The Tcpdump Group git mirrors - tcpdump/blob - print-ip.c

   1 /*
   2  * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997
   3  *      The Regents of the University of California.  All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that: (1) source code distributions
   7  * retain the above copyright notice and this paragraph in its entirety, (2)
   8  * distributions including binary code include the above copyright notice and
   9  * this paragraph in its entirety in the documentation or other materials
  10  * provided with the distribution, and (3) all advertising materials mentioning
  11  * features or use of this software display the following acknowledgement:
  12  * ``This product includes software developed by the University of California,
  13  * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
  14  * the University nor the names of its contributors may be used to endorse
  15  * or promote products derived from this software without specific prior
  16  * written permission.
  17  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
  18  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
  19  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  20  */
  21
  22 /* \summary: IP printer */
  23
  24 #ifdef HAVE_CONFIG_H
  25 #include <config.h>
  26 #endif
  27
  28 #include "netdissect-stdinc.h"
  29
  30 #include <string.h>
  31
  32 #include "netdissect.h"
  33 #include "addrtoname.h"
  34 #include "extract.h"
  35
  36 #include "ip.h"
  37 #include "ipproto.h"
  38
  39
  40 static const struct tok ip_option_values[] = {
  41     { IPOPT_EOL, "EOL" },
  42     { IPOPT_NOP, "NOP" },
  43     { IPOPT_TS, "timestamp" },
  44     { IPOPT_SECURITY, "security" },
  45     { IPOPT_RR, "RR" },
  46     { IPOPT_SSRR, "SSRR" },
  47     { IPOPT_LSRR, "LSRR" },
  48     { IPOPT_RA, "RA" },
  49     { IPOPT_RFC1393, "traceroute" },
  50     { 0, NULL }
  51 };
  52
  53 /*
  54  * print the recorded route in an IP RR, LSRR or SSRR option.
  55  */
  56 static int
  57 ip_printroute(netdissect_options *ndo,
  58               const u_char *cp, u_int length)
  59 {
  60         u_int ptr;
  61         u_int len;
  62
  63         if (length < 3) {
  64                 ND_PRINT(" [bad length %u]", length);
  65                 return (0);
  66         }
  67         if ((length + 1) & 3)
  68                 ND_PRINT(" [bad length %u]", length);
  69         ND_TCHECK_1(cp + 2);
  70         ptr = GET_U_1(cp + 2) - 1;
  71         if (ptr < 3 || ((ptr + 1) & 3) || ptr > length + 1)
  72                 ND_PRINT(" [bad ptr %u]", GET_U_1(cp + 2));
  73
  74         for (len = 3; len < length; len += 4) {
  75                 ND_TCHECK_4(cp + len);
  76                 ND_PRINT(" %s", ipaddr_string(ndo, cp + len));
  77                 if (ptr > len)
  78                         ND_PRINT(",");
  79         }
  80         return (0);
  81
  82 trunc:
  83         return (-1);
  84 }
  85
  86 /*
  87  * If source-routing is present and valid, return the final destination.
  88  * Otherwise, return IP destination.
  89  *
  90  * This is used for UDP and TCP pseudo-header in the checksum
  91  * calculation.
  92  */
  93 static uint32_t
  94 ip_finddst(netdissect_options *ndo,
  95            const struct ip *ip)
  96 {
  97         u_int length;
  98         u_int len;
  99         const u_char *cp;
 100
 101         cp = (const u_char *)(ip + 1);
 102         length = IP_HL(ip) * 4;
 103         if (length < sizeof(struct ip))
 104                 goto trunc;
 105         length -= sizeof(struct ip);
 106
 107         for (; length != 0; cp += len, length -= len) {
 108                 int tt;
 109
 110                 ND_TCHECK_1(cp);
 111                 tt = GET_U_1(cp);
 112                 if (tt == IPOPT_EOL)
 113                         break;
 114                 else if (tt == IPOPT_NOP)
 115                         len = 1;
 116                 else {
 117                         ND_TCHECK_1(cp + 1);
 118                         len = GET_U_1(cp + 1);
 119                         if (len < 2)
 120                                 break;
 121                 }
 122                 if (length < len)
 123                         goto trunc;
 124                 ND_TCHECK_LEN(cp, len);
 125                 switch (tt) {
 126
 127                 case IPOPT_SSRR:
 128                 case IPOPT_LSRR:
 129                         if (len < 7)
 130                                 break;
 131                         return (GET_IPV4_TO_NETWORK_ORDER(cp + len - 4));
 132                 }
 133         }
 134 trunc:
 135         return (GET_IPV4_TO_NETWORK_ORDER(ip->ip_dst));
 136 }
 137
 138 /*
 139  * Compute a V4-style checksum by building a pseudoheader.
