]> The Tcpdump Group git mirrors - tcpdump/blob - print-tcp.c
projects / tcpdump / blob


1528b3b9d6de76b3651b2df3d2a485cedabfa416
[tcpdump] / print-tcp.c
1 /*
2 * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997
3 * The Regents of the University of California. All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
16 * written permission.
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
20 */
21
22
23 #ifdef HAVE_CONFIG_H
24 #include "config.h"
25 #endif
26
27 #include <tcpdump-stdinc.h>
28
29 #include <rpc/rpc.h>
30
31 #include <stdio.h>
32 #include <stdlib.h>
33 #include <string.h>
34
35 #include "interface.h"
36 #include "addrtoname.h"
37 #include "extract.h"
38
39 #ifndef lint
40 static const char rcsid[] _U_ =
41 "@(#) $Header: /tcpdump/master/tcpdump/print-tcp.c,v 1.108 2003-11-15 00:39:41 guy Exp $ (LBL)";
42 #endif
43 #include "tcp.h"
44
45 #include "ip.h"
46 #ifdef INET6
47 #include "ip6.h"
48 #endif
49 #include "ipproto.h"
50
51 #include "nameser.h"
52
53 static void print_tcp_rst_data(register const u_char *sp, u_int length);
54
55 #define MAX_RST_DATA_LEN 30
56
57
58 struct tha {
59 #ifndef INET6
60 struct in_addr src;
61 struct in_addr dst;
62 #else
63 struct in6_addr src;
64 struct in6_addr dst;
65 #endif /*INET6*/
66 u_int port;
67 };
68
69 struct tcp_seq_hash {
70 struct tcp_seq_hash *nxt;
71 struct tha addr;
72 tcp_seq seq;
73 tcp_seq ack;
74 };
75
76 #define TSEQ_HASHSIZE 919
77
78 /* These tcp optinos do not have the size octet */
79 #define ZEROLENOPT(o) ((o) == TCPOPT_EOL || (o) == TCPOPT_NOP)
80
81 static struct tcp_seq_hash tcp_seq_hash[TSEQ_HASHSIZE];
82
83
84 #ifndef TELNET_PORT
85 #define TELNET_PORT 23
86 #endif
87 #ifndef BGP_PORT
88 #define BGP_PORT 179
89 #endif
90 #define NETBIOS_SSN_PORT 139
91 #ifndef PPTP_PORT
92 #define PPTP_PORT 1723
93 #endif
94 #define BEEP_PORT 10288
95 #ifndef NFS_PORT
96 #define NFS_PORT 2049
97 #endif
98 #define MSDP_PORT 639
99 #define LDP_PORT 646
100
101 static int tcp_cksum(register const struct ip *ip,
102 register const struct tcphdr *tp,
103 register int len)
104 {
105 union phu {
106 struct phdr {
107 u_int32_t src;
108 u_int32_t dst;
109 u_char mbz;
110 u_char proto;
111 u_int16_t len;
112 } ph;
113 u_int16_t pa[6];
114 } phu;
115 const u_int16_t *sp;
116
117 /* pseudo-header.. */
118 phu.ph.len = htons(len); /* XXX */
119 phu.ph.mbz = 0;
120 phu.ph.proto = IPPROTO_TCP;
121 memcpy(&phu.ph.src, &ip->ip_src.s_addr, sizeof(u_int32_t));
122 if (IP_HL(ip) == 5)
123 memcpy(&phu.ph.dst, &ip->ip_dst.s_addr, sizeof(u_int32_t));
124 else
125 phu.ph.dst = ip_finddst(ip);
126
127 sp = &phu.pa[0];
128 return in_cksum((u_short *)tp, len,
129 sp[0]+sp[1]+sp[2]+sp[3]+sp[4]+sp[5]);
130 }
131
132 #ifdef INET6
133 static int tcp6_cksum(const struct ip6_hdr *ip6, const struct tcphdr *tp,
134 int len)
135 {
136 size_t i, tlen;
137 register const u_int16_t *sp;
138 u_int32_t sum;
139 union {
140 struct {
141 struct in6_addr ph_src;
142 struct in6_addr ph_dst;
143 u_int32_t ph_len;
144 u_int8_t ph_zero[3];
145 u_int8_t ph_nxt;
146 } ph;
147 u_int16_t pa[20];
148 } phu;
149
150 tlen = EXTRACT_16BITS(&ip6->ip6_plen) + sizeof(struct ip6_hdr) -
151 ((const char *)tp - (const char*)ip6);
152
153 /* pseudo-header */
154 memset(&phu, 0, sizeof(phu));
155 phu.ph.ph_src = ip6->ip6_src;
156 phu.ph.ph_dst = ip6->ip6_dst;
157 phu.ph.ph_len = htonl(tlen);
158 phu.ph.ph_nxt = IPPROTO_TCP;
159
160 sum = 0;
161 for (i = 0; i < sizeof(phu.pa) / sizeof(phu.pa[0]); i++)
162 sum += phu.pa[i];
