]> The Tcpdump Group git mirrors - tcpdump/blob - print-tcp.c
projects / tcpdump / blob


21d855ed72b1a38b508e73ea4d3090a8f6e34287
[tcpdump] / print-tcp.c
1 /*
2 * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997
3 * The Regents of the University of California. All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
16 * written permission.
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
20 */
21
22 #ifndef lint
23 static const char rcsid[] =
24 "@(#) $Header: /tcpdump/master/tcpdump/print-tcp.c,v 1.98 2002-08-01 08:53:31 risso Exp $ (LBL)";
25 #endif
26
27 #ifdef HAVE_CONFIG_H
28 #include "config.h"
29 #endif
30
31 #include <tcpdump-stdinc.h>
32
33 #include <rpc/rpc.h>
34
35 #include <stdio.h>
36 #include <stdlib.h>
37 #include <string.h>
38
39 #include "interface.h"
40 #include "addrtoname.h"
41 #include "extract.h"
42
43 #include "tcp.h"
44
45 #include "ip.h"
46 #ifdef INET6
47 #include "ip6.h"
48 #endif
49
50 #include "nameser.h"
51
52 static void print_tcp_rst_data(register const u_char *sp, u_int length);
53
54 #define MAX_RST_DATA_LEN 30
55
56
57 struct tha {
58 #ifndef INET6
59 struct in_addr src;
60 struct in_addr dst;
61 #else
62 struct in6_addr src;
63 struct in6_addr dst;
64 #endif /*INET6*/
65 u_int port;
66 };
67
68 struct tcp_seq_hash {
69 struct tcp_seq_hash *nxt;
70 struct tha addr;
71 tcp_seq seq;
72 tcp_seq ack;
73 };
74
75 #define TSEQ_HASHSIZE 919
76
77 /* These tcp optinos do not have the size octet */
78 #define ZEROLENOPT(o) ((o) == TCPOPT_EOL || (o) == TCPOPT_NOP)
79
80 static struct tcp_seq_hash tcp_seq_hash[TSEQ_HASHSIZE];
81
82
83 #ifndef TELNET_PORT
84 #define TELNET_PORT 23
85 #endif
86 #ifndef BGP_PORT
87 #define BGP_PORT 179
88 #endif
89 #define NETBIOS_SSN_PORT 139
90 #ifndef PPTP_PORT
91 #define PPTP_PORT 1723
92 #endif
93 #define BEEP_PORT 10288
94 #ifndef NFS_PORT
95 #define NFS_PORT 2049
96 #endif
97 #define MSDP_PORT 639
98
99 static int tcp_cksum(register const struct ip *ip,
100 register const struct tcphdr *tp,
101 register int len)
102 {
103 union phu {
104 struct phdr {
105 u_int32_t src;
106 u_int32_t dst;
107 u_char mbz;
108 u_char proto;
109 u_int16_t len;
110 } ph;
111 u_int16_t pa[6];
112 } phu;
113 const u_int16_t *sp;
114
115 /* pseudo-header.. */
116 phu.ph.len = htons(len); /* XXX */
117 phu.ph.mbz = 0;
118 phu.ph.proto = IPPROTO_TCP;
119 memcpy(&phu.ph.src, &ip->ip_src.s_addr, sizeof(u_int32_t));
120 if (IP_HL(ip) == 5)
121 memcpy(&phu.ph.dst, &ip->ip_dst.s_addr, sizeof(u_int32_t));
122 else
123 phu.ph.dst = ip_finddst(ip);
124
125 sp = &phu.pa[0];
126 return in_cksum((u_short *)tp, len,
127 sp[0]+sp[1]+sp[2]+sp[3]+sp[4]+sp[5]);
128 }
129
130 #ifdef INET6
131 static int tcp6_cksum(const struct ip6_hdr *ip6, const struct tcphdr *tp,
132 int len)
133 {
134 int i, tlen;
135 register const u_int16_t *sp;
136 u_int32_t sum;
137 union {
138 struct {
139 struct in6_addr ph_src;
140 struct in6_addr ph_dst;
141 u_int32_t ph_len;
142 u_int8_t ph_zero[3];
143 u_int8_t ph_nxt;
144 } ph;
145 u_int16_t pa[20];
146 } phu;
147
148 tlen = ntohs(ip6->ip6_plen) + sizeof(struct ip6_hdr) -
149 ((const char *)tp - (const char*)ip6);
150
151 /* pseudo-header */
152 memset(&phu, 0, sizeof(phu));
153 phu.ph.ph_src = ip6->ip6_src;
154 phu.ph.ph_dst = ip6->ip6_dst;
155 phu.ph.ph_len = htonl(tlen);
156 phu.ph.ph_nxt = IPPROTO_TCP;
157
158 sum = 0;
159 for (i = 0; i < sizeof(phu.pa) / sizeof(phu.pa[0]); i++)
160 sum += phu.pa[i];