 140  */
 141 uint16_t
 142 nextproto4_cksum(netdissect_options *ndo,
 143                  const struct ip *ip, const uint8_t *data,
 144                  u_int len, u_int covlen, u_int next_proto)
 145 {
 146         struct phdr {
 147                 uint32_t src;
 148                 uint32_t dst;
 149                 u_char mbz;
 150                 u_char proto;
 151                 uint16_t len;
 152         } ph;
 153         struct cksum_vec vec[2];
 154
 155         /* pseudo-header.. */
 156         ph.len = htons((uint16_t)len);
 157         ph.mbz = 0;
 158         ph.proto = next_proto;
 159         ph.src = GET_IPV4_TO_NETWORK_ORDER(ip->ip_src);
 160         if (IP_HL(ip) == 5)
 161                 ph.dst = GET_IPV4_TO_NETWORK_ORDER(ip->ip_dst);
 162         else
 163                 ph.dst = ip_finddst(ndo, ip);
 164
 165         vec[0].ptr = (const uint8_t *)(void *)&ph;
 166         vec[0].len = sizeof(ph);
 167         vec[1].ptr = data;
 168         vec[1].len = covlen;
 169         return (in_cksum(vec, 2));
 170 }
 171
 172 static int
 173 ip_printts(netdissect_options *ndo,
 174            const u_char *cp, u_int length)
 175 {
 176         u_int ptr;
 177         u_int len;
 178         u_int hoplen;
 179         const char *type;
 180
 181         if (length < 4) {
 182                 ND_PRINT("[bad length %u]", length);
 183                 return (0);
 184         }
 185         ND_PRINT(" TS{");
 186         ND_TCHECK_1(cp + 3);
 187         hoplen = ((GET_U_1(cp + 3) & 0xF) != IPOPT_TS_TSONLY) ? 8 : 4;
 188         if ((length - 4) & (hoplen-1))
 189                 ND_PRINT("[bad length %u]", length);
 190         ND_TCHECK_1(cp + 2);
 191         ptr = GET_U_1(cp + 2) - 1;
 192         len = 0;
 193         if (ptr < 4 || ((ptr - 4) & (hoplen-1)) || ptr > length + 1)
 194                 ND_PRINT("[bad ptr %u]", GET_U_1(cp + 2));
 195         ND_TCHECK_1(cp + 3);
 196         switch (GET_U_1(cp + 3)&0xF) {
 197         case IPOPT_TS_TSONLY:
 198                 ND_PRINT("TSONLY");
 199                 break;
 200         case IPOPT_TS_TSANDADDR:
 201                 ND_PRINT("TS+ADDR");
 202                 break;
 203         /*
 204          * prespecified should really be 3, but some ones might send 2
 205          * instead, and the IPOPT_TS_PRESPEC constant can apparently
 206          * have both values, so we have to hard-code it here.
