epan/dissectors/packet-ethertype.c

   1 /* packet-ethertype.c
   2  * Routines for processing Ethernet payloads and payloads like Ethernet
   3  * payloads (i.e., payloads when there could be an Ethernet trailer and
   4  * possibly an FCS).
   5  *
   6  * $Id$
   7  *
   8  * Gilbert Ramirez <gram@alumni.rice.edu>
   9  *
  10  * Wireshark - Network traffic analyzer
  11  * By Gerald Combs <gerald@wireshark.org>
  12  * Copyright 1998 Gerald Combs
  13  *
  14  * This program is free software; you can redistribute it and/or
  15  * modify it under the terms of the GNU General Public License
  16  * as published by the Free Software Foundation; either version 2
  17  * of the License, or (at your option) any later version.
  18  *
  19  * This program is distributed in the hope that it will be useful,
  20  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  21  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  22  * GNU General Public License for more details.
  23  *
  24  * You should have received a copy of the GNU General Public License
  25  * along with this program; if not, write to the Free Software
  26  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
  27  */
  28
  29 #include "config.h"
  30
  31 #include <glib.h>
  32 #include <epan/packet.h>
  33 #include <epan/exceptions.h>
  34 #include <epan/etypes.h>
  35 #include <epan/ppptypes.h>
  36 #include <epan/show_exception.h>
  37 #include "packet-bpq.h"
  38 #include "packet-eth.h"
  39 #include "packet-ip.h"
  40 #include "packet-ipv6.h"
  41 #include "packet-ipx.h"
  42 #include "packet-vlan.h"
  43 #include "packet-ieee8021ah.h"
  44 #include "packet-vines.h"
  45
  46
  47 void proto_register_ethertype(void);
  48 void proto_reg_handoff_ethertype(void);
  49
  50 static dissector_table_t ethertype_dissector_table;
  51
  52 static dissector_handle_t data_handle;
  53
  54 const value_string etype_vals[] = {
  55         { ETHERTYPE_IP,                   "IP" },
  56         { ETHERTYPE_IPv6,                 "IPv6" },
  57         { ETHERTYPE_VLAN,                 "802.1Q Virtual LAN" },
  58         { ETHERTYPE_ARP,                  "ARP" },
  59         { ETHERTYPE_WLCCP,                "Cisco Wireless Lan Context Control Protocol" },
  60         { ETHERTYPE_MINT,                 "Motorola Media Indepentent Network Transport" },
  61         { ETHERTYPE_CENTRINO_PROMISC,     "IEEE 802.11 (Centrino promiscuous)" },
  62         { ETHERTYPE_XNS_IDP,              "XNS Internet Datagram Protocol" },
  63         { ETHERTYPE_X25L3,                "X.25 Layer 3" },
  64         { ETHERTYPE_WOL,                  "Wake on LAN" },
  65         { ETHERTYPE_WMX_M2M,              "WiMax Mac-to-Mac" },
  66         { ETHERTYPE_EPL_V1,               "EPL_V1" },
  67         { ETHERTYPE_REVARP,               "RARP" },
  68         { ETHERTYPE_DEC_LB,               "DEC LanBridge" },
  69         { ETHERTYPE_ATALK,                "Appletalk" },
  70         { ETHERTYPE_SNA,                  "SNA-over-Ethernet" },
  71         { ETHERTYPE_DLR,                  "EtherNet/IP Device Level Ring" },
  72         { ETHERTYPE_AARP,                 "AARP" },
  73         { ETHERTYPE_IPX,                  "Netware IPX/SPX" },
  74         { ETHERTYPE_VINES_IP,             "Vines IP" },
  75         { ETHERTYPE_VINES_ECHO,           "Vines Echo" },
  76         { ETHERTYPE_TRAIN,                "Netmon Train" },
  77         /* Ethernet Loopback */
  78         { ETHERTYPE_LOOP,                 "Loopback" },
  79         { ETHERTYPE_FOUNDRY,              "Foundry proprietary" },
  80         { ETHERTYPE_WCP,                  "Wellfleet Compression Protocol" },
  81         { ETHERTYPE_STP,                  "Spanning Tree Protocol" },
  82         /* for ISMP, see RFC 2641, RFC 2642, RFC 2643 */
  83         { ETHERTYPE_ISMP,                 "Cabletron Interswitch Message Protocol" },
