2 * copyright (c) 2001-2009 Emil Mikulic.
4 * decode.c: packet decoding.
6 * Given a captured packet, decode it and fill out a pktsummary struct which
7 * will be sent to the accounting code in acct.c
9 * You may use, modify and redistribute this file under the terms of the
10 * GNU General Public License version 2. (see COPYING.GPL)
20 #include <sys/ioctl.h>
21 #include <sys/socket.h>
26 #include <arpa/inet.h> /* inet_ntoa() */
28 /* need struct ether_header */
29 #if defined(__NetBSD__) || defined(__OpenBSD__)
30 # include <sys/queue.h>
32 # include <net/if_arp.h>
33 # include <netinet/if_ether.h>
36 # include <sys/ethernet.h>
37 # define ETHER_HDR_LEN 14
40 # include <netinet/if_ether.h>
41 # define ETHER_HDR_LEN 14
43 # include <net/ethernet.h>
47 #ifndef ETHERTYPE_PPPOE
48 #define ETHERTYPE_PPPOE 0x8864
51 #ifndef ETHERTYPE_IPV6
52 # ifdef HAVE_NET_IF_ETHER_H
53 # include <net/if_ether.h> /* ETH_P_IPV6 for GNU/kfreebsd */
56 # define ETHERTYPE_IPV6 ETH_P_IPV6
60 #include <net/if.h> /* struct ifreq */
61 #include <netinet/in_systm.h> /* n_long */
62 #include <netinet/ip.h> /* struct ip */
63 #include <netinet/ip6.h> /* struct ip6_hdr */
65 #include <netinet/tcp.h> /* struct tcphdr */
66 #include <netinet/udp.h> /* struct udphdr */
68 static void decode_ether(u_char
*, const struct pcap_pkthdr
*,
70 static void decode_loop(u_char
*, const struct pcap_pkthdr
*,
72 static void decode_ppp(u_char
*, const struct pcap_pkthdr
*,
74 static void decode_pppoe(u_char
*, const struct pcap_pkthdr
*,
76 static void decode_pppoe_real(const u_char
*pdata
, const uint32_t len
,
77 struct pktsummary
*sm
);
78 static void decode_linux_sll(u_char
*, const struct pcap_pkthdr
*,
80 static void decode_raw(u_char
*, const struct pcap_pkthdr
*,
82 static void decode_ip(const u_char
*pdata
, const uint32_t len
,
83 struct pktsummary
*sm
);
84 static void decode_ipv6(const u_char
*pdata
, const uint32_t len
,
85 struct pktsummary
*sm
);
87 /* Link-type header information */
88 static const struct linkhdr linkhdrs
[] = {
89 /* linktype hdrlen handler */
90 { DLT_EN10MB
, ETHER_HDR_LEN
, decode_ether
},
91 { DLT_LOOP
, NULL_HDR_LEN
, decode_loop
},
92 { DLT_NULL
, NULL_HDR_LEN
, decode_loop
},
93 { DLT_PPP
, PPP_HDR_LEN
, decode_ppp
},
94 #if defined(__NetBSD__)
95 { DLT_PPP_SERIAL
, PPP_HDR_LEN
, decode_ppp
},
97 { DLT_FDDI
, FDDI_HDR_LEN
, NULL
},
98 { DLT_PPP_ETHER
, PPPOE_HDR_LEN
, decode_pppoe
},
100 { DLT_LINUX_SLL
, SLL_HDR_LEN
, decode_linux_sll
},
102 { DLT_RAW
, RAW_HDR_LEN
, decode_raw
},
107 * Returns a pointer to the linkhdr record matching the given linktype, or
108 * NULL if no matching entry found.
110 const struct linkhdr
*
111 getlinkhdr(const int linktype
)
115 for (i
=0; linkhdrs
[i
].linktype
!= -1; i
++)
116 if (linkhdrs
[i
].linktype
== linktype
)
117 return (&(linkhdrs
[i
]));
122 * Returns the minimum snaplen needed to decode everything up to the TCP/UDP
123 * packet headers. The IPv6 header is normative. The argument lh is not
124 * allowed to be NULL.