163
164 sp = (const u_int16_t *)tp;
165
166 for (i = 0; i < (tlen & ~1); i += 2)
167 sum += *sp++;
168
169 if (tlen & 1)
170 sum += htons((*(const u_int8_t *)sp) << 8);
171
172 while (sum > 0xffff)
173 sum = (sum & 0xffff) + (sum >> 16);
174 sum = ~sum & 0xffff;
175
176 return (sum);
177 }
178 #endif
179
180 void
181 tcp_print(register const u_char *bp, register u_int length,
182 register const u_char *bp2, int fragmented)
183 {
184 register const struct tcphdr *tp;
185 register const struct ip *ip;
186 register u_char flags;
187 register u_int hlen;
188 register char ch;
189 u_int16_t sport, dport, win, urp;
190 u_int32_t seq, ack, thseq, thack;
191 int threv;
192 #ifdef INET6
193 register const struct ip6_hdr *ip6;
194 #endif
195
196 tp = (struct tcphdr *)bp;
197 ip = (struct ip *)bp2;
198 #ifdef INET6
199 if (IP_V(ip) == 6)
200 ip6 = (struct ip6_hdr *)bp2;
201 else
202 ip6 = NULL;
203 #endif /*INET6*/
204 ch = '\0';
205 if (!TTEST(tp->th_dport)) {
206 (void)printf("%s > %s: [|tcp]",
207 ipaddr_string(&ip->ip_src),
208 ipaddr_string(&ip->ip_dst));
209 return;
210 }
211
212 sport = EXTRACT_16BITS(&tp->th_sport);
213 dport = EXTRACT_16BITS(&tp->th_dport);
214
215 hlen = TH_OFF(tp) * 4;
216
217 /*
218 * If data present and NFS port used, assume NFS.
219 * Pass offset of data plus 4 bytes for RPC TCP msg length
220 * to NFS print routines.
221 */
222 if (!qflag) {
223 if ((u_char *)tp + 4 + sizeof(struct rpc_msg) <= snapend &&
224 dport == NFS_PORT) {
225 nfsreq_print((u_char *)tp + hlen + 4, length - hlen,
226 (u_char *)ip);
227 return;
228 } else if ((u_char *)tp + 4 + sizeof(struct rpc_msg)
229 <= snapend &&
230 sport == NFS_PORT) {
231 nfsreply_print((u_char *)tp + hlen + 4, length - hlen,
232 (u_char *)ip);
233 return;
234 }
235 }
236 #ifdef INET6
237 if (ip6) {
238 if (ip6->ip6_nxt == IPPROTO_TCP) {
239 (void)printf("%s.%s > %s.%s: ",
240 ip6addr_string(&ip6->ip6_src),
241 tcpport_string(sport),
242 ip6addr_string(&ip6->ip6_dst),
243 tcpport_string(dport));
244 } else {
245 (void)printf("%s > %s: ",
246 tcpport_string(sport), tcpport_string(dport));
247 }
248 } else
249 #endif /*INET6*/
250 {
251 if (ip->ip_p == IPPROTO_TCP) {
252 (void)printf("%s.%s > %s.%s: ",
253 ipaddr_string(&ip->ip_src),
254 tcpport_string(sport),
255 ipaddr_string(&ip->ip_dst),
256 tcpport_string(dport));
257 } else {
258 (void)printf("%s > %s: ",
259 tcpport_string(sport), tcpport_string(dport));
260 }
261 }
262
263 TCHECK(*tp);
264
265 seq = EXTRACT_32BITS(&tp->th_seq);
266 ack = EXTRACT_32BITS(&tp->th_ack);
267 win = EXTRACT_16BITS(&tp->th_win);
268 urp = EXTRACT_16BITS(&tp->th_urp);
269
270 if (qflag) {
271 (void)printf("tcp %d", length - TH_OFF(tp) * 4);
272 return;
273 }
274 if ((flags = tp->th_flags) & (TH_SYN|TH_FIN|TH_RST|TH_PUSH|
275 TH_ECNECHO|TH_CWR)) {
276 if (flags & TH_SYN)
277 putchar('S');
278 if (flags & TH_FIN)
279 putchar('F');
280 if (flags & TH_RST)
281 putchar('R');
282 if (flags & TH_PUSH)
283 putchar('P');
284 if (flags & TH_CWR)
285 putchar('W'); /* congestion _W_indow reduced (ECN) */
286 if (flags & TH_ECNECHO)
287 putchar('E'); /* ecn _E_cho sent (ECN) */
288 } else
289 putchar('.');
290
291 if (!Sflag && (flags & TH_ACK)) {
292 register struct tcp_seq_hash *th;
293 const void *src, *dst;
294 register int rev;
295 struct tha tha;
296 /*
297 * Find (or record) the initial sequence numbers for
298 * this conversation. (we pick an arbitrary
299 * collating order so there's only one entry for
300 * both directions).
