2 * copyright (c) 2001-2009 Emil Mikulic.
4 * decode.c: packet decoding.
6 * Given a captured packet, decode it and fill out a pktsummary struct which
7 * will be sent to the accounting code in acct.c
9 * You may use, modify and redistribute this file under the terms of the
10 * GNU General Public License version 2. (see COPYING.GPL)
19 #include <sys/ioctl.h>
20 #include <sys/socket.h>
25 #include <arpa/inet.h> /* inet_ntoa() */
27 /* need struct ether_header */
28 #if defined(__NetBSD__) || defined(__OpenBSD__)
29 # include <sys/queue.h>
31 # include <net/if_arp.h>
32 # include <netinet/if_ether.h>
35 # include <sys/ethernet.h>
36 # define ETHER_HDR_LEN 14
39 # include <netinet/if_ether.h>
40 # define ETHER_HDR_LEN 14
42 # include <net/ethernet.h>
46 #ifndef ETHERTYPE_PPPOE
47 #define ETHERTYPE_PPPOE 0x8864
50 #ifndef ETHERTYPE_IPV6
51 # ifdef HAVE_NET_IF_ETHER_H
52 # include <net/if_ether.h> /* ETH_P_IPV6 for GNU/kfreebsd */
55 # define ETHERTYPE_IPV6 ETH_P_IPV6
59 #include <net/if.h> /* struct ifreq */
60 #include <netinet/in_systm.h> /* n_long */
61 #include <netinet/ip.h> /* struct ip */
62 #include <netinet/ip6.h> /* struct ip6_hdr */
64 #include <netinet/tcp.h> /* struct tcphdr */
65 #include <netinet/udp.h> /* struct udphdr */
67 extern int want_pppoe
;
69 static void decode_ether(u_char
*, const struct pcap_pkthdr
*,
71 static void decode_loop(u_char
*, const struct pcap_pkthdr
*,
73 static void decode_ppp(u_char
*, const struct pcap_pkthdr
*,
75 static void decode_pppoe(u_char
*, const struct pcap_pkthdr
*,
77 static void decode_pppoe_real(const u_char
*pdata
, const uint32_t len
,
78 struct pktsummary
*sm
);
79 static void decode_linux_sll(u_char
*, const struct pcap_pkthdr
*,
81 static void decode_raw(u_char
*, const struct pcap_pkthdr
*,
83 static void decode_ip(const u_char
*pdata
, const uint32_t len
,
84 struct pktsummary
*sm
);
85 static void decode_ipv6(const u_char
*pdata
, const uint32_t len
,
86 struct pktsummary
*sm
);
88 /* Link-type header information */
89 static const struct linkhdr linkhdrs
[] = {
90 /* linktype hdrlen handler */
91 { DLT_EN10MB
, ETHER_HDR_LEN
, decode_ether
},
92 { DLT_LOOP
, NULL_HDR_LEN
, decode_loop
},
93 { DLT_NULL
, NULL_HDR_LEN
, decode_loop
},
94 { DLT_PPP
, PPP_HDR_LEN
, decode_ppp
},
95 #if defined(__NetBSD__)
96 { DLT_PPP_SERIAL
, PPP_HDR_LEN
, decode_ppp
},
98 { DLT_FDDI
, FDDI_HDR_LEN
, NULL
},
99 { DLT_PPP_ETHER
, PPPOE_HDR_LEN
, decode_pppoe
},
101 { DLT_LINUX_SLL
, SLL_HDR_LEN
, decode_linux_sll
},
103 { DLT_RAW
, RAW_HDR_LEN
, decode_raw
},
108 * Returns a pointer to the linkhdr record matching the given linktype, or
109 * NULL if no matching entry found.
111 const struct linkhdr
*
112 getlinkhdr(const int linktype
)
116 for (i
=0; linkhdrs
[i
].linktype
!= -1; i
++)
117 if (linkhdrs
[i
].linktype
== linktype
)
118 return (&(linkhdrs
[i
]));
123 * Returns the minimum snaplen needed to decode everything up to the TCP/UDP
124 * packet headers. The IPv6 header is normative. The argument lh is not
125 * allowed to be NULL.