127 getsnaplen(const struct linkhdr
*lh
)
129 return (int)(lh
->hdrlen
+ IPV6_HDR_LEN
+ max(TCP_HDR_LEN
, UDP_HDR_LEN
));
132 /* Decoding functions. */
134 decode_ether(u_char
*user _unused_
,
135 const struct pcap_pkthdr
*pheader
,
139 const struct ether_header
*hdr
= (const struct ether_header
*)pdata
;
140 struct pktsummary sm
;
141 memset(&sm
, 0, sizeof(sm
));
142 sm
.time
= pheader
->ts
.tv_sec
;
144 if (pheader
->caplen
< ETHER_HDR_LEN
) {
145 verbosef("ether: packet too short (%u bytes)", pheader
->caplen
);
150 memcpy(sm
.src_mac
, hdr
->ether_shost
.ether_addr_octet
, sizeof(sm
.src_mac
));
151 memcpy(sm
.dst_mac
, hdr
->ether_dhost
.ether_addr_octet
, sizeof(sm
.dst_mac
));
153 memcpy(sm
.src_mac
, hdr
->ether_shost
, sizeof(sm
.src_mac
));
154 memcpy(sm
.dst_mac
, hdr
->ether_dhost
, sizeof(sm
.dst_mac
));
157 type
= ntohs( hdr
->ether_type
);
161 if (!opt_want_pppoe
) {
162 decode_ip(pdata
+ ETHER_HDR_LEN
,
163 pheader
->caplen
- ETHER_HDR_LEN
, &sm
);
166 verbosef("ether: discarded IP packet, expecting PPPoE instead");
169 /* known protocol, don't complain about it. */
171 case ETHERTYPE_PPPOE
:
173 decode_pppoe_real(pdata
+ ETHER_HDR_LEN
,
174 pheader
->caplen
- ETHER_HDR_LEN
, &sm
);
176 verbosef("ether: got PPPoE frame: maybe you want --pppoe");
179 verbosef("ether: unknown protocol (0x%04x)", type
);
184 decode_loop(u_char
*user _unused_
,
185 const struct pcap_pkthdr
*pheader
,
189 struct pktsummary sm
;
190 memset(&sm
, 0, sizeof(sm
));
192 if (pheader
->caplen
< NULL_HDR_LEN
) {
193 verbosef("loop: packet too short (%u bytes)", pheader
->caplen
);
196 family
= *(const uint32_t *)pdata
;
198 family
= ntohl(family
);
200 if (family
== AF_INET
) {
201 /* OpenBSD tun or FreeBSD tun or FreeBSD lo */
202 decode_ip(pdata
+ NULL_HDR_LEN
, pheader
->caplen
- NULL_HDR_LEN
, &sm
);
203 sm
.time
= pheader
->ts
.tv_sec
;
206 else if (family
== AF_INET6
) {
207 /* XXX: Check this! */
208 decode_ip(pdata
+ NULL_HDR_LEN
, pheader
->caplen
- NULL_HDR_LEN
, &sm
);
209 sm
.time
= pheader
->ts
.tv_sec
;
213 verbosef("loop: unknown family (%x)", family
);
217 decode_ppp(u_char
*user _unused_
,
218 const struct pcap_pkthdr
*pheader
,
221 struct pktsummary sm
;
222 memset(&sm
, 0, sizeof(sm
));
224 if (pheader
->caplen
< PPPOE_HDR_LEN
) {
225 verbosef("ppp: packet too short (%u bytes)", pheader
->caplen
);
229 if (pdata
[2] == 0x00 && pdata
[3] == 0x21) {
230 decode_ip(pdata
+ PPP_HDR_LEN
, pheader
->caplen
- PPP_HDR_LEN
, &sm
);
231 sm
.time
= pheader
->ts
.tv_sec
;
234 verbosef("non-IP PPP packet; ignoring.");
238 decode_pppoe(u_char
*user _unused_
,
239 const struct pcap_pkthdr
*pheader
,
242 struct pktsummary sm
;
243 memset(&sm
, 0, sizeof(sm
));
244 sm
.time
= pheader
->ts
.tv_sec
;
245 decode_pppoe_real(pdata
, pheader
->caplen
, &sm
);
249 decode_pppoe_real(const u_char
*pdata
, const uint32_t len
,
250 struct pktsummary
*sm
)
252 if (len
< PPPOE_HDR_LEN
) {
253 verbosef("pppoe: packet too short (%u bytes)", len
);
257 if (pdata
[1] != 0x00) {
258 verbosef("pppoe: code = 0x%02x, expecting 0; ignoring.", pdata
[1]);
262 if ((pdata
[6] == 0xc0) && (pdata
[7] == 0x21)) return; /* LCP */
263 if ((pdata
[6] == 0xc0) && (pdata
[7] == 0x25)) return; /* LQR */
265 if ((pdata
[6] == 0x00) && (pdata
[7] == 0x21)) {
266 decode_ip(pdata
+ PPPOE_HDR_LEN
, len
- PPPOE_HDR_LEN
, sm
);
269 verbosef("pppoe: non-IP PPPoE packet (0x%02x%02x); ignoring.",