301 */
302 #ifdef INET6
303 memset(&tha, 0, sizeof(tha));
304 rev = 0;
305 if (ip6) {
306 src = &ip6->ip6_src;
307 dst = &ip6->ip6_dst;
308 if (sport > dport)
309 rev = 1;
310 else if (sport == dport) {
311 if (memcmp(src, dst, sizeof ip6->ip6_dst) > 0)
312 rev = 1;
313 }
314 if (rev) {
315 memcpy(&tha.src, dst, sizeof ip6->ip6_dst);
316 memcpy(&tha.dst, src, sizeof ip6->ip6_src);
317 tha.port = dport << 16 | sport;
318 } else {
319 memcpy(&tha.dst, dst, sizeof ip6->ip6_dst);
320 memcpy(&tha.src, src, sizeof ip6->ip6_src);
321 tha.port = sport << 16 | dport;
322 }
323 } else {
324 src = &ip->ip_src;
325 dst = &ip->ip_dst;
326 if (sport > dport)
327 rev = 1;
328 else if (sport == dport) {
329 if (memcmp(src, dst, sizeof ip->ip_dst) > 0)
330 rev = 1;
331 }
332 if (rev) {
333 memcpy(&tha.src, dst, sizeof ip->ip_dst);
334 memcpy(&tha.dst, src, sizeof ip->ip_src);
335 tha.port = dport << 16 | sport;
336 } else {
337 memcpy(&tha.dst, dst, sizeof ip->ip_dst);
338 memcpy(&tha.src, src, sizeof ip->ip_src);
339 tha.port = sport << 16 | dport;
340 }
341 }
342 #else
343 rev = 0;
344 src = &ip->ip_src;
345 dst = &ip->ip_dst;
346 if (sport > dport)
347 rev = 1;
348 else if (sport == dport) {
349 if (memcmp(src, dst, sizeof ip->ip_dst) > 0)
350 rev = 1;
351 }
352 if (rev) {
353 memcpy(&tha.src, dst, sizeof ip->ip_dst);
354 memcpy(&tha.dst, src, sizeof ip->ip_src);
355 tha.port = dport << 16 | sport;
356 } else {
357 memcpy(&tha.dst, dst, sizeof ip->ip_dst);
358 memcpy(&tha.src, src, sizeof ip->ip_src);
359 tha.port = sport << 16 | dport;
360 }
361 #endif
362
363 threv = rev;
364 for (th = &tcp_seq_hash[tha.port % TSEQ_HASHSIZE];
365 th->nxt; th = th->nxt)
366 if (memcmp((char *)&tha, (char *)&th->addr,
367 sizeof(th->addr)) == 0)
368 break;
369
370 if (!th->nxt || (flags & TH_SYN)) {
371 /* didn't find it or new conversation */
372 if (th->nxt == NULL) {
373 th->nxt = (struct tcp_seq_hash *)
374 calloc(1, sizeof(*th));
375 if (th->nxt == NULL)
376 error("tcp_print: calloc");
377 }
378 th->addr = tha;
379 if (rev)
380 th->ack = seq, th->seq = ack - 1;
381 else
382 th->seq = seq, th->ack = ack - 1;
383 } else {
384 if (rev)
385 seq -= th->ack, ack -= th->seq;
386 else
387 seq -= th->seq, ack -= th->ack;
388 }
389
390 thseq = th->seq;
391 thack = th->ack;
392 } else {
393 /*fool gcc*/
394 thseq = thack = threv = 0;
395 }
396 if (hlen > length) {
397 (void)printf(" [bad hdr length]");
398 return;
399 }
400
401 if (IP_V(ip) == 4 && vflag && !fragmented) {
402 u_int16_t sum, tcp_sum;
403 if (TTEST2(tp->th_sport, length)) {
404 sum = tcp_cksum(ip, tp, length);
405 if (sum != 0) {
406 tcp_sum = EXTRACT_16BITS(&tp->th_sum);
407 (void)printf(" [bad tcp cksum %x (->%x)!]",
408 tcp_sum, in_cksum_shouldbe(tcp_sum, sum));
409 } else
410 (void)printf(" [tcp sum ok]");
411 }
412 }
413 #ifdef INET6
414 if (IP_V(ip) == 6 && ip6->ip6_plen && vflag && !fragmented) {
415 int sum;
416 if (TTEST2(tp->th_sport, length)) {
417 sum = tcp6_cksum(ip6, tp, length);
418 if (sum != 0)