161
162 sp = (const u_int16_t *)tp;
163
164 for (i = 0; i < (tlen & ~1); i += 2)
165 sum += *sp++;
166
167 if (tlen & 1)
168 sum += htons((*(const u_int8_t *)sp) << 8);
169
170 while (sum > 0xffff)
171 sum = (sum & 0xffff) + (sum >> 16);
172 sum = ~sum & 0xffff;
173
174 return (sum);
175 }
176 #endif
177
178 void
179 tcp_print(register const u_char *bp, register u_int length,
180 register const u_char *bp2, int fragmented)
181 {
182 register const struct tcphdr *tp;
183 register const struct ip *ip;
184 register u_char flags;
185 register int hlen;
186 register char ch;
187 u_int16_t sport, dport, win, urp;
188 u_int32_t seq, ack, thseq, thack;
189 int threv;
190 #ifdef INET6
191 register const struct ip6_hdr *ip6;
192 #endif
193
194 tp = (struct tcphdr *)bp;
195 ip = (struct ip *)bp2;
196 #ifdef INET6
197 if (IP_V(ip) == 6)
198 ip6 = (struct ip6_hdr *)bp2;
199 else
200 ip6 = NULL;
201 #endif /*INET6*/
202 ch = '\0';
203 if (!TTEST(tp->th_dport)) {
204 (void)printf("%s > %s: [|tcp]",
205 ipaddr_string(&ip->ip_src),
206 ipaddr_string(&ip->ip_dst));
207 return;
208 }
209
210 sport = ntohs(tp->th_sport);
211 dport = ntohs(tp->th_dport);
212
213 hlen = TH_OFF(tp) * 4;
214
215 /*
216 * If data present and NFS port used, assume NFS.
217 * Pass offset of data plus 4 bytes for RPC TCP msg length
218 * to NFS print routines.
219 */
220 if (!qflag) {
221 if ((u_char *)tp + 4 + sizeof(struct rpc_msg) <= snapend &&
222 dport == NFS_PORT) {
223 nfsreq_print((u_char *)tp + hlen + 4, length - hlen,
224 (u_char *)ip);
225 return;
226 } else if ((u_char *)tp + 4 + sizeof(struct rpc_msg)
227 <= snapend &&
228 sport == NFS_PORT) {
229 nfsreply_print((u_char *)tp + hlen + 4, length - hlen,
230 (u_char *)ip);
231 return;
232 }
233 }
234 #ifdef INET6
235 if (ip6) {
236 if (ip6->ip6_nxt == IPPROTO_TCP) {
237 (void)printf("%s.%s > %s.%s: ",
238 ip6addr_string(&ip6->ip6_src),
239 tcpport_string(sport),
240 ip6addr_string(&ip6->ip6_dst),
241 tcpport_string(dport));
242 } else {
243 (void)printf("%s > %s: ",
244 tcpport_string(sport), tcpport_string(dport));
245 }
246 } else
247 #endif /*INET6*/
248 {
249 if (ip->ip_p == IPPROTO_TCP) {
250 (void)printf("%s.%s > %s.%s: ",
251 ipaddr_string(&ip->ip_src),
252 tcpport_string(sport),
253 ipaddr_string(&ip->ip_dst),
254 tcpport_string(dport));
255 } else {
256 (void)printf("%s > %s: ",
257 tcpport_string(sport), tcpport_string(dport));
258 }
259 }
260
261 TCHECK(*tp);
262
263 seq = (u_int32_t)ntohl(tp->th_seq);
264 ack = (u_int32_t)ntohl(tp->th_ack);
265 win = ntohs(tp->th_win);
266 urp = ntohs(tp->th_urp);
267
268 if (qflag) {
269 (void)printf("tcp %d", length - TH_OFF(tp) * 4);
270 return;
271 }
272 if ((flags = tp->th_flags) & (TH_SYN|TH_FIN|TH_RST|TH_PUSH|
273 TH_ECNECHO|TH_CWR)) {
274 if (flags & TH_SYN)
275 putchar('S');
276 if (flags & TH_FIN)
277 putchar('F');
278 if (flags & TH_RST)
279 putchar('R');
280 if (flags & TH_PUSH)
281 putchar('P');
282 if (flags & TH_CWR)
283 putchar('W'); /* congestion _W_indow reduced (ECN) */
284 if (flags & TH_ECNECHO)
285 putchar('E'); /* ecn _E_cho sent (ECN) */
286 } else
287 putchar('.');
288
289 if (!Sflag && (flags & TH_ACK)) {
290 register struct tcp_seq_hash *th;
291 register int rev;
292 struct tha tha;
293 /*
294 * Find (or record) the initial sequence numbers for
295 * this conversation. (we pick an arbitrary
296 * collating order so there's only one entry for
297 * both directions).