 207          */
 208
 209         case 2:
 210                 ND_PRINT("PRESPEC2.0");
 211                 break;
 212         case 3:                 /* IPOPT_TS_PRESPEC */
 213                 ND_PRINT("PRESPEC");
 214                 break;
 215         default:
 216                 ND_PRINT("[bad ts type %u]", GET_U_1(cp + 3)&0xF);
 217                 goto done;
 218         }
 219
 220         type = " ";
 221         for (len = 4; len < length; len += hoplen) {
 222                 if (ptr == len)
 223                         type = " ^ ";
 224                 ND_TCHECK_LEN(cp + len, hoplen);
 225                 ND_PRINT("%s%u@%s", type, GET_BE_U_4(cp + len + hoplen - 4),
 226                           hoplen!=8 ? "" : ipaddr_string(ndo, cp + len));
 227                 type = " ";
 228         }
 229
 230 done:
 231         ND_PRINT("%s", ptr == len ? " ^ " : "");
 232
 233         if (GET_U_1(cp + 3) >> 4)
 234                 ND_PRINT(" [%u hops not recorded]} ", GET_U_1(cp + 3)>>4);
 235         else
 236                 ND_PRINT("}");
 237         return (0);
 238
 239 trunc:
 240         return (-1);
 241 }
 242
 243 /*
 244  * print IP options.
 245    If truncated return -1, else 0.
 246  */
 247 static int
 248 ip_optprint(netdissect_options *ndo,
 249             const u_char *cp, u_int length)
 250 {
 251         u_int option_len;
 252         const char *sep = "";
 253
 254         for (; length > 0; cp += option_len, length -= option_len) {
 255                 u_int option_code;
 256
 257                 ND_PRINT("%s", sep);
 258                 sep = ",";
 259
 260                 ND_TCHECK_1(cp);
 261                 option_code = GET_U_1(cp);
 262
 263                 ND_PRINT("%s",
 264                           tok2str(ip_option_values,"unknown %u",option_code));
 265
 266                 if (option_code == IPOPT_NOP ||
 267                     option_code == IPOPT_EOL)
 268                         option_len = 1;
 269
 270                 else {
 271                         ND_TCHECK_1(cp + 1);
 272                         option_len = GET_U_1(cp + 1);
 273                         if (option_len < 2) {
 274                                 ND_PRINT(" [bad length %u]", option_len);
 275                                 return 0;
 276                         }
 277                 }
 278
 279                 if (option_len > length) {
 280                         ND_PRINT(" [bad length %u]", option_len);
 281                         return 0;
 282                 }
 283
 284                 ND_TCHECK_LEN(cp, option_len);
 285
 286                 switch (option_code) {
 287                 case IPOPT_EOL:
 288                         return 0;
 289
 290                 case IPOPT_TS:
 291                         if (ip_printts(ndo, cp, option_len) == -1)
 292                                 goto trunc;
 293                         break;
 294
 295                 case IPOPT_RR:       /* fall through */
 296                 case IPOPT_SSRR:
 297                 case IPOPT_LSRR:
 298                         if (ip_printroute(ndo, cp, option_len) == -1)
 299                                 goto trunc;
 300                         break;
 301
 302                 case IPOPT_RA:
 303                         if (option_len < 4) {
 304                                 ND_PRINT(" [bad length %u]", option_len);
 305                                 break;
 306                         }
 307                         ND_TCHECK_1(cp + 3);
 308                         if (GET_BE_U_2(cp + 2) != 0)
 309                                 ND_PRINT(" value %u", GET_BE_U_2(cp + 2));
 310                         break;
 311
 312                 case IPOPT_NOP:       /* nothing to print - fall through */
 313                 case IPOPT_SECURITY:
 314                 default:
 315                         break;
 316                 }
 317         }
 318         return 0;
 319
 320 trunc:
 321         return -1;
 322 }
 323
 324 #define IP_RES 0x8000
 325
 326 static const struct tok ip_frag_values[] = {
 327         { IP_MF,        "+" },
 328         { IP_DF,        "DF" },
 329         { IP_RES,       "rsvd" }, /* The RFC3514 evil ;-) bit */
 330         { 0,            NULL }
 331 };
 332
 333
 334 /*
 335  * print an IP datagram.
