Add support for B.A.T.M.A.N. Advanced #980

T-X · 2020-11-23T00:04:06Z

This adds support for the layer 2 mesh routing protocol
B.A.T.M.A.N. Advanced. "batadv" can be used to filter on batman-adv
packets. It also allows later filters to look at frames inside the
tunnel when both "version" and "type" are specified.

Documentation for the batman-adv protocol can be found at the following
locations:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/networking/batman-adv.rst
https://www.open-mesh.org/

Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>

T-X · 2020-11-23T00:08:58Z

One remark: pcap/batadv_packet.h and pcap/batadv_legacy_packet.h are basically copies from the Linux kernel and are therefore GPLv2 licensed. Let me know if that's okay for you or if I should ask the other maintainers and contributors for a BSD-3-Clause (compatible) dual-license for these two header files.

infrastation · 2020-11-23T00:55:33Z

Thank you for preparing this feature. Neither macOS nor FreeBSD like the new Linux-specific headers. As you mentioned, these are GPL, also the amount of filter-specific code seems to be much smaller than the amount of declarations. So it might be worth to consider if the new code could have just the declarations it needs, then it would be simpler to make these portable and have the same licence as the rest of libpcap. Other opinions are welcome.

guyharris · 2020-11-23T01:11:26Z

So it might be worth to consider if the new code could have just the declarations it needs, then it would be simpler to make these portable and have the same licence as the rest of libpcap. Other opinions are welcome.

My opinion can be summarized as "+1". :-)

I.e., no GPLed code, please.

guyharris · 2020-11-23T01:13:11Z

pcap/batadv_packet.h

+#ifndef _UAPI_LINUX_BATADV_PACKET_H_
+#define _UAPI_LINUX_BATADV_PACKET_H_
+
+#include <asm/byteorder.h>


None of those three headers are available on all the operating systems on which libpcap operates. (Note that one of those operating systems is Windows.)

Find a way not to use them.

guyharris · 2020-11-23T01:13:38Z

pcap/batadv_packet.h

@@ -0,0 +1,631 @@
+/* SPDX-License-Identifier: (GPL-2.0 WITH Linux-syscall-note) */


No GPLed code, please.

guyharris · 2020-11-23T02:29:28Z

Here's a tarball containing a patch, pcap/batadv_legacy_packet.h, and pcap/batadv_packet.h. The patch is a variant of your change that compiles on macOS Catalina and Xcode 11.7, so it rips out enough Linuxisms to get it to compile there, at least.

It also gets rid of all #pragma pack stuff (not all compilers necessarily support it), instead declaring 2-byte and 4-byte integral values as arrays of uint8_t of the appropriate length.

Do those headers need to be part of the libpcap distribution, rather than being internal to the libpcap source?

tarfile.gz

T-X · 2020-11-23T21:36:26Z

Thanks for the great feedback!

Changelog v2:

changes to batadv_{legacy_,}packet.h:
- integrated @guyharris' suggested changes: removal of #pragma packed(2), bitfield endianess #ifdefs, Linux specific includes, unused definitions, conversion to uint8_t only
- further removed kernel doc comments and instead added a small note to consult the Linux kernel version for a complete definition
- changed the license to BSD-3 for these new, tiny versions
- moved these two header files from the pcap directory to the root directory
- shortened the include guards, the UAPI directory for instance was Linux specific

T-X · 2020-11-23T21:51:55Z

Changelog v3:

removed unused variables "s" and "b1" in gen_batadv() to satisfy the AppVeyor CI / Visual Studio builds

infrastation · 2020-11-23T21:51:57Z

Passed FreeBSD build this time, that's better. One other thing that would complement this feature is some tcpdump test(s) to flex the new keywords. Do you have enough batman packets with the right protocol fields?

T-X · 2020-11-24T15:17:46Z

Changelog v4:

changed offset parameter of gen_batadv_push_offset() from size_t to u_int and added according type cast on callers, to make AppVeyor CI / Visual Studio happy

T-X · 2020-11-24T15:20:17Z

@infrastation sure, generating some test packets is no issue, can do that next weekend. According tests need to be added to the tcpdump repository in a separate commit over there, right?

infrastation · 2020-11-25T11:14:46Z

Yes, that's correct, and the tests will not pass until this feature has been merged, but eventually it would be consistent.

T-X · 2020-12-02T00:57:05Z

Some simple tests for tcpdump for the batman-adv version 15 packet types and their decoding offsets can be found here: the-tcpdump-group/tcpdump#891

infrastation · 2020-12-02T01:14:24Z

Thank you. For what it's worth, I have just looked through the proposed changes one more time and could not find any immediate issues to fix (which does not automatically mean everything is good, but still). Other reviewers are welcome.

