Skip to content

Commit 418a007

Browse files
guyharrisguyharris
committed
Linux: handle other DSA tags.
Many of those entries need their own LINKTYPE_/DLT_? values, including tcpdump and Wireshark support for same, but at least this lets you see raw hex data from a capture. Fixes the-tcpdump-group#1367. Supercedes the-tcpdump-group#1451.
1 parent 2852d15 commit 418a007

File tree

1 file changed

+280
-4
lines changed

1 file changed

+280
-4
lines changed

‎pcap-linux.c‎

Lines changed: 280 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5404,23 +5404,299 @@ iface_get_offload(pcap_t *handle _U_)
54045404
}
54055405
#endif /* SIOCETHTOOL */
54065406

5407+
/*
5408+
* As per
5409+
*
5410+
* https://www.kernel.org/doc/html/latest/networking/dsa/dsa.html#switch-tagging-protocols
5411+
*
5412+
* Type 1 means that the tag is prepended to the Ethernet packet.
5413+
* LINKTYPE_ETHERNET/DLT_EN10MB doesn't work, as it would try to
5414+
* dissect the tag data as the Ethernet header. These should get
5415+
* their own LINKTYPE_DLT_ values.
5416+
*
5417+
* Type 2 means that the tag is inserted into the Ethernet header
5418+
* after the source address and before the type/length field.
5419+
*
5420+
* Type 3 means that tag is a packet trailer. LINKTYPE_ETHERNET/DLT_EN10MB
5421+
* works, unless the next-layer protocol has no length field of its own,
5422+
* so that the tag might be treated as part of the payload. These should
5423+
* get their own LINKTYPE_/DLT_ values.
5424+
*
5425+
* If you get an "unsupported DSA tag" error, please add the tag to here,
5426+
* complete with a full comment indicating whether it's type 1, 2, or 3,
5427+
* and, for type 2, indicating whether it has an Ethertype and, if so
5428+
* what that type is, and whether it's registered with the IEEE or is
5429+
* self-assigned. Also, point to *something* that indicates the format
5430+
* of the tag.
5431+
*/
54075432
static struct dsa_proto {
54085433
const char *name;
54095434
bpf_u_int32 linktype;
54105435
} dsa_protos[] = {
54115436
/*
5412-
* None is special and indicates that the interface does not have
5413-
* any tagging protocol configured, and is therefore a standard
5414-
* Ethernet interface.
5437+
* Type 1. See
5438+
*
5439+
* https://elixir.bootlin.com/linux/v6.13.2/source/net/dsa/tag_ar9331.c
5440+
*/
5441+
{ "ar9331", DLT_EN10MB },
5442+
5443+
/*
5444+
* Type 2, without an Ethertype at the beginning,
5445+
* assigned a LINKTYPE_/DLT_ value.
54155446
*/
5416-
{ "none", DLT_EN10MB },
54175447
{ "brcm", DLT_DSA_TAG_BRCM },
5448+
5449+
/*
5450+
* Type 2, with Ethertype 0x8874, assigned to Broadcom.
5451+
*
5452+
* This doies not require a LINKTYPE_/DLT_ value, it
5453+
* just requires that Ethertype 0x8874 be dissected
5454+
* properly.
5455+
*/
5456+
{ "brcm-legacy", DLT_EN10MB },
5457+
5458+
/*
5459+
* Type 1.
5460+
*/
54185461
{ "brcm-prepend", DLT_DSA_TAG_BRCM_PREPEND },
5462+
5463+
/*
5464+
* Type 2, without an Etherype at he beginning,
5465+
* assigned a LINKTYPE_/DLT_ value.
5466+
*/
54195467
{ "dsa", DLT_DSA_TAG_DSA },
5468+
5469+
/*
5470+
* Type 2, with an Ethertype field, but without
5471+
* an assigned Ethertype value that can be relied
5472+
* on; assigned a LINKTYPE_/DLT_ value.
5473+
*/
54205474
{ "edsa", DLT_DSA_TAG_EDSA },
5475+