  84         { ETHERTYPE_ISMP_TBFLOOD,         "Cabletron SFVLAN 1.8 Tag-Based Flood" },
  85         /* In www.iana.org/assignments/ethernet-numbers, 8203-8205 description is
  86          * Quantum Software.  Now the company is called QNX Software Systems. */
  87         { ETHERTYPE_QNX_QNET6,            "QNX 6 QNET protocol" },
  88         { ETHERTYPE_PPPOED,               "PPPoE Discovery" },
  89         { ETHERTYPE_PPPOES,               "PPPoE Session" },
  90         { ETHERTYPE_INTEL_ANS,            "Intel ANS probe" },
  91         { ETHERTYPE_MS_NLB_HEARTBEAT,     "MS NLB heartbeat" },
  92         { ETHERTYPE_JUMBO_LLC,            "Jumbo LLC" },
  93         { ETHERTYPE_HOMEPLUG,             "Homeplug" },
  94         { ETHERTYPE_HOMEPLUG_AV,          "Homeplug AV" },
  95         { ETHERTYPE_IEEE_802_1AD,         "802.1ad Provider Bridge (Q-in-Q)" },
  96         { ETHERTYPE_IEEE_802_1AH,         "802.1ah Provider Backbone Bridge (mac-in-mac)" },
  97         { ETHERTYPE_EAPOL,                "802.1X Authentication" },
  98         { ETHERTYPE_RSN_PREAUTH,          "802.11i Pre-Authentication" },
  99         { ETHERTYPE_MPLS,                 "MPLS label switched packet" },
 100         { ETHERTYPE_MPLS_MULTI,           "MPLS multicast label switched packet" },
 101         { ETHERTYPE_3C_NBP_DGRAM,         "3Com NBP Datagram" },
 102         { ETHERTYPE_DEC,                  "DEC proto" },
 103         { ETHERTYPE_DNA_DL,               "DEC DNA Dump/Load" },
 104         { ETHERTYPE_DNA_RC,               "DEC DNA Remote Console" },
 105         { ETHERTYPE_DNA_RT,               "DEC DNA Routing" },
 106         { ETHERTYPE_LAT,                  "DEC LAT" },
 107         { ETHERTYPE_DEC_DIAG,             "DEC Diagnostics" },
 108         { ETHERTYPE_DEC_CUST,             "DEC Customer use" },
 109         { ETHERTYPE_DEC_SCA,              "DEC LAVC/SCA" },
 110         { ETHERTYPE_DEC_LAST,             "DEC LAST" },
 111         { ETHERTYPE_ETHBRIDGE,            "Transparent Ethernet bridging" },
 112         { ETHERTYPE_CGMP,                 "Cisco Group Management Protocol" },
 113         { ETHERTYPE_GIGAMON,              "Gigamon Header" },
 114         { ETHERTYPE_MSRP,                 "802.1Qat Multiple Stream Reservation Protocol" },
 115         { ETHERTYPE_MMRP,                 "802.1ak Multiple Mac Registration Protocol" },
 116         { ETHERTYPE_AVBTP,                "IEEE 1722 Audio Video Bridging Transport Protocol" },
 117         { ETHERTYPE_ROHC,                 "Robust Header Compression(RoHC)" },
 118         { ETHERTYPE_TRILL,                "TRansparent Interconnection of Lots of Links" },
 119         { ETHERTYPE_L2ISIS,               "Intermediate System to Intermediate System" },
 120         { ETHERTYPE_MAC_CONTROL,          "MAC Control" },
 121         { ETHERTYPE_SLOW_PROTOCOLS,       "Slow Protocols" },
 122         { ETHERTYPE_RTMAC,                "Real-Time Media Access Control" },
 123         { ETHERTYPE_RTCFG,                "Real-Time Configuration Protocol" },
 124         { ETHERTYPE_CDMA2000_A10_UBS,     "CDMA2000 A10 Unstructured byte stream" },
 125         { ETHERTYPE_ATMOE,                "ATM over Ethernet" },
 126         { ETHERTYPE_PROFINET,             "PROFINET"},
 127         { ETHERTYPE_AOE,                  "ATA over Ethernet" },
 128         { ETHERTYPE_ECATF,                "EtherCAT frame" },
 129         { ETHERTYPE_TELKONET,             "Telkonet powerline" },
 130         { ETHERTYPE_EPL_V2,               "ETHERNET Powerlink v2"       },
 131         { ETHERTYPE_XIMETA,               "XiMeta Technology" },
 132         { ETHERTYPE_CSM_ENCAPS,           "CSM_ENCAPS Protocol" },
 133         { ETHERTYPE_IEEE802_OUI_EXTENDED, "IEEE 802a OUI Extended Ethertype" },
 134         { ETHERTYPE_IEC61850_GOOSE,       "IEC 61850/GOOSE" },
 135         { ETHERTYPE_IEC61850_GSE,         "IEC 61850/GSE management services" },