128 getsnaplen(const struct linkhdr
*lh
)
130 return (int)(lh
->hdrlen
+ IPV6_HDR_LEN
+ max(TCP_HDR_LEN
, UDP_HDR_LEN
));
133 /* Decoding functions. */
135 decode_ether(u_char
*user _unused_
,
136 const struct pcap_pkthdr
*pheader
,
140 const struct ether_header
*hdr
= (const struct ether_header
*)pdata
;
141 struct pktsummary sm
;
142 memset(&sm
, 0, sizeof(sm
));
143 sm
.time
= pheader
->ts
.tv_sec
;
145 if (pheader
->caplen
< ETHER_HDR_LEN
) {
146 verbosef("ether: packet too short (%u bytes)", pheader
->caplen
);
151 memcpy(sm
.src_mac
, hdr
->ether_shost
.ether_addr_octet
, sizeof(sm
.src_mac
));
152 memcpy(sm
.dst_mac
, hdr
->ether_dhost
.ether_addr_octet
, sizeof(sm
.dst_mac
));
154 memcpy(sm
.src_mac
, hdr
->ether_shost
, sizeof(sm
.src_mac
));
155 memcpy(sm
.dst_mac
, hdr
->ether_dhost
, sizeof(sm
.dst_mac
));
158 type
= ntohs( hdr
->ether_type
);
163 decode_ip(pdata
+ ETHER_HDR_LEN
,
164 pheader
->caplen
- ETHER_HDR_LEN
, &sm
);
167 verbosef("ether: discarded IP packet, expecting PPPoE instead");
170 /* known protocol, don't complain about it. */
172 case ETHERTYPE_PPPOE
:
174 decode_pppoe_real(pdata
+ ETHER_HDR_LEN
,
175 pheader
->caplen
- ETHER_HDR_LEN
, &sm
);
177 verbosef("ether: got PPPoE frame: maybe you want --pppoe");
180 verbosef("ether: unknown protocol (0x%04x)", type
);
185 decode_loop(u_char
*user _unused_
,
186 const struct pcap_pkthdr
*pheader
,
190 struct pktsummary sm
;
191 memset(&sm
, 0, sizeof(sm
));
193 if (pheader
->caplen
< NULL_HDR_LEN
) {
194 verbosef("loop: packet too short (%u bytes)", pheader
->caplen
);
197 family
= *(const uint32_t *)pdata
;
199 family
= ntohl(family
);
201 if (family
== AF_INET
) {
202 /* OpenBSD tun or FreeBSD tun or FreeBSD lo */
203 decode_ip(pdata
+ NULL_HDR_LEN
, pheader
->caplen
- NULL_HDR_LEN
, &sm
);
204 sm
.time
= pheader
->ts
.tv_sec
;
207 else if (family
== AF_INET6
) {
208 /* XXX: Check this! */
209 decode_ip(pdata
+ NULL_HDR_LEN
, pheader
->caplen
- NULL_HDR_LEN
, &sm
);
210 sm
.time
= pheader
->ts
.tv_sec
;
214 verbosef("loop: unknown family (%x)", family
);
218 decode_ppp(u_char
*user _unused_
,
219 const struct pcap_pkthdr
*pheader
,
222 struct pktsummary sm
;
223 memset(&sm
, 0, sizeof(sm
));
225 if (pheader
->caplen
< PPPOE_HDR_LEN
) {
226 verbosef("ppp: packet too short (%u bytes)", pheader
->caplen
);
230 if (pdata
[2] == 0x00 && pdata
[3] == 0x21) {
231 decode_ip(pdata
+ PPP_HDR_LEN
, pheader
->caplen
- PPP_HDR_LEN
, &sm
);
232 sm
.time
= pheader
->ts
.tv_sec
;
235 verbosef("non-IP PPP packet; ignoring.");
239 decode_pppoe(u_char
*user _unused_
,
240 const struct pcap_pkthdr
*pheader
,
243 struct pktsummary sm
;
244 memset(&sm
, 0, sizeof(sm
));
245 sm
.time
= pheader
->ts
.tv_sec
;
246 decode_pppoe_real(pdata
, pheader
->caplen
, &sm
);
250 decode_pppoe_real(const u_char
*pdata
, const uint32_t len
,
251 struct pktsummary
*sm
)
253 if (len
< PPPOE_HDR_LEN
) {
254 verbosef("pppoe: packet too short (%u bytes)", len
);
258 if (pdata
[1] != 0x00) {
259 verbosef("pppoe: code = 0x%02x, expecting 0; ignoring.", pdata
[1]);
263 if ((pdata
[6] == 0xc0) && (pdata
[7] == 0x21)) return; /* LCP */
264 if ((pdata
[6] == 0xc0) && (pdata
[7] == 0x25)) return; /* LQR */
266 if ((pdata
[6] == 0x00) && (pdata
[7] == 0x21)) {
267 decode_ip(pdata
+ PPPOE_HDR_LEN
, len
- PPPOE_HDR_LEN
, sm
);
270 verbosef("pppoe: non-IP PPPoE packet (0x%02x%02x); ignoring.",