298 */
299 #ifdef INET6
300 memset(&tha, 0, sizeof(tha));
301 rev = 0;
302 if (ip6) {
303 if (sport > dport)
304 rev = 1;
305 else if (sport == dport) {
306 int i;
307
308 for (i = 0; i < 4; i++) {
309 if (((u_int32_t *)(&ip6->ip6_src))[i] >
310 ((u_int32_t *)(&ip6->ip6_dst))[i]) {
311 rev = 1;
312 break;
313 }
314 }
315 }
316 if (rev) {
317 tha.src = ip6->ip6_dst;
318 tha.dst = ip6->ip6_src;
319 tha.port = dport << 16 | sport;
320 } else {
321 tha.dst = ip6->ip6_dst;
322 tha.src = ip6->ip6_src;
323 tha.port = sport << 16 | dport;
324 }
325 } else {
326 if (sport > dport ||
327 (sport == dport &&
328 ip->ip_src.s_addr > ip->ip_dst.s_addr)) {
329 rev = 1;
330 }
331 if (rev) {
332 *(struct in_addr *)&tha.src = ip->ip_dst;
333 *(struct in_addr *)&tha.dst = ip->ip_src;
334 tha.port = dport << 16 | sport;
335 } else {
336 *(struct in_addr *)&tha.dst = ip->ip_dst;
337 *(struct in_addr *)&tha.src = ip->ip_src;
338 tha.port = sport << 16 | dport;
339 }
340 }
341 #else
342 if (sport < dport ||
343 (sport == dport &&
344 ip->ip_src.s_addr < ip->ip_dst.s_addr)) {
345 tha.src = ip->ip_src, tha.dst = ip->ip_dst;
346 tha.port = sport << 16 | dport;
347 rev = 0;
348 } else {
349 tha.src = ip->ip_dst, tha.dst = ip->ip_src;
350 tha.port = dport << 16 | sport;
351 rev = 1;
352 }
353 #endif
354
355 threv = rev;
356 for (th = &tcp_seq_hash[tha.port % TSEQ_HASHSIZE];
357 th->nxt; th = th->nxt)
358 if (!memcmp((char *)&tha, (char *)&th->addr,
359 sizeof(th->addr)))
360 break;
361
362 if (!th->nxt || (flags & TH_SYN)) {
363 /* didn't find it or new conversation */
364 if (th->nxt == NULL) {
365 th->nxt = (struct tcp_seq_hash *)
366 calloc(1, sizeof(*th));
367 if (th->nxt == NULL)
368 error("tcp_print: calloc");
369 }
370 th->addr = tha;
371 if (rev)
372 th->ack = seq, th->seq = ack - 1;
373 else
374 th->seq = seq, th->ack = ack - 1;
375 } else {
376 if (rev)
377 seq -= th->ack, ack -= th->seq;
378 else
379 seq -= th->seq, ack -= th->ack;
380 }
381
382 thseq = th->seq;
383 thack = th->ack;
384 } else {
385 /*fool gcc*/
386 thseq = thack = threv = 0;
387 }
388 if (hlen > length) {
389 (void)printf(" [bad hdr length]");
390 return;
391 }
392
393 if (IP_V(ip) == 4 && vflag && !fragmented) {
394 u_int16_t sum, tcp_sum;
395 if (TTEST2(tp->th_sport, length)) {
396 sum = tcp_cksum(ip, tp, length);
397 if (sum != 0) {
398 tcp_sum = ntohs(tp->th_sum);
399 (void)printf(" [bad tcp cksum %x (->%x)!]",
400 tcp_sum, in_cksum_shouldbe(tcp_sum, sum));
401 } else
402 (void)printf(" [tcp sum ok]");
403 }
404 }
405 #ifdef INET6
406 if (IP_V(ip) == 6 && ip6->ip6_plen && vflag && !fragmented) {
407 int sum;
408 if (TTEST2(tp->th_sport, length)) {
409 sum = tcp6_cksum(ip6, tp, length);
410 if (sum != 0)
411 (void)printf(" [bad tcp cksum %x!]", sum);
412 else
413 (void)printf(" [tcp sum ok]");
414 }
415 }
416 #endif
417
418 length -= hlen;