 136         { ETHERTYPE_IEC61850_SV,          "IEC 61850/SV (Sampled Value Transmission" },
 137         { ETHERTYPE_TIPC,                 "Transparent Inter Process Communication" },
 138         { ETHERTYPE_LLDP,                 "802.1 Link Layer Discovery Protocol (LLDP)" },
 139         { ETHERTYPE_3GPP2,                "CDMA2000 A10 3GPP2 Packet" },
 140         { ETHERTYPE_TTE_PCF,              "TTEthernet Protocol Control Frame" },
 141         { ETHERTYPE_CESOETH,              "Circuit Emulation Services over Ethernet (MEF8)" },
 142         { ETHERTYPE_LLTD,                 "Link Layer Topology Discovery (LLTD)" },
 143         { ETHERTYPE_WSMP,                 "(WAVE) Short Message Protocol (WSM)" },
 144         { ETHERTYPE_VMLAB,                "VMware Lab Manager" },
 145         { ETHERTYPE_COBRANET,             "Cirrus Cobranet Packet" },
 146         { ETHERTYPE_NSRP,                 "Juniper Netscreen Redundant Protocol" },
 147         /*
 148          * NDISWAN on Windows translates Ethernet frames from higher-level
 149          * protocols into PPP frames to hand to the PPP driver, and translates
 150          * PPP frames from the PPP driver to hand to the higher-level protocols.
 151          *
 152          * Apparently the PPP driver, on at least some versions of Windows,
 153          * passes frames for internal-to-PPP protocols up through NDISWAN;
 154          * the protocol type field appears to be passed through unchanged
 155          * (unlike what's done with, for example, the protocol type field
 156          * for IP, which is mapped from its PPP value to its Ethernet value).
 157          *
 158          * This means that we may see, on Ethernet captures, frames for
 159          * protocols internal to PPP, so we list as "Ethernet" protocol
 160          * types the PPP protocol types we've seen.
 161          */
 162         { PPP_IPCP,                       "PPP IP Control Protocol" },
 163         { PPP_LCP,                        "PPP Link Control Protocol" },
 164         { PPP_PAP,                        "PPP Password Authentication Protocol" },
 165         { PPP_CCP,                        "PPP Compression Control Protocol" },
 166         { ETHERTYPE_LLT,                  "Veritas Low Latency Transport (not officially registered)" },
 167         { ETHERTYPE_CFM,                  "IEEE 802.1ag Connectivity Fault Management (CFM) protocol" },
 168         { ETHERTYPE_DCE,                  "Data Center Ethernet (DCE) protocol(Cisco)" },
 169         { ETHERTYPE_FCOE,                 "Fibre Channel over Ethernet" },
 170         { ETHERTYPE_IEEE80211_DATA_ENCAP, "IEEE 802.11 data encapsulation" },
 171         { ETHERTYPE_LINX,                 "LINX IPC Protocol" },
 172         { ETHERTYPE_FIP,                  "FCoE Initialization Protocol" },
 173         { ETHERTYPE_MIH,                  "Media Independent Handover Protocol" },
 174         { ETHERTYPE_ELMI,                 "Ethernet Local Management Interface (MEF16)" },
 175         { ETHERTYPE_PTP,                  "PTPv2 over Ethernet (IEEE1588)" },
 176         { ETHERTYPE_NCSI,                 "Network Controller Sideband Interface" },
 177         { ETHERTYPE_PRP,                  "Parallel Redundancy Protocol (PRP) and HSR Supervision (IEC62439 Part 3)" },
 178         { ETHERTYPE_FLIP,                 "Flow Layer Internal Protocol" },
 179         { ETHERTYPE_ROCE,                 "RDMA over Converged Ethernet" },
 180         { ETHERTYPE_TDMOE,                "Digium TDM over Ethernet Protocol" },
 181         { ETHERTYPE_WAI,                  "WAI Authentication Protocol" },
 182         { ETHERTYPE_HSR,                  "High-availability Seamless Redundancy (IEC62439 Part 3)" },
 183         { ETHERTYPE_BPQ,                  "AX.25"},
 184         { ETHERTYPE_CMD,                  "CiscoMetaData"},
 185         { 0, NULL }