274 /* very similar to decode_ether ... */
276 decode_linux_sll(u_char
*user _unused_
,
277 const struct pcap_pkthdr
*pheader
,
280 const struct sll_header
{
281 uint16_t packet_type
;
282 uint16_t device_type
;
283 uint16_t addr_length
;
284 #define SLL_MAX_ADDRLEN 8
285 uint8_t addr
[SLL_MAX_ADDRLEN
];
287 } *hdr
= (const struct sll_header
*)pdata
;
289 struct pktsummary sm
;
290 memset(&sm
, 0, sizeof(sm
));
292 if (pheader
->caplen
< SLL_HDR_LEN
) {
293 verbosef("linux_sll: packet too short (%u bytes)", pheader
->caplen
);
297 type
= ntohs( hdr
->ether_type
);
301 decode_ip(pdata
+ SLL_HDR_LEN
, pheader
->caplen
- SLL_HDR_LEN
, &sm
);
302 sm
.time
= pheader
->ts
.tv_sec
;
306 /* known protocol, don't complain about it. */
309 verbosef("linux_sll: unknown protocol (%04x)", type
);
314 decode_raw(u_char
*user _unused_
,
315 const struct pcap_pkthdr
*pheader
,
318 struct pktsummary sm
;
319 memset(&sm
, 0, sizeof(sm
));
321 decode_ip(pdata
, pheader
->caplen
, &sm
);
322 sm
.time
= pheader
->ts
.tv_sec
;
326 static void decode_ip_payload(const u_char
*pdata
, const uint32_t len
,
327 struct pktsummary
*sm
);
330 decode_ip(const u_char
*pdata
, const uint32_t len
, struct pktsummary
*sm
)
332 const struct ip
*hdr
= (const struct ip
*)pdata
;
334 if (hdr
->ip_v
== 6) {
335 /* Redirect parsing of IPv6 packets. */
336 decode_ipv6(pdata
, len
, sm
);
339 if (len
< IP_HDR_LEN
) {
340 verbosef("ip: packet too short (%u bytes)", len
);
343 if (hdr
->ip_v
!= 4) {
344 verbosef("ip: version %d (expecting 4 or 6)", hdr
->ip_v
);
348 sm
->len
= ntohs(hdr
->ip_len
);
349 sm
->proto
= hdr
->ip_p
;
351 sm
->src
.family
= IPv4
;
352 sm
->src
.ip
.v4
= hdr
->ip_src
.s_addr
;
354 sm
->dst
.family
= IPv4
;
355 sm
->dst
.ip
.v4
= hdr
->ip_dst
.s_addr
;
357 decode_ip_payload(pdata
+ IP_HDR_LEN
, len
- IP_HDR_LEN
, sm
);
361 decode_ipv6(const u_char
*pdata
, const uint32_t len
, struct pktsummary
*sm
)
363 const struct ip6_hdr
*hdr
= (const struct ip6_hdr
*)pdata
;
365 if (len
< IPV6_HDR_LEN
) {
366 verbosef("ipv6: packet too short (%u bytes)", len
);
370 sm
->len
= ntohs(hdr
->ip6_plen
) + IPV6_HDR_LEN
;
371 sm
->proto
= hdr
->ip6_nxt
;
373 sm
->src
.family
= IPv6
;
374 memcpy(&sm
->src
.ip
.v6
, &hdr
->ip6_src
, sizeof(sm
->src
.ip
.v6
));
376 sm
->dst
.family
= IPv6
;
377 memcpy(&sm
->dst
.ip
.v6
, &hdr
->ip6_dst
, sizeof(sm
->dst
.ip
.v6
));
379 decode_ip_payload(pdata
+ IPV6_HDR_LEN
, len
- IPV6_HDR_LEN
, sm
);
383 decode_ip_payload(const u_char
*pdata
, const uint32_t len
,
384 struct pktsummary
*sm
)
388 const struct tcphdr
*thdr
= (const struct tcphdr
*)pdata
;
389 if (len
< TCP_HDR_LEN
) {
390 verbosef("tcp: packet too short (%u bytes)", len
);
391 sm
->proto
= IPPROTO_INVALID
; /* don't do accounting! */
394 sm
->src_port
= ntohs(thdr
->th_sport
);
395 sm
->dst_port
= ntohs(thdr
->th_dport
);
396 sm
->tcp_flags
= thdr
->th_flags
&
397 (TH_FIN
|TH_SYN
|TH_RST
|TH_PUSH
|TH_ACK
|TH_URG
);
402 const struct udphdr
*uhdr
= (const struct udphdr
*)pdata
;
403 if (len
< UDP_HDR_LEN
) {
404 verbosef("udp: packet too short (%u bytes)", len
);
405 sm
->proto
= IPPROTO_INVALID
; /* don't do accounting! */
408 sm
->src_port
= ntohs(uhdr
->uh_sport
);
409 sm
->dst_port
= ntohs(uhdr
->uh_dport
);
418 /* known protocol, don't complain about it */
422 verbosef("ip: unknown protocol %d", sm
->proto
);
426 /* vim:set ts=3 sw=3 tw=78 expandtab: */