419 if (vflag > 1 || length > 0 || flags & (TH_SYN | TH_FIN | TH_RST))
420 (void)printf(" %u:%u(%u)", seq, seq + length, length);
421 if (flags & TH_ACK)
422 (void)printf(" ack %u", ack);
423
424 (void)printf(" win %d", win);
425
426 if (flags & TH_URG)
427 (void)printf(" urg %d", urp);
428 /*
429 * Handle any options.
430 */
431 if ((hlen -= sizeof(*tp)) > 0) {
432 register const u_char *cp;
433 register int i, opt, len, datalen;
434
435 cp = (const u_char *)tp + sizeof(*tp);
436 putchar(' ');
437 ch = '<';
438 while (hlen > 0) {
439 putchar(ch);
440 TCHECK(*cp);
441 opt = *cp++;
442 if (ZEROLENOPT(opt))
443 len = 1;
444 else {
445 TCHECK(*cp);
446 len = *cp++; /* total including type, len */
447 if (len < 2 || len > hlen)
448 goto bad;
449 --hlen; /* account for length byte */
450 }
451 --hlen; /* account for type byte */
452 datalen = 0;
453
454 /* Bail if "l" bytes of data are not left or were not captured */
455 #define LENCHECK(l) { if ((l) > hlen) goto bad; TCHECK2(*cp, l); }
456
457 switch (opt) {
458
459 case TCPOPT_MAXSEG:
460 (void)printf("mss");
461 datalen = 2;
462 LENCHECK(datalen);
463 (void)printf(" %u", EXTRACT_16BITS(cp));
464
465 break;
466
467 case TCPOPT_EOL:
468 (void)printf("eol");
469 break;
470
471 case TCPOPT_NOP:
472 (void)printf("nop");
473 break;
474
475 case TCPOPT_WSCALE:
476 (void)printf("wscale");
477 datalen = 1;
478 LENCHECK(datalen);
479 (void)printf(" %u", *cp);
480 break;
481
482 case TCPOPT_SACKOK:
483 (void)printf("sackOK");
484 break;
485
486 case TCPOPT_SACK:
487 (void)printf("sack");
488 datalen = len - 2;
489 if (datalen % 8 != 0) {
490 (void)printf(" malformed sack ");
491 } else {
492 u_int32_t s, e;
493
494 (void)printf(" sack %d ", datalen / 8);
495 for (i = 0; i < datalen; i += 8) {
496 LENCHECK(i + 4);
497 s = EXTRACT_32BITS(cp + i);
498 LENCHECK(i + 8);
499 e = EXTRACT_32BITS(cp + i + 4);
500 if (threv) {
501 s -= thseq;
502 e -= thseq;
503 } else {
504 s -= thack;
505 e -= thack;
506 }
507 (void)printf("{%u:%u}", s, e);
508 }
509 (void)printf(" ");
510 }
511 break;
512
513 case TCPOPT_ECHO:
514 (void)printf("echo");
515 datalen = 4;
516 LENCHECK(datalen);
517 (void)printf(" %u", EXTRACT_32BITS(cp));
518 break;
519
520 case TCPOPT_ECHOREPLY:
521 (void)printf("echoreply");
522 datalen = 4;
523 LENCHECK(datalen);
524 (void)printf(" %u", EXTRACT_32BITS(cp));
525 break;
526
527 case TCPOPT_TIMESTAMP:
528 (void)printf("timestamp");
529 datalen = 8;
530 LENCHECK(4);
531 (void)printf(" %u", EXTRACT_32BITS(cp));
532 LENCHECK(datalen);
533 (void)printf(" %u", EXTRACT_32BITS(cp + 4));
534 break;
535
536 case TCPOPT_CC:
537 (void)printf("cc");
538 datalen = 4;
539 LENCHECK(datalen);
540 (void)printf(" %u", EXTRACT_32BITS(cp));
541 break;
542
543 case TCPOPT_CCNEW:
544 (void)printf("ccnew");
545 datalen = 4;
546 LENCHECK(datalen);
547 (void)printf(" %u", EXTRACT_32BITS(cp));