5476+
/*
5477+
* Type 1, with different transmit and receive headers,
5478+
* so can't really be handled well with the current
5479+
* libpcap API and with pcap files. Use DLT_LINUX_SLL,
5480+
* to get the direction?
5481+
*
5482+
* See
5483+
*
5484+
* https://elixir.bootlin.com/linux/v6.13.2/source/net/dsa/tag_gswip.c
5485+
*/
5486+
{ "gswip", DLT_EN10MB },
5487+
5488+
/*
5489+
* Type 3. See
5490+
*
5491+
* https://elixir.bootlin.com/linux/v6.13.2/source/net/dsa/tag_hellcreek.c
5492+
*/
5493+
{ "hellcreek", DLT_EN10MB },
5494+
5495+
/*
5496+
* Type 3, with different transmit and receive headers,
5497+
* so can't really be handled well with the current
5498+
* libpcap API and with pcap files. Use DLT_LINUX_SLL,
5499+
* to get the direction?
5500+
*
5501+
* See
5502+
*
5503+
* https://elixir.bootlin.com/linux/v6.13.2/source/net/dsa/tag_ksz.c#L102
5504+
*/
5505+
{ "ksz8795", DLT_EN10MB },
5506+
5507+
/*
5508+
* Type 3, with different transmit and receive headers,
5509+
* so can't really be handled well with the current
5510+
* libpcap API and with pcap files. Use DLT_LINUX_SLL,
5511+
* to get the direction?
5512+
*
5513+
* See
5514+
*
5515+
* https://elixir.bootlin.com/linux/v6.13.2/source/net/dsa/tag_ksz.c#L160
5516+
*/
5517+
{ "ksz9477", DLT_EN10MB },
5518+
5519+
/*
5520+
* Type 3, with different transmit and receive headers,
5521+
* so can't really be handled well with the current
5522+
* libpcap API and with pcap files. Use DLT_LINUX_SLL,
5523+
* to get the direction?
5524+
*
5525+
* See
5526+
*
5527+
* https://elixir.bootlin.com/linux/v6.13.2/source/net/dsa/tag_ksz.c#L341
5528+
*/
5529+
{ "ksz9893", DLT_EN10MB },
5530+
5531+
/*
5532+
* Type 3, with different transmit and receive headers,
5533+
* so can't really be handled well with the current
5534+
* libpcap API and with pcap files. Use DLT_LINUX_SLL,
5535+
* to get the direction?
5536+
*
5537+
* See
5538+
*
5539+
* https://elixir.bootlin.com/linux/v6.13.2/source/net/dsa/tag_ksz.c#L386
5540+
*/
5541+
{ "lan937x", DLT_EN10MB },
5542+
5543+
/*
5544+
* Type 2, with Ethertype 0x8100; the VID can be interpreted
5545+
* as per
5546+
*
5547+
* https://elixir.bootlin.com/linux/v6.13.2/source/net/dsa/tag_lan9303.c#L24
5548+
*
5549+
* so giving its own LINKTYPE_/DLT_ value would allow a
5550+
* dissector to do so.
5551+
*/
5552+
{ "lan9303", DLT_EN10MB },
5553+
5554+
/*
5555+
* Type 2, without an Etherype at he beginning,
5556+
* should be assigned a LINKTYPE_/DLT_ value.
5557+
*
5558+
* See
5559+
*
5560+
* https://elixir.bootlin.com/linux/v6.13.2/source/net/dsa/tag_mtk.c#L15
5561+
*/
5562+
{ "mtk", DLT_EN10MB },
5563+
5564+
/*
5565+
* None is special and indicates that the interface does not have
5566+
* any tagging protocol configured, and is therefore a standard
5567+
* Ethernet interface.
5568+
*/
5569+
{ "none", DLT_EN10MB },
5570+
5571+
/*
5572+
* Type 1.
5573+
*
5574+
* See
5575+
*
5576+
* https://elixir.bootlin.com/linux/v6.13.2/source/net/dsa/tag_ocelot.c
5577+
*/
5578+
{ "ocelot", DLT_EN10MB },
5579+
5580+
/*
5581+
* Type 1.
5582+
*
5583+
* See
5584+
*
5585+
* https://elixir.bootlin.com/linux/v6.13.2/source/net/dsa/tag_ocelot.c
5586+
*/
5587+
{ "seville", DLT_EN10MB },
5588+
5589+
/*
5590+
* Type 2, with Ethertype 0x8100; the VID can be interpreted
5591+
* as per
5592+