273 /* very similar to decode_ether ... */
275 decode_linux_sll(u_char
*user _unused_
,
276 const struct pcap_pkthdr
*pheader
,
279 const struct sll_header
{
280 uint16_t packet_type
;
281 uint16_t device_type
;
282 uint16_t addr_length
;
283 #define SLL_MAX_ADDRLEN 8
284 uint8_t addr
[SLL_MAX_ADDRLEN
];
286 } *hdr
= (const struct sll_header
*)pdata
;
288 struct pktsummary sm
;
289 memset(&sm
, 0, sizeof(sm
));
291 if (pheader
->caplen
< SLL_HDR_LEN
) {
292 verbosef("linux_sll: packet too short (%u bytes)", pheader
->caplen
);
296 type
= ntohs( hdr
->ether_type
);
300 decode_ip(pdata
+ SLL_HDR_LEN
, pheader
->caplen
- SLL_HDR_LEN
, &sm
);
301 sm
.time
= pheader
->ts
.tv_sec
;
305 /* known protocol, don't complain about it. */
308 verbosef("linux_sll: unknown protocol (%04x)", type
);
313 decode_raw(u_char
*user _unused_
,
314 const struct pcap_pkthdr
*pheader
,
317 struct pktsummary sm
;
318 memset(&sm
, 0, sizeof(sm
));
320 decode_ip(pdata
, pheader
->caplen
, &sm
);
321 sm
.time
= pheader
->ts
.tv_sec
;
325 static void decode_ip_payload(const u_char
*pdata
, const uint32_t len
,
326 struct pktsummary
*sm
);
329 decode_ip(const u_char
*pdata
, const uint32_t len
, struct pktsummary
*sm
)
331 const struct ip
*hdr
= (const struct ip
*)pdata
;
333 if (hdr
->ip_v
== 6) {
334 /* Redirect parsing of IPv6 packets. */
335 decode_ipv6(pdata
, len
, sm
);
338 if (len
< IP_HDR_LEN
) {
339 verbosef("ip: packet too short (%u bytes)", len
);
342 if (hdr
->ip_v
!= 4) {
343 verbosef("ip: version %d (expecting 4 or 6)", hdr
->ip_v
);
347 sm
->len
= ntohs(hdr
->ip_len
);
348 sm
->proto
= hdr
->ip_p
;
350 sm
->src
.family
= IPv4
;
351 sm
->src
.ip
.v4
= hdr
->ip_src
.s_addr
;
353 sm
->dst
.family
= IPv4
;
354 sm
->dst
.ip
.v4
= hdr
->ip_dst
.s_addr
;
356 decode_ip_payload(pdata
+ IP_HDR_LEN
, len
- IP_HDR_LEN
, sm
);
360 decode_ipv6(const u_char
*pdata
, const uint32_t len
, struct pktsummary
*sm
)
362 const struct ip6_hdr
*hdr
= (const struct ip6_hdr
*)pdata
;
364 if (len
< IPV6_HDR_LEN
) {
365 verbosef("ipv6: packet too short (%u bytes)", len
);
369 sm
->len
= ntohs(hdr
->ip6_plen
) + IPV6_HDR_LEN
;
370 sm
->proto
= hdr
->ip6_nxt
;
372 sm
->src
.family
= IPv6
;
373 memcpy(&sm
->src
.ip
.v6
, &hdr
->ip6_src
, sizeof(sm
->src
.ip
.v6
));
375 sm
->dst
.family
= IPv6
;
376 memcpy(&sm
->dst
.ip
.v6
, &hdr
->ip6_dst
, sizeof(sm
->dst
.ip
.v6
));
378 decode_ip_payload(pdata
+ IPV6_HDR_LEN
, len
- IPV6_HDR_LEN
, sm
);
382 decode_ip_payload(const u_char
*pdata
, const uint32_t len
,
383 struct pktsummary
*sm
)
387 const struct tcphdr
*thdr
= (const struct tcphdr
*)pdata
;
388 if (len
< TCP_HDR_LEN
) {
389 verbosef("tcp: packet too short (%u bytes)", len
);
390 sm
->proto
= IPPROTO_INVALID
; /* don't do accounting! */
393 sm
->src_port
= ntohs(thdr
->th_sport
);
394 sm
->dst_port
= ntohs(thdr
->th_dport
);
395 sm
->tcp_flags
= thdr
->th_flags
&
396 (TH_FIN
|TH_SYN
|TH_RST
|TH_PUSH
|TH_ACK
|TH_URG
);
401 const struct udphdr
*uhdr
= (const struct udphdr
*)pdata
;
402 if (len
< UDP_HDR_LEN
) {
403 verbosef("udp: packet too short (%u bytes)", len
);
404 sm
->proto
= IPPROTO_INVALID
; /* don't do accounting! */
407 sm
->src_port
= ntohs(uhdr
->uh_sport
);
408 sm
->dst_port
= ntohs(uhdr
->uh_dport
);
417 /* known protocol, don't complain about it */
421 verbosef("ip: unknown protocol %d", sm
->proto
);
425 /* vim:set ts=3 sw=3 tw=78 expandtab: */