2 * copyright (c) 2001-2009 Emil Mikulic.
4 * decode.c: packet decoding.
6 * Given a captured packet, decode it and fill out a pktsummary struct which
7 * will be sent to the accounting code in acct.c
9 * You may use, modify and redistribute this file under the terms of the
10 * GNU General Public License version 2. (see COPYING.GPL)
17 #include <sys/ioctl.h>
18 #include <sys/socket.h>
24 #include <arpa/inet.h> /* inet_ntoa() */
26 /* need struct ether_header */
27 #if defined(__NetBSD__) || defined(__OpenBSD__)
28 # include <sys/queue.h>
30 # include <net/if_arp.h>
31 # include <netinet/if_ether.h>
34 # include <sys/ethernet.h>
35 # define ETHER_HDR_LEN 14
38 # include <netinet/if_ether.h>
39 # define ETHER_HDR_LEN 14
41 # include <net/ethernet.h>
45 #ifndef ETHERTYPE_PPPOE
46 #define ETHERTYPE_PPPOE 0x8864
49 #include <net/if.h> /* struct ifreq */
50 #include <netinet/in_systm.h> /* n_long */
51 #include <netinet/ip.h> /* struct ip */
53 #include <netinet/tcp.h> /* struct tcphdr */
54 #include <netinet/udp.h> /* struct udphdr */
56 extern int want_pppoe
;
58 static void decode_ether(u_char
*, const struct pcap_pkthdr
*,
60 static void decode_loop(u_char
*, const struct pcap_pkthdr
*,
62 static void decode_ppp(u_char
*, const struct pcap_pkthdr
*,
64 static void decode_pppoe(u_char
*, const struct pcap_pkthdr
*,
66 static void decode_pppoe_real(const u_char
*pdata
, const uint32_t len
,
68 static void decode_linux_sll(u_char
*, const struct pcap_pkthdr
*,
70 static void decode_raw(u_char
*, const struct pcap_pkthdr
*,
72 static void decode_ip(const u_char
*pdata
, const uint32_t len
,
75 /* Link-type header information */
76 static const linkhdr_t linkhdrs
[] = {
77 /* linktype hdrlen handler */
78 { DLT_EN10MB
, ETHER_HDR_LEN
, decode_ether
},
79 { DLT_LOOP
, NULL_HDR_LEN
, decode_loop
},
80 { DLT_NULL
, NULL_HDR_LEN
, decode_loop
},
81 { DLT_PPP
, PPP_HDR_LEN
, decode_ppp
},
82 #if defined(__NetBSD__)
83 { DLT_PPP_SERIAL
, PPP_HDR_LEN
, decode_ppp
},
85 { DLT_FDDI
, FDDI_HDR_LEN
, NULL
},
86 { DLT_PPP_ETHER
, PPPOE_HDR_LEN
, decode_pppoe
},
88 { DLT_LINUX_SLL
, SLL_HDR_LEN
, decode_linux_sll
},
90 { DLT_RAW
, RAW_HDR_LEN
, decode_raw
},
95 * Returns a pointer to the linkhdr_t record matching the given linktype, or
96 * NULL if no matching entry found.
99 getlinkhdr(int linktype
)
103 for (i
=0; linkhdrs
[i
].linktype
!= -1; i
++)
104 if (linkhdrs
[i
].linktype
== linktype
)
105 return (&(linkhdrs
[i
]));
110 * Returns the minimum caplen needed to decode everything up to the TCP/UDP
111 * packet headers. Argument lh is not allowed to be NULL.
114 getcaplen(const linkhdr_t
*lh
)
117 return (lh
->hdrlen
+ IP_HDR_LEN
+ max(TCP_HDR_LEN
, UDP_HDR_LEN
));
121 * Convert IP address to a numbers-and-dots notation in a static buffer
122 * provided by inet_ntoa().