T-X · 2021-02-13T19:37:31Z

I'm a bit hesitant to ask, as I can see with all the frequent commits that everyone is very eagerly working on libpcap/tcpdump. But any chance to get this merged? Would help me adding it to the collaborative projects I would want to use this in. Which are usually reluctant in adding changes that are not upstream yet.

mcr · 2021-02-13T20:30:47Z

Hi, @fenner , you've been down the pcap compiler space more than I, do you have any final comments before I merge this?

guyharris · 2021-02-13T21:09:48Z

grammar.y.in

+				type = pcap_nametobatadvtype_v15($2);
+				break;
+			default:
+				YYABORT;


This should probably call bpf_set_error() to report that $1 is an unsupported batman-adv version.

Thanks! I've added an according error message with bpf_set_error().

fxlb · 2021-10-10T14:25:59Z

Rebased. "All checks have failed" => There are some errors fo fix.

fxlb · 2023-07-29T10:12:18Z

The current types/sub-types in libpcap filter syntax use "-" and not "_".

Examples:

wlan:   
assoc-req,  assoc-resp, ...

The  following   ICMP   type   field   values   are   available:
icmp-echoreply,  icmp-unreach, ...

The  following  ICMPv6  type   field   values   are   available:
icmp6-destinationunreach, icmp6-packettoobig, ...

The following TCP flags field  values  are  available:  tcp-fin,
tcp-syn, tcp-rst, tcp-push, tcp-ack, tcp-urg, tcp-ece, tcp-cwr.

Thus for batman-adv packet types,

The following packet type aliases are available for compat  ver-
sion  14:  iv_ogm,  unicast-frag (?), tt_query, roam_adv, unicast_4addr.

The following packet type aliases are available for compat  ver-
sion 15: iv_ogm, unicast_frag, unicast_4addr, unicast_tvlv.

it should be better to replace "_" by "-".

T-X · 2023-09-11T06:12:19Z

Changelog v6:

rebased to current master (no changes)
changed all packet sub-type aliases to use hyphens instead of underscores and updated manpage accordingly

T-X · 2024-06-28T04:09:18Z

Changelog v7:

rebased to current master branch
added new batman-adv multicast packet type, introduced in batman-adv v2024.0

T-X · 2024-06-28T06:29:33Z

I would also like to add the correct offset to the batadv_mcast_packet type, which has a variable payload offset. I would need to add the contents of the two bytes tvlv_len field to the offset:
https://git.open-mesh.org/batman-adv.git/blob/9e1f3974cca1fc0866793076684ea0f5c2649412:/include/uapi/linux/batadv_packet.h#l509

My tries so far were not successful with this, I might need some help/guidance for that.

T-X · 2024-06-30T06:17:26Z

Changelog v8:

removed mention of BATADV_UNICAST_TVLV from gen_batadv_offsets_v15(): currently a batman-adv unicast tvlv packets do not carry/support any payload frames, it only contains TVLVs, therefore removing it from offset considerations
added a new patch to take variable length offsets, the tvlv length, in a batman-adv mcast packet into account ("batman-adv: Add offset support to batman-adv mcast packet"), allows using offset adjustments with this packet type, too

T-X · 2024-06-30T06:25:32Z

Changelog v9:

removed an implicit cast from size_t to bpf_u_int32 for the field_offset variable in gen_batadv_offsets_v15(), which was added in v8 in the newly added patch

simonwunderlich · 2024-07-01T07:20:58Z

I would love to see this in tcpdump, too!

@mcr @fenner @infrastation @guyharris any chance you could help getting it merged? It sounded like @mcr was ready to merge it in 2021 already, but it's been stalled since then. Some embedded distributions already took the code as patch in to support their users, but having actually it merged would be great ...

This adds support for the layer 2 mesh routing protocol B.A.T.M.A.N. Advanced. "batadv" can be used to filter on batman-adv packets. It also allows later filters to look at frames inside the tunnel when both "version" and "type" are specified. Documentation for the batman-adv protocol can be found at the following locations: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/networking/batman-adv.rst https://www.open-mesh.org/ Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>

The batman-adv multicast packet type has a variable offset for its encapsulated payload frames. The offset depends not only on the batman-adv mcast packet header length but also the length of a potential, variable length TVLV between the batman-adv mcast packet header and the payload. This adds according BPF instructions to take the TVLV length into account for a batman-adv mcast packet and adjusts the payload offset accordingly. Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>

infrastation · 2025-01-05T21:06:32Z

Thank you for waiting. Rebased on the current master branch. I have looked through the changes one more time, there are minor places for improvement, but the most demanding parts are in gencode.c and grammar.y.in, as expected. One way to make it easier to verify could be capturing the new keywords in filter tests in TESTrun, I may be able to do that soon.