 186 };
 187
 188 static void add_dix_trailer(packet_info *pinfo, proto_tree *tree, proto_tree *fh_tree,
 189                             int trailer_id, tvbuff_t *tvb, tvbuff_t *next_tvb, int offset_after_etype,
 190                             guint length_before, gint fcs_len);
 191
 192 void
 193 capture_ethertype(guint16 etype, const guchar *pd, int offset, int len,
 194                   packet_counts *ld)
 195 {
 196         switch (etype) {
 197         case ETHERTYPE_ARP:
 198                 ld->arp++;
 199                 break;
 200         case ETHERTYPE_IP:
 201                 capture_ip(pd, offset, len, ld);
 202                 break;
 203         case ETHERTYPE_IPv6:
 204                 capture_ipv6(pd, offset, len, ld);
 205                 break;
 206         case ETHERTYPE_IPX:
 207                 capture_ipx(ld);
 208                 break;
 209         case ETHERTYPE_VLAN:
 210                 capture_vlan(pd, offset, len, ld);
 211                 break;
 212         case ETHERTYPE_IEEE_802_1AD:
 213         case ETHERTYPE_IEEE_802_1AH:
 214                 capture_ieee8021ah(pd, offset, len, ld);
 215                 break;
 216         case ETHERTYPE_VINES_IP:
 217         case ETHERTYPE_VINES_ECHO:
 218                 capture_vines(ld);
 219                 break;
 220         case ETHERTYPE_BPQ:
 221                 capture_bpq(pd, offset, len, ld);
 222                 break;
 223         default:
 224                 ld->other++;
 225                 break;
 226         }
 227 }
 228
 229 void
 230 ethertype(guint16 etype, tvbuff_t *tvb, int offset_after_etype,
 231           packet_info *pinfo, proto_tree *tree, proto_tree *fh_tree,
 232           int etype_id, int trailer_id, int fcs_len)
 233 {
 234         const char              *description;
 235         tvbuff_t                *volatile next_tvb;
 236         guint                   length_before;
 237         gint                    captured_length, reported_length;
 238         volatile gboolean       dissector_found = FALSE;
 239         const char              *volatile saved_proto;
 240         void                    *pd_save;
 241
 242         /* Add the Ethernet type to the protocol tree */
 243         if (tree) {
 244                 proto_tree_add_uint(fh_tree, etype_id, tvb,
 245                                     offset_after_etype - 2, 2, etype);
 246         }
 247
 248         /* Get the captured length and reported length of the data
 249            after the Ethernet type. */
 250         captured_length = tvb_length_remaining(tvb, offset_after_etype);
 251         reported_length = tvb_reported_length_remaining(tvb,
 252                                                         offset_after_etype);
 253
 254         /* Remember how much data there is after the Ethernet type,
 255            including any trailer and FCS. */
 256         length_before = reported_length;
 257
 258         /* Construct a tvbuff for the payload after the Ethernet type.
 259            If the FCS length is positive, remove the FCS.
 260            (If it's zero, there's no FCS; if it's negative,
 261            we don't know whether there's an FCS, so we'll
 262            guess based on the length of the trailer.) */
 263         if (fcs_len > 0) {
 264                 if (captured_length >= 0 && reported_length >= 0) {
 265                         if (reported_length >= fcs_len)
 266                                 reported_length -= fcs_len;
 267                         if (captured_length > reported_length)
 268                                 captured_length = reported_length;
 269                 }
 270         }
 271         next_tvb = tvb_new_subset(tvb, offset_after_etype, captured_length,
 272                                   reported_length);
 273
 274         pinfo->ethertype = etype;
 275
 276         /* Look for sub-dissector, and call it if found.