419 (void)printf(" [bad tcp cksum %x!]", sum);
420 else
421 (void)printf(" [tcp sum ok]");
422 }
423 }
424 #endif
425
426 length -= hlen;
427 if (vflag > 1 || length > 0 || flags & (TH_SYN | TH_FIN | TH_RST))
428 (void)printf(" %u:%u(%u)", seq, seq + length, length);
429 if (flags & TH_ACK)
430 (void)printf(" ack %u", ack);
431
432 (void)printf(" win %d", win);
433
434 if (flags & TH_URG)
435 (void)printf(" urg %d", urp);
436 /*
437 * Handle any options.
438 */
439 if (hlen > sizeof(*tp)) {
440 register const u_char *cp;
441 register u_int i, opt, datalen;
442 register u_int len;
443
444 hlen -= sizeof(*tp);
445 cp = (const u_char *)tp + sizeof(*tp);
446 putchar(' ');
447 ch = '<';
448 while (hlen > 0) {
449 putchar(ch);
450 TCHECK(*cp);
451 opt = *cp++;
452 if (ZEROLENOPT(opt))
453 len = 1;
454 else {
455 TCHECK(*cp);
456 len = *cp++; /* total including type, len */
457 if (len < 2 || len > hlen)
458 goto bad;
459 --hlen; /* account for length byte */
460 }
461 --hlen; /* account for type byte */
462 datalen = 0;
463
464 /* Bail if "l" bytes of data are not left or were not captured */
465 #define LENCHECK(l) { if ((l) > hlen) goto bad; TCHECK2(*cp, l); }
466
467 switch (opt) {
468
469 case TCPOPT_MAXSEG:
470 (void)printf("mss");
471 datalen = 2;
472 LENCHECK(datalen);
473 (void)printf(" %u", EXTRACT_16BITS(cp));
474
475 break;
476
477 case TCPOPT_EOL:
478 (void)printf("eol");
479 break;
480
481 case TCPOPT_NOP:
482 (void)printf("nop");
483 break;
484
485 case TCPOPT_WSCALE:
486 (void)printf("wscale");
487 datalen = 1;
488 LENCHECK(datalen);
489 (void)printf(" %u", *cp);
490 break;
491
492 case TCPOPT_SACKOK:
493 (void)printf("sackOK");
494 break;
495
496 case TCPOPT_SACK:
497 (void)printf("sack");
498 datalen = len - 2;
499 if (datalen % 8 != 0) {
500 (void)printf(" malformed sack ");
501 } else {
502 u_int32_t s, e;
503
504 (void)printf(" sack %d ", datalen / 8);
505 for (i = 0; i < datalen; i += 8) {
506 LENCHECK(i + 4);
507 s = EXTRACT_32BITS(cp + i);
508 LENCHECK(i + 8);
509 e = EXTRACT_32BITS(cp + i + 4);
510 if (threv) {
511 s -= thseq;
512 e -= thseq;
513 } else {
514 s -= thack;
515 e -= thack;
516 }
517 (void)printf("{%u:%u}", s, e);
518 }
519 (void)printf(" ");
520 }
521 break;
522
523 case TCPOPT_ECHO:
524 (void)printf("echo");
525 datalen = 4;
526 LENCHECK(datalen);
527 (void)printf(" %u", EXTRACT_32BITS(cp));
528 break;
529
530 case TCPOPT_ECHOREPLY:
531 (void)printf("echoreply");
532 datalen = 4;
533 LENCHECK(datalen);
534 (void)printf(" %u", EXTRACT_32BITS(cp));
535 break;
536
537 case TCPOPT_TIMESTAMP:
538 (void)printf("timestamp");
539 datalen = 8;
540 LENCHECK(4);
541 (void)printf(" %u", EXTRACT_32BITS(cp));
542 LENCHECK(datalen);
543 (void)printf(" %u", EXTRACT_32BITS(cp + 4));
544 break;
545
546 case TCPOPT_CC:
547 (void)printf("cc");
548 datalen = 4;
549 LENCHECK(datalen);
550 (void)printf(" %u", EXTRACT_32BITS(cp));
551 break;
552
553 case TCPOPT_CCNEW:
554 (void)printf("ccnew");
555 datalen = 4;
556 LENCHECK(datalen);
557 (void)printf(" %u", EXTRACT_32BITS(cp));