T-X · 2025-01-06T11:08:14Z

@infrastation thanks once more for the feedback and a happy new year!
Btw. one more limitation I noticed, which I think other protocols in libpcap that use header offsets, like Geneve or PPPoE, would have too: I can't match multiple batman-adv packet types. Something like these won't work:

batadv 15 and not batadv 15 bcast
batadv 15 bcast or batadv 15 iv-ogm
(batadv 15 bcast) or (batadv 15 iv-ogm)
batadv 15 (bcast or iv-ogm) -> syntax error

But it seemed to me that this is a limitation of how these offsets work in libpcap right now in general, right? Once the keyword matches then the offset is applied immediately and globally and not within a specific scope? Which in the first three examples above would result in matching batman-adv packets within batman-adv packets, even when using brackets?

mcr · 2025-01-06T18:35:17Z

T-X ***@***.***> wrote: But it seemed to me that this is a limitation of how these offsets work in libpcap right now in general, right? Once the keyword matches then the offset is applied immediately and globally and not within a specific scope? Which in the first three examples above would result in matching batman-adv packets within batman-adv packets, even when using brackets? Correct. And vlan is even more complex/annoying, because it can get taken out of the packet into meta-data. Fixing all of this requires some deep BPF knowledge, and some significant reorganization to the pcap filter language. And at least 3 weeks of bikeshedding what are probably gonna have to be new keywords.

infrastation · 2025-01-07T20:44:44Z

Three weeks of bikeshedding is not as bad as setting in stone something that causes pain by design, e.g. the rnr keyword.

infrastation · 2025-08-15T22:49:14Z

Thank you for waiting. I had another brief look at the proposed changes and would like to make a few comments, hopefully this will not take long.

infrastation · 2025-08-16T09:25:45Z

nametoaddr.c

+	{ "roam-adv",		BATADV_LEGACY_ROAM_ADV },
+	{ "unicast-4addr",	BATADV_LEGACY_UNICAST_4ADDR },
+	{ "coded",		BATADV_LEGACY_CODED },
+	{ (char *)0, 0 }


infrastation · 2025-08-16T09:25:53Z

nametoaddr.c

+	{ "unicast-4addr",	BATADV_UNICAST_4ADDR },
+	{ "icmp",		BATADV_ICMP },
+	{ "unicast-tvlv",	BATADV_UNICAST_TVLV },
+	{ (char *)0, 0 }


infrastation · 2025-08-16T09:27:42Z

pcap/namedb.h

+PCAP_API int	pcap_nametobatadvtype_v14(const char *);
+
+PCAP_AVAILABLE_1_11
+PCAP_API int	pcap_nametobatadvtype_v15(const char *);


The two new functions look out of place in the public API and should not exist even in the private API. The translation of a packet type string to a packet type number should be done in grammar.y.in using the existing str2tok() function the same way it is done for ieee80211_types[].

infrastation · 2025-08-16T09:30:31Z

gencode.c

+	if (has_type) {
+		b0 = gen_batadv_check_type(cstate, b0, version, type);
+		b0 = gen_batadv_offsets(cstate, b0, version, type);
+	}


This block uses version, is it supposed to be within the block just above then?

infrastation · 2025-08-16T09:41:57Z

gencode.c

+	size_t offset;
+
+	switch (type) {
+	case BATADV_LEGACY_UNICAST:		/* 0x03 */


Here and elsewhere: if there is no reason to know the exact value of a named constant, it is better not to provide it.

infrastation · 2025-08-16T09:53:19Z

gencode.c

+	switch (version) {
+	case 14:
+	case 15:
+		if (type > UINT8_MAX)


BATMAN packet types seem to be 8-bit (I could find a few TVLV diagrams, but not a packet diagram with a Type field in it, which does not look right, please see if you could fix that as well). Anyway, the point here is that the valid range check should be done as early in gencode.c as possible (see the call to assert_maxval() in gen_pppoes() and similar examples), then the functions that actually process the packet type should use an uint8_t for the validated value.

infrastation · 2025-08-16T11:41:48Z

Makefile.in

@@ -119,6 +119,8 @@ PUBHDR = \
 	pcap/vlan.h

 HDR = $(PUBHDR) \
+	batadv_legacy_packet.h \
+	batadv_packet.h \


The contents of these two new header files that is used only in gencode.c should go directly into gencode.c, and the remaining part (message types only, as far as I can see) should be in one header file used by both grammar.y.in and gencode.c (much like ieee80211.h). Also for clarity it may be better to use BATADV14_ and BATADV15_ for the packet types and batadv14_ and batadv15_ for the structures, in case there is yet another version in future.

infrastation · 2025-08-16T11:52:31Z

This is one of several proposed non-trivial changes that I did not originally understand, so I took a rather long detour earlier to develop additional tooling and tests and to learn the BPF compiler better. In addition to the comments left on the patch, please note:

The new code needs a number of tests: "filter" type (to show the resulting filter program explicitly) for all permutations of the new syntax and "apply" type (to prove that the filter program works as expected) for several keywords and a selection of packets in a pcap savefile.
If there is no better specification for the protocol encoding, it would be useful to say somewhere that the encoding is defined by the C structures in this and this file.