125 ip_to_str(const in_addr_t ip
)
130 return (inet_ntoa(in
));
133 /* Decoding functions. */
135 decode_ether(u_char
*user _unused_
,
136 const struct pcap_pkthdr
*pheader
,
140 const struct ether_header
*hdr
= (const struct ether_header
*)pdata
;
142 memset(&sm
, 0, sizeof(sm
));
143 sm
.time
= pheader
->ts
.tv_sec
;
145 if (pheader
->caplen
< ETHER_HDR_LEN
) {
146 verbosef("ether: packet too short (%u bytes)", pheader
->caplen
);
151 memcpy(sm
.src_mac
, hdr
->ether_shost
.ether_addr_octet
, sizeof(sm
.src_mac
));
152 memcpy(sm
.dst_mac
, hdr
->ether_dhost
.ether_addr_octet
, sizeof(sm
.dst_mac
));
154 memcpy(sm
.src_mac
, hdr
->ether_shost
, sizeof(sm
.src_mac
));
155 memcpy(sm
.dst_mac
, hdr
->ether_dhost
, sizeof(sm
.dst_mac
));
158 type
= ntohs( hdr
->ether_type
);
162 decode_ip(pdata
+ ETHER_HDR_LEN
,
163 pheader
->caplen
- ETHER_HDR_LEN
, &sm
);
166 verbosef("ether: discarded IP packet, expecting PPPoE instead");
169 /* known protocol, don't complain about it. */
171 case ETHERTYPE_PPPOE
:
173 decode_pppoe_real(pdata
+ ETHER_HDR_LEN
,
174 pheader
->caplen
- ETHER_HDR_LEN
, &sm
);
176 verbosef("ether: got PPPoE frame: maybe you want --pppoe");
179 verbosef("ether: unknown protocol (0x%04x)", type
);
184 decode_loop(u_char
*user _unused_
,
185 const struct pcap_pkthdr
*pheader
,
190 memset(&sm
, 0, sizeof(sm
));
192 if (pheader
->caplen
< NULL_HDR_LEN
) {
193 verbosef("loop: packet too short (%u bytes)", pheader
->caplen
);
196 family
= *(const uint32_t *)pdata
;
198 family
= ntohl(family
);
200 if (family
== AF_INET
) {
201 /* OpenBSD tun or FreeBSD tun or FreeBSD lo */
202 decode_ip(pdata
+ NULL_HDR_LEN
, pheader
->caplen
- NULL_HDR_LEN
, &sm
);
203 sm
.time
= pheader
->ts
.tv_sec
;
207 verbosef("loop: unknown family (%x)", family
);
211 decode_ppp(u_char
*user _unused_
,
212 const struct pcap_pkthdr
*pheader
,
216 memset(&sm
, 0, sizeof(sm
));
218 if (pheader
->caplen
< PPPOE_HDR_LEN
) {
219 verbosef("ppp: packet too short (%u bytes)", pheader
->caplen
);
223 if (pdata
[2] == 0x00 && pdata
[3] == 0x21) {
224 decode_ip(pdata
+ PPP_HDR_LEN
, pheader
->caplen
- PPP_HDR_LEN
, &sm
);
225 sm
.time
= pheader
->ts
.tv_sec
;
228 verbosef("non-IP PPP packet; ignoring.");
232 decode_pppoe(u_char
*user _unused_
,
233 const struct pcap_pkthdr
*pheader
,
237 memset(&sm
, 0, sizeof(sm
));
238 sm
.time
= pheader
->ts
.tv_sec
;
239 decode_pppoe_real(pdata
, pheader
->caplen
, &sm
);
243 decode_pppoe_real(const u_char
*pdata
, const uint32_t len
,
246 if (len
< PPPOE_HDR_LEN
) {
247 verbosef("pppoe: packet too short (%u bytes)", len
);
251 if (pdata
[1] != 0x00) {