 336  */
 337 void
 338 ip_print(netdissect_options *ndo,
 339          const u_char *bp,
 340          u_int length)
 341 {
 342         const struct ip *ip;
 343         const u_char *ipend;
 344         u_int off;
 345         u_int hlen;
 346         u_int len;
 347         struct cksum_vec vec[1];
 348         uint8_t ip_tos, ip_ttl, ip_proto;
 349         uint16_t sum, ip_sum;
 350         const char *p_name;
 351         int truncated = 0;
 352
 353         ndo->ndo_protocol = "ip";
 354         ip = (const struct ip *)bp;
 355         if (IP_V(ip) != 4) { /* print version and fail if != 4 */
 356             if (IP_V(ip) == 6)
 357               ND_PRINT("IP6, wrong link-layer encapsulation");
 358             else
 359               ND_PRINT("IP%u", IP_V(ip));
 360             nd_print_invalid(ndo);
 361             return;
 362         }
 363         if (!ndo->ndo_eflag)
 364                 ND_PRINT("IP ");
 365
 366         ND_TCHECK_SIZE(ip);
 367         if (length < sizeof (struct ip)) {
 368                 ND_PRINT("truncated-ip %u", length);
 369                 return;
 370         }
 371         hlen = IP_HL(ip) * 4;
 372         if (hlen < sizeof (struct ip)) {
 373                 ND_PRINT("bad-hlen %u", hlen);
 374                 return;
 375         }
 376
 377         len = GET_BE_U_2(ip->ip_len);
 378         if (length < len)
 379                 ND_PRINT("truncated-ip - %u bytes missing! ",
 380                         len - length);
 381         if (len < hlen) {
 382 #ifdef GUESS_TSO
 383             if (len) {
 384                 ND_PRINT("bad-len %u", len);
 385                 return;
 386             }
 387             else {
 388                 /* we guess that it is a TSO send */
 389                 len = length;
 390             }
 391 #else
 392             ND_PRINT("bad-len %u", len);
 393             return;
 394 #endif /* GUESS_TSO */
 395         }
 396
 397         /*
 398          * Cut off the snapshot length to the end of the IP payload.
 399          */
 400         ipend = bp + len;
 401         if (ipend < ndo->ndo_snapend)
 402                 ndo->ndo_snapend = ipend;
 403
 404         len -= hlen;
 405
 406         off = GET_BE_U_2(ip->ip_off);
 407
 408         ip_proto = GET_U_1(ip->ip_p);
 409
 410         if (ndo->ndo_vflag) {
 411             ip_tos = GET_U_1(ip->ip_tos);
 412             ND_PRINT("(tos 0x%x", ip_tos);
 413             /* ECN bits */
 414             switch (ip_tos & 0x03) {
 415
 416             case 0:
 417                 break;
 418
 419             case 1:
 420                 ND_PRINT(",ECT(1)");
 421                 break;
 422
 423             case 2:
 424                 ND_PRINT(",ECT(0)");
 425                 break;
 426
 427             case 3:
 428                 ND_PRINT(",CE");
 429                 break;
 430             }
 431
 432             ip_ttl = GET_U_1(ip->ip_ttl);
 433             if (ip_ttl >= 1)
 434                 ND_PRINT(", ttl %u", ip_ttl);
 435
 436             /*
 437              * for the firewall guys, print id, offset.
 438              * On all but the last stick a "+" in the flags portion.
 439              * For unfragmented datagrams, note the don't fragment flag.