 277            Catch exceptions, so that if the reported length of "next_tvb"
 278            was reduced by some dissector before an exception was thrown,
 279            we can still put in an item for the trailer. */
 280         saved_proto = pinfo->current_proto;
 281         pd_save = pinfo->private_data;
 282         TRY {
 283                 dissector_found = dissector_try_uint(ethertype_dissector_table,
 284                                                      etype, next_tvb, pinfo, tree);
 285         }
 286         CATCH_NONFATAL_ERRORS {
 287                 /* Somebody threw an exception that means that there
 288                    was a problem dissecting the payload; that means
 289                    that a dissector was found, so we don't need to
 290                    dissect the payload as data or update the protocol
 291                    or info columns.
 292
 293                    Just show the exception and then drive on to show
 294                    the trailer, after noting that a dissector was found
 295                    and restoring the protocol value that was in effect
 296                    before we called the subdissector. */
 297                 show_exception(next_tvb, pinfo, tree, EXCEPT_CODE, GET_MESSAGE);
 298
 299                 /*  Restore the private_data structure in case one of the
 300                  *  called dissectors modified it (and, due to the exception,
 301                  *  was unable to restore it).
 302                  */
 303                 pinfo->private_data = pd_save;
 304                 dissector_found = TRUE;
 305                 pinfo->current_proto = saved_proto;
 306         }
 307         ENDTRY;
 308
 309         if (!dissector_found) {
 310                 /* No sub-dissector found.
 311                    Label rest of packet as "Data" */
 312                 call_dissector(data_handle,next_tvb, pinfo, tree);
 313
 314                 /* Label protocol */
 315                 col_add_fstr(pinfo->cinfo, COL_PROTOCOL, "0x%04x", etype);
 316
 317                 description = try_val_to_str(etype, etype_vals);
 318                 if (description) {
 319                         col_add_str(pinfo->cinfo, COL_INFO, description);
 320                 }
 321         }
 322
 323         add_dix_trailer(pinfo, tree, fh_tree, trailer_id, tvb, next_tvb, offset_after_etype,
 324                         length_before, fcs_len);
 325 }
 326
 327 static void
 328 add_dix_trailer(packet_info *pinfo, proto_tree *tree, proto_tree *fh_tree, int trailer_id,
 329                 tvbuff_t *tvb, tvbuff_t *next_tvb, int offset_after_etype,
 330                 guint length_before, gint fcs_len)
 331 {
 332         guint            length;
 333         tvbuff_t        *trailer_tvb;
 334
 335         /* OK, how much is there in that tvbuff now? */
 336         length = tvb_reported_length(next_tvb);
 337
 338         /* If there's less than there was before, what's left is
 339            a trailer. */
 340         if (length < length_before) {
 341                 /*
 342                  * Is any of the padding present in the tvbuff?
 343                  */
 344                 if (tvb_offset_exists(tvb, offset_after_etype + length)) {
 345                         /*
 346                          * Yes - create a tvbuff for the padding.
 347                          */
 348                         trailer_tvb = tvb_new_subset_remaining(tvb,
 349                                                                offset_after_etype + length);
 350                 } else {
 351                         /*
 352                          * No - don't bother showing the trailer.
 353                          * XXX - show a Short Frame indication?
 354                          */
 355                         trailer_tvb = NULL;
 356                 }
 357         } else
 358                 trailer_tvb = NULL;     /* no trailer */
 359
 360         add_ethernet_trailer(pinfo, tree, fh_tree, trailer_id, tvb, trailer_tvb, fcs_len);
 361 }
 362
 363 void
 364 proto_register_ethertype(void)
 365 {
 366         /* subdissector code */
 367         ethertype_dissector_table = register_dissector_table("ethertype",
 368                                                              "Ethertype", FT_UINT16, BASE_HEX);
 369 }
 370
 371 void
 372 proto_reg_handoff_ethertype(void)
 373 {
 374         data_handle = find_dissector("data");
 375 }