*
5593+
* https://elixir.bootlin.com/linux/v6.13.2/source/net/dsa/tag_8021q.c#L15
5594+
*
5595+
* so giving its own LINKTYPE_/DLT_ value would allow a
5596+
* dissector to do so.
5597+
*/
5598+
{ "ocelot-8021q", DLT_EN10MB },
5599+
5600+
/*
5601+
* Type 2, without an Etherype at he beginning,
5602+
* should be assigned a LINKTYPE_/DLT_ value.
5603+
*
5604+
* See
5605+
*
5606+
* https://elixir.bootlin.com/linux/v6.13.2/source/net/dsa/tag_qca.c
5607+
*/
5608+
{ "qca", DLT_EN10MB },
5609+
5610+
/*
5611+
* Type 2, with Ethertype 0x8899, assigned to Realtek;
5612+
* they use it for several on-the-Ethernet protocols
5613+
* as well, but there are fields that allow the two
5614+
* tag formats, and all the protocols in question,
5615+
* to be distinguiished from one another.
5616+
*
5617+
* This doies not require a LINKTYPE_/DLT_ value, it
5618+
* just requires that Ethertype 0x8899 be dissected
5619+
* properly.
5620+
*
5621+
* See
5622+
*
5623+
* https://elixir.bootlin.com/linux/v6.13.2/source/net/dsa/tag_rtl4_a.c
5624+
*
5625+
* http://realtek.info/pdf/rtl8306sd%28m%29_datasheet_1.1.pdf
5626+
*
5627+
* and various pages in tcpdump's print-realtek.c and Wireshark's
5628+
* epan/dissectors/packet-realtek.c for the other protocols.
5629+
*/
54215630
{ "rtl4a", DLT_EN10MB },
5631+
5632+
/*
5633+
* Type 2, with Ethertype 0x8899, assigned to Realtek;
5634+
* see above.
5635+
*/
54225636
{ "rtl8_4", DLT_EN10MB },
5637+
5638+
/*
5639+
* Type 3, with the same tag format as rtl8_4.
5640+
*/
54235641
{ "rtl8_4t", DLT_EN10MB },
5642+
5643+
/*
5644+
* Type 2, with Ethertype 0xe001; that's probably
5645+
* self-assigned, so this really should ahve its
5646+
* own LINKTYPE_/DLT_ value.
5647+
*
5648+
* See
5649+
*
5650+
* https://elixir.bootlin.com/linux/v6.13.2/source/net/dsa/tag_rzn1_a5psw.c
5651+
*/
5652+
{ "a5psw", DLT_EN10MB },
5653+
5654+
/*
5655+
* Type 2, with Ethertype 0x8100 or the self-assigned
5656+
* 0xdadb, so this really should ahve its own
5657+
* LINKTYPE_/DLT_ value; that would also allow the
5658+
* VID of the tag to be dissected as per
5659+
*
5660+
* https://elixir.bootlin.com/linux/v6.13.2/source/net/dsa/tag_8021q.c#L15
5661+
*/
5662+
{ "sja1105", DLT_EN10MB },
5663+
5664+
/*
5665+
* Type "none of the above", with both a header and trailer,
5666+
* with different transmit and receive tags. Has
5667+
* Ethertype 0xdadc, which is probably self-assigned.
5668+
* This should really have its own LINKTYPE_/DLT_ value.
5669+
*/
5670+
{ "sja1110", DLT_EN10MB },
5671+
5672+
/*
5673+
* Type 3, as the name suggests.
5674+
*
5675+
* See
5676+
*
5677+
* https://elixir.bootlin.com/linux/v6.13.2/source/net/dsa/tag_trailer.c
5678+
*/
5679+
{ "trailer", DLT_EN10MB },
5680+
5681+
/*
5682+
* Type 2, with Ethertype 0x8100; the VID can be interpreted
5683+
* as per
5684+
*
5685+
* https://elixir.bootlin.com/linux/v6.13.2/source/net/dsa/tag_8021q.c#L15
5686+
*
5687+
* so giving its own LINKTYPE_/DLT_ value would allow a
5688+
* dissector to do so.
5689+
*/
5690+
{ "vsc73xx-8021q", DLT_EN10MB },
5691+
5692+
/*
5693+
* Type 3.
5694+
*
5695+
* See
5696+
*
5697+
* https://elixir.bootlin.com/linux/v6.13.2/source/net/dsa/tag_xrs700x.c
5698+
*/
5699+
{ "xrs700x", DLT_EN10MB },
54245700
};
54255701

54265702
static int

0 commit comments

Comments
 (0)