 440              */
 441             ND_PRINT(", id %u, offset %u, flags [%s], proto %s (%u)",
 442                          GET_BE_U_2(ip->ip_id),
 443                          (off & IP_OFFMASK) * 8,
 444                          bittok2str(ip_frag_values, "none", off & (IP_RES|IP_DF|IP_MF)),
 445                          tok2str(ipproto_values, "unknown", ip_proto),
 446                          ip_proto);
 447
 448             ND_PRINT(", length %u", GET_BE_U_2(ip->ip_len));
 449
 450             if ((hlen - sizeof(struct ip)) > 0) {
 451                 ND_PRINT(", options (");
 452                 if (ip_optprint(ndo, (const u_char *)(ip + 1),
 453                     hlen - sizeof(struct ip)) == -1) {
 454                         ND_PRINT(" [truncated-option]");
 455                         truncated = 1;
 456                 }
 457                 ND_PRINT(")");
 458             }
 459
 460             if (!ndo->ndo_Kflag && (const u_char *)ip + hlen <= ndo->ndo_snapend) {
 461                 vec[0].ptr = (const uint8_t *)(const void *)ip;
 462                 vec[0].len = hlen;
 463                 sum = in_cksum(vec, 1);
 464                 if (sum != 0) {
 465                     ip_sum = GET_BE_U_2(ip->ip_sum);
 466                     ND_PRINT(", bad cksum %x (->%x)!", ip_sum,
 467                              in_cksum_shouldbe(ip_sum, sum));
 468                 }
 469             }
 470
 471             ND_PRINT(")\n    ");
 472             if (truncated) {
 473                 ND_PRINT("%s > %s: ",
 474                          ipaddr_string(ndo, ip->ip_src),
 475                          ipaddr_string(ndo, ip->ip_dst));
 476                 goto trunc;
 477             }
 478         }
 479
 480         /*
 481          * If this is fragment zero, hand it to the next higher
 482          * level protocol.  Let them know whether there are more
 483          * fragments.
 484          */
 485         if ((off & IP_OFFMASK) == 0) {
 486                 u_int nh = GET_U_1(ip->ip_p);
 487
 488                 if (nh != IPPROTO_TCP && nh != IPPROTO_UDP &&
 489                     nh != IPPROTO_SCTP && nh != IPPROTO_DCCP) {
 490                         ND_PRINT("%s > %s: ",
 491                                      ipaddr_string(ndo, ip->ip_src),
 492                                      ipaddr_string(ndo, ip->ip_dst));
 493                 }
 494                 ip_print_demux(ndo, (const u_char *)ip + hlen, len, 4,
 495                     off & IP_MF, GET_U_1(ip->ip_ttl), nh, bp);
 496         } else {
 497                 /*
 498                  * Ultra quiet now means that all this stuff should be
 499                  * suppressed.
 500                  */
 501                 if (ndo->ndo_qflag > 1)
 502                         return;
 503
 504                 /*
 505                  * This isn't the first frag, so we're missing the
 506                  * next level protocol header.  print the ip addr
 507                  * and the protocol.
 508                  */
 509                 ND_PRINT("%s > %s:", ipaddr_string(ndo, ip->ip_src),
 510                           ipaddr_string(ndo, ip->ip_dst));
 511                 if (!ndo->ndo_nflag && (p_name = netdb_protoname(ip_proto)) != NULL)
 512                         ND_PRINT(" %s", p_name);
 513                 else
 514                         ND_PRINT(" ip-proto-%u", ip_proto);
 515         }
 516         return;
 517
 518 trunc:
 519         nd_print_trunc(ndo);
 520         return;
 521 }
 522
 523 void
 524 ipN_print(netdissect_options *ndo, const u_char *bp, u_int length)
 525 {
 526         ndo->ndo_protocol = "ipN";
 527         if (length < 1) {
 528                 ND_PRINT("truncated-ip %u", length);
 529                 return;
 530         }
 531
 532         ND_TCHECK_1(bp);
 533         switch (GET_U_1(bp) & 0xF0) {
 534         case 0x40:
 535                 ip_print(ndo, bp, length);
 536                 break;
 537         case 0x60:
 538                 ip6_print(ndo, bp, length);
 539                 break;
 540         default:
 541                 ND_PRINT("unknown ip %u", (GET_U_1(bp) & 0xF0) >> 4);
 542                 break;
 543         }
 544         return;
 545
 546 trunc:
 547         nd_print_trunc(ndo);
 548         return;
 549 }