548 break;
549
550 case TCPOPT_CCECHO:
551 (void)printf("ccecho");
552 datalen = 4;
553 LENCHECK(datalen);
554 (void)printf(" %u", EXTRACT_32BITS(cp));
555 break;
556
557 default:
558 (void)printf("opt-%d:", opt);
559 datalen = len - 2;
560 for (i = 0; i < datalen; ++i) {
561 LENCHECK(i);
562 (void)printf("%02x", cp[i]);
563 }
564 break;
565 }
566
567 /* Account for data printed */
568 cp += datalen;
569 hlen -= datalen;
570
571 /* Check specification against observed length */
572 ++datalen; /* option octet */
573 if (!ZEROLENOPT(opt))
574 ++datalen; /* size octet */
575 if (datalen != len)
576 (void)printf("[len %d]", len);
577 ch = ',';
578 if (opt == TCPOPT_EOL)
579 break;
580 }
581 putchar('>');
582 }
583
584 if (length <= 0)
585 return;
586
587 /*
588 * Decode payload if necessary.
589 */
590 bp += TH_OFF(tp) * 4;
591 if (flags & TH_RST) {
592 if (vflag)
593 print_tcp_rst_data(bp, length);
594 } else {
595 if (sport == TELNET_PORT || dport == TELNET_PORT) {
596 if (!qflag && vflag)
597 telnet_print(bp, length);
598 } else if (sport == BGP_PORT || dport == BGP_PORT)
599 bgp_print(bp, length);
600 else if (sport == PPTP_PORT || dport == PPTP_PORT)
601 pptp_print(bp, length);
602 #ifdef TCPDUMP_DO_SMB
603 else if (sport == NETBIOS_SSN_PORT || dport == NETBIOS_SSN_PORT)
604 nbt_tcp_print(bp, length);
605 #endif
606 else if (sport == BEEP_PORT || dport == BEEP_PORT)
607 beep_print(bp, length);
608 else if (length > 2 &&
609 (sport == NAMESERVER_PORT || dport == NAMESERVER_PORT)) {
610 /*
611 * TCP DNS query has 2byte length at the head.
612 * XXX packet could be unaligned, it can go strange
613 */
614 ns_print(bp + 2, length - 2);
615 } else if (sport == MSDP_PORT || dport == MSDP_PORT) {
616 msdp_print(bp, length);
617 }
618 }
619 return;
620 bad:
621 fputs("[bad opt]", stdout);
622 if (ch != '\0')
623 putchar('>');
624 return;
625 trunc:
626 fputs("[|tcp]", stdout);
627 if (ch != '\0')
628 putchar('>');
629 }
630
631 /*
632 * RFC1122 says the following on data in RST segments:
633 *
634 * 4.2.2.12 RST Segment: RFC-793 Section 3.4
635 *
636 * A TCP SHOULD allow a received RST segment to include data.
637 *
638 * DISCUSSION
639 * It has been suggested that a RST segment could contain
640 * ASCII text that encoded and explained the cause of the
641 * RST. No standard has yet been established for such
642 * data.
643 *
644 */
645
646 static void
647 print_tcp_rst_data(register const u_char *sp, u_int length)
648 {
649 int c;
650
651 if (TTEST2(*sp, length))
652 printf(" [RST");
653 else
654 printf(" [!RST");
655 if (length > MAX_RST_DATA_LEN) {
656 length = MAX_RST_DATA_LEN; /* can use -X for longer */
657 putchar('+'); /* indicate we truncate */
658 }
659 putchar(' ');
660 while (length-- && sp <= snapend) {
661 c = *sp++;
662 safeputchar(c);
663 }
664 putchar(']');
665 }
[mirror] the TCPdump network dissector