252 verbosef("pppoe: code = 0x%02x, expecting 0; ignoring.", pdata
[1]);
256 if ((pdata
[6] == 0xc0) && (pdata
[7] == 0x21)) return; /* LCP */
257 if ((pdata
[6] == 0xc0) && (pdata
[7] == 0x25)) return; /* LQR */
259 if ((pdata
[6] == 0x00) && (pdata
[7] == 0x21)) {
260 decode_ip(pdata
+ PPPOE_HDR_LEN
, len
- PPPOE_HDR_LEN
, sm
);
263 verbosef("pppoe: non-IP PPPoE packet (0x%02x%02x); ignoring.",
267 /* very similar to decode_ether ... */
269 decode_linux_sll(u_char
*user _unused_
,
270 const struct pcap_pkthdr
*pheader
,
273 const struct sll_header
{
274 uint16_t packet_type
;
275 uint16_t device_type
;
276 uint16_t addr_length
;
277 #define SLL_MAX_ADDRLEN 8
278 uint8_t addr
[SLL_MAX_ADDRLEN
];
280 } *hdr
= (const struct sll_header
*)pdata
;
283 memset(&sm
, 0, sizeof(sm
));
285 if (pheader
->caplen
< SLL_HDR_LEN
) {
286 verbosef("linux_sll: packet too short (%u bytes)", pheader
->caplen
);
290 type
= ntohs( hdr
->ether_type
);
293 decode_ip(pdata
+ SLL_HDR_LEN
, pheader
->caplen
- SLL_HDR_LEN
, &sm
);
294 sm
.time
= pheader
->ts
.tv_sec
;
298 /* known protocol, don't complain about it. */
301 verbosef("linux_sll: unknown protocol (%04x)", type
);
306 decode_raw(u_char
*user _unused_
,
307 const struct pcap_pkthdr
*pheader
,
311 memset(&sm
, 0, sizeof(sm
));
313 decode_ip(pdata
, pheader
->caplen
, &sm
);
314 sm
.time
= pheader
->ts
.tv_sec
;
319 decode_ip(const u_char
*pdata
, const uint32_t len
, pktsummary
*sm
)
321 const struct ip
*hdr
= (const struct ip
*)pdata
;
323 if (len
< IP_HDR_LEN
) {
324 verbosef("ip: packet too short (%u bytes)", len
);
327 if (hdr
->ip_v
!= 4) {
328 verbosef("ip: version %d (expecting 4)", hdr
->ip_v
);
332 sm
->len
= ntohs(hdr
->ip_len
);
333 sm
->proto
= hdr
->ip_p
;
334 sm
->src_ip
= hdr
->ip_src
.s_addr
;
335 sm
->dest_ip
= hdr
->ip_dst
.s_addr
;
339 const struct tcphdr
*thdr
=
340 (const struct tcphdr
*)(pdata
+ IP_HDR_LEN
);
341 if (len
< IP_HDR_LEN
+ TCP_HDR_LEN
) {
342 verbosef("tcp: packet too short (%u bytes)", len
);
345 sm
->src_port
= ntohs(thdr
->th_sport
);
346 sm
->dest_port
= ntohs(thdr
->th_dport
);
347 sm
->tcp_flags
= thdr
->th_flags
&
348 (TH_FIN
|TH_SYN
|TH_RST
|TH_PUSH
|TH_ACK
|TH_URG
);
353 const struct udphdr
*uhdr
=
354 (const struct udphdr
*)(pdata
+ IP_HDR_LEN
);
355 if (len
< IP_HDR_LEN
+ UDP_HDR_LEN
) {
356 verbosef("udp: packet too short (%u bytes)", len
);
359 sm
->src_port
= ntohs(uhdr
->uh_sport
);
360 sm
->dest_port
= ntohs(uhdr
->uh_dport
);
365 /* known protocol, don't complain about it */
369 verbosef("ip: unknown protocol %d", sm
->proto
);
373 /* vim:set ts=3 sw=3 tw=78 expandtab: */