558 break;
559
560 case TCPOPT_CCECHO:
561 (void)printf("ccecho");
562 datalen = 4;
563 LENCHECK(datalen);
564 (void)printf(" %u", EXTRACT_32BITS(cp));
565 break;
566
567 default:
568 (void)printf("opt-%u:", opt);
569 datalen = len - 2;
570 for (i = 0; i < datalen; ++i) {
571 LENCHECK(i);
572 (void)printf("%02x", cp[i]);
573 }
574 break;
575 }
576
577 /* Account for data printed */
578 cp += datalen;
579 hlen -= datalen;
580
581 /* Check specification against observed length */
582 ++datalen; /* option octet */
583 if (!ZEROLENOPT(opt))
584 ++datalen; /* size octet */
585 if (datalen != len)
586 (void)printf("[len %d]", len);
587 ch = ',';
588 if (opt == TCPOPT_EOL)
589 break;
590 }
591 putchar('>');
592 }
593
594 if (length <= 0)
595 return;
596
597 /*
598 * Decode payload if necessary.
599 */
600 bp += TH_OFF(tp) * 4;
601 if (flags & TH_RST) {
602 if (vflag)
603 print_tcp_rst_data(bp, length);
604 } else {
605 if (sport == TELNET_PORT || dport == TELNET_PORT) {
606 if (!qflag && vflag)
607 telnet_print(bp, length);
608 } else if (sport == BGP_PORT || dport == BGP_PORT)
609 bgp_print(bp, length);
610 else if (sport == PPTP_PORT || dport == PPTP_PORT)
611 pptp_print(bp);
612 #ifdef TCPDUMP_DO_SMB
613 else if (sport == NETBIOS_SSN_PORT || dport == NETBIOS_SSN_PORT)
614 nbt_tcp_print(bp, length);
615 #endif
616 else if (sport == BEEP_PORT || dport == BEEP_PORT)
617 beep_print(bp, length);
618 else if (length > 2 &&
619 (sport == NAMESERVER_PORT || dport == NAMESERVER_PORT ||
620 sport == MULTICASTDNS_PORT || dport == MULTICASTDNS_PORT)) {
621 /*
622 * TCP DNS query has 2byte length at the head.
623 * XXX packet could be unaligned, it can go strange
624 */
625 ns_print(bp + 2, length - 2, 0);
626 } else if (sport == MSDP_PORT || dport == MSDP_PORT) {
627 msdp_print(bp, length);
628 }
629 else if (sport == LDP_PORT || dport == LDP_PORT)
630 printf(": LDP, length: %u", length);
631 }
632 return;
633 bad:
634 fputs("[bad opt]", stdout);
635 if (ch != '\0')
636 putchar('>');
637 return;
638 trunc:
639 fputs("[|tcp]", stdout);
640 if (ch != '\0')
641 putchar('>');
642 }
643
644 /*
645 * RFC1122 says the following on data in RST segments:
646 *
647 * 4.2.2.12 RST Segment: RFC-793 Section 3.4
648 *
649 * A TCP SHOULD allow a received RST segment to include data.
650 *
651 * DISCUSSION
652 * It has been suggested that a RST segment could contain
653 * ASCII text that encoded and explained the cause of the
654 * RST. No standard has yet been established for such
655 * data.
656 *
657 */
658
659 static void
660 print_tcp_rst_data(register const u_char *sp, u_int length)
661 {
662 int c;
663
664 if (TTEST2(*sp, length))
665 printf(" [RST");
666 else
667 printf(" [!RST");
668 if (length > MAX_RST_DATA_LEN) {
669 length = MAX_RST_DATA_LEN; /* can use -X for longer */
670 putchar('+'); /* indicate we truncate */
671 }
672 putchar(' ');
673 while (length-- && sp <= snapend) {
674 c = *sp++;
675 safeputchar(c);
676 }
677 putchar(']');
678 }
[mirror] the TCPdump network dissector