Other things I do not understand yet are:

whether the new offset code works exactly as it should
whether it would be better to separate v14 and v15 syntax explicitly, especially with the batadv [version] [type] syntax in mind when the version is not specified, but the type is

infrastation

Also please rebase these changes on the current master branch.

guyharris reviewed Nov 23, 2020

View reviewed changes

infrastation added the reviewed_needsrework label Nov 23, 2020

T-X force-pushed the batman-adv-support branch from a26e995 to cf95dad Compare November 23, 2020 21:26

T-X force-pushed the batman-adv-support branch from cf95dad to 53f2460 Compare November 23, 2020 21:40

T-X force-pushed the batman-adv-support branch 3 times, most recently from ed25b1c to 5a89e57 Compare November 24, 2020 10:54

infrastation removed the reviewed_needsrework label Nov 25, 2020

T-X mentioned this pull request Dec 2, 2020

batman-adv: Add tests for batman-adv version 15 packet types the-tcpdump-group/tcpdump#891

Open

guyharris reviewed Feb 13, 2021

View reviewed changes

T-X force-pushed the batman-adv-support branch from 5a89e57 to 3dcde32 Compare February 14, 2021 20:09

fxlb force-pushed the batman-adv-support branch from 3dcde32 to a576d46 Compare July 10, 2021 09:57

fxlb force-pushed the batman-adv-support branch from a576d46 to 555ee39 Compare October 10, 2021 13:31

T-X force-pushed the batman-adv-support branch from 555ee39 to e3698e7 Compare November 4, 2021 23:01

fxlb force-pushed the batman-adv-support branch from 5f47568 to 512ae9f Compare August 2, 2023 14:41

T-X force-pushed the batman-adv-support branch from 512ae9f to f8cbaf1 Compare September 11, 2023 06:10

T-X force-pushed the batman-adv-support branch from f8cbaf1 to bab4324 Compare June 28, 2024 03:42

T-X force-pushed the batman-adv-support branch from bab4324 to 1fc5b59 Compare June 30, 2024 06:11

T-X force-pushed the batman-adv-support branch from 1fc5b59 to da42b5b Compare June 30, 2024 06:23

T-X added 2 commits January 5, 2025 20:23

infrastation force-pushed the batman-adv-support branch from da42b5b to e688c38 Compare January 5, 2025 20:57

mcr approved these changes Aug 15, 2025

View reviewed changes

infrastation reviewed Aug 16, 2025

View reviewed changes

infrastation requested changes Aug 16, 2025

View reviewed changes

		@@ -0,0 +1,631 @@
		/* SPDX-License-Identifier: (GPL-2.0 WITH Linux-syscall-note) */

Add support for B.A.T.M.A.N. Advanced #980

Are you sure you want to change the base?

Add support for B.A.T.M.A.N. Advanced #980

Uh oh!

Conversation

T-X commented Nov 23, 2020

Uh oh!

T-X commented Nov 23, 2020

Uh oh!

infrastation commented Nov 23, 2020

Uh oh!

guyharris commented Nov 23, 2020

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

guyharris commented Nov 23, 2020

Uh oh!

T-X commented Nov 23, 2020

Uh oh!

T-X commented Nov 23, 2020

Uh oh!

infrastation commented Nov 23, 2020

Uh oh!

T-X commented Nov 24, 2020

Uh oh!

T-X commented Nov 24, 2020

Uh oh!

infrastation commented Nov 25, 2020

Uh oh!

T-X commented Dec 2, 2020

Uh oh!

infrastation commented Dec 2, 2020

Uh oh!

T-X commented Feb 13, 2021

Uh oh!

mcr commented Feb 13, 2021

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

fxlb commented Oct 10, 2021

Uh oh!

fxlb commented Jul 29, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

T-X commented Sep 11, 2023

Uh oh!

T-X commented Jun 28, 2024

Uh oh!

T-X commented Jun 28, 2024

Uh oh!

T-X commented Jun 30, 2024

Uh oh!

T-X commented Jun 30, 2024

Uh oh!

simonwunderlich commented Jul 1, 2024

Uh oh!

infrastation commented Jan 5, 2025

Uh oh!

T-X commented Jan 6, 2025

Uh oh!

mcr commented Jan 6, 2025 via email

Uh oh!

infrastation commented Jan 7, 2025

Uh oh!

infrastation commented Aug 15, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

infrastation Aug 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

infrastation Aug 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

fxlb commented Jul 29, 2023 •

edited

Loading

infrastation Aug 16, 2025 •

edited

Loading

infrastation Aug 16, 2025 •

edited

Loading