAX_AGE) / 256.0;
 223             hello_time = tvb_get_ntohs(tvb, BPDU_HELLO_TIME) / 256.0;
 224             forward_delay = tvb_get_ntohs(tvb, BPDU_FORWARD_DELAY) / 256.0;
 225
 226             proto_tree_add_uint(bpdu_tree, hf_bpdu_flags, tvb,
 227                                 BPDU_FLAGS, 1, flags);
 228             if (flags & 0x80)
 229                   proto_tree_add_text(bpdu_tree, tvb, BPDU_FLAGS, 1, "   1... ....  Topology Change Acknowledgment");
 230             if (flags & 0x01)
 231                   proto_tree_add_text(bpdu_tree, tvb, BPDU_FLAGS, 1, "   .... ...1  Topology Change");
 232
 233             proto_tree_add_ether_hidden(bpdu_tree, hf_bpdu_root_mac, tvb,
 234                                        BPDU_ROOT_IDENTIFIER + 2, 6,
 235                                        root_identifier_mac);
 236             proto_tree_add_text(bpdu_tree, tvb,
 237                                 BPDU_ROOT_IDENTIFIER, 8,
 238                                 "Root Identifier: %d / %s",
 239                                 root_identifier_bridge_priority,
 240                                 root_identifier_mac_str);
 241             proto_tree_add_uint(bpdu_tree, hf_bpdu_root_cost, tvb,
 242                                 BPDU_ROOT_PATH_COST, 4,
 243                                 root_path_cost);
 244             proto_tree_add_text(bpdu_tree, tvb,
 245                                 BPDU_BRIDGE_IDENTIFIER, 8,
 246                                 "Bridge Identifier: %d / %s",
 247                                 bridge_identifier_bridge_priority,
 248                                 bridge_identifier_mac_str);
 249             proto_tree_add_ether_hidden(bpdu_tree, hf_bpdu_bridge_mac, tvb,
 250                                        BPDU_BRIDGE_IDENTIFIER + 2, 6,
 251                                        bridge_identifier_mac);
 252             proto_tree_add_uint(bpdu_tree, hf_bpdu_port_id, tvb,
 253                                 BPDU_PORT_IDENTIFIER, 2,
 254                                 port_identifier);
 255             proto_tree_add_double(bpdu_tree, hf_bpdu_msg_age, tvb,
 256                                 BPDU_MESSAGE_AGE, 2,
 257                                 message_age);
 258             proto_tree_add_double(bpdu_tree, hf_bpdu_max_age, tvb,
 259                                 BPDU_MAX_AGE, 2,
 260                                 max_age);
 261             proto_tree_add_double(bpdu_tree, hf_bpdu_hello_time, tvb,
 262                                 BPDU_HELLO_TIME, 2,
 263                                 hello_time);
 264             proto_tree_add_double(bpdu_tree, hf_bpdu_forward_delay, tvb,
 265                                 BPDU_FORWARD_DELAY, 2,
 266                                 forward_delay);
 267       }
 268 }
 269
 270 void
 271 proto_register_bpdu(void)
 272 {
 273
 274   static hf_register_info hf[] = {
 275     { &hf_bpdu_proto_id,
 276       { "Protocol Identifier",          "stp.protocol",
 277         FT_UINT16,      BASE_HEX,       NULL,   0x0,
 278         "", HFILL }},
 279     { &hf_bpdu_version_id,
 280       { "Protocol Version Identifier",  "stp.version",
 281         FT_UINT8,       BASE_DEC,       NULL,   0x0,
 282         "", HFILL }},
 283     { &hf_bpdu_type,
 284       { "BPDU type",                    "stp.type",
 285         FT_UINT8,       BASE_HEX,       NULL,   0x0,
 286         "", HFILL }},
 287     { &hf_bpdu_flags,
 288       { "BPDU flags",                   "stp.flags",
 289         FT_UINT8,       BASE_HEX,       NULL,   0x0,
 290         "", HFILL }},
 291     { &hf_bpdu_root_mac,
 292       { "Root Identifier",              "stp.root.hw",
 293         FT_ETHER,       BASE_NONE,      NULL,   0x0,
 294         "", HFILL }},
 295     { &hf_bpdu_root_cost,
 296       { "Root Path Cost",               "stp.root.cost",
 297         FT_UINT32,      BASE_DEC,       NULL,   0x0,
 298         "", HFILL }},
 299     { &hf_bpdu_bridge_mac,
 300       { "Bridge Identifier",            "stp.bridge.hw",
 301         FT_ETHER,       BASE_NONE,      NULL,   0x0,
 302         "", HFILL }},
 303     { &hf_bpdu_port_id,
 304       { "Port identifier",              "stp.port",
 305         FT_UINT16,      BASE_HEX,       NULL,   0x0,
 306         "", HFILL }},
 307     { &hf_bpdu_msg_age,
 308       { "Message Age",                  "stp.msg_age",
 309         FT_DOUBLE,      BASE_NONE,      NULL,   0x0,
 310         "", HFILL }},
 311     { &hf_bpdu_max_age,
 312       { "Max Age",                      "stp.max_age",
 313         FT_DOUBLE,      BASE_NONE,      NULL,   0x0,
 314         "", HFILL }},
 315     { &hf_bpdu_hello_time,
 316       { "Hello Time",                   "stp.hello",
 317         FT_DOUBLE,      BASE_NONE,      NULL,   0x0,
 318         "", HFILL }},
 319     { &hf_bpdu_forward_delay,
 320       { "Forward Delay",                "stp.forward",
 321         FT_DOUBLE,      BASE_NONE,      NULL,   0x0,
 322         "", HFILL }},
 323   };
 324   static gint *ett[] = {
 325     &ett_bpdu,
 326   };
 327
 328   proto_bpdu = proto_register_protocol("Spanning Tree Protocol", "STP", "stp");
 329   proto_register_field_array(proto_bpdu, hf, array_length(hf));
 330   proto_register_subtree_array(ett, array_length(ett));
 331
 332   register_dissector("bpdu", dissect_bpdu, proto_bpdu);
 333 }
 334
 335 void
 336 proto_reg_handoff_bpdu(void)
 337 {
 338   /*
 339    * Get handle for the GVRP dissector.
 340    */
 341   gvrp_handle = find_dissector("gvrp");
 342
 343   dissector_add("llc.dsap", SAP_BPDU, dissect_bpdu, proto_bpdu);
 344   dissector_add("ppp.protocol", PPP_BPDU, dissect_bpdu, proto_bpdu);
 345 }