]> The Tcpdump Group git mirrors - tcpdump/blob - print-ip.c
NDOize AH, BEEP and DTP decoders
[tcpdump] / print-ip.c
1 /*
2 * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997
3 * The Regents of the University of California. All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
16 * written permission.
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
20 */
21
22 #ifdef HAVE_CONFIG_H
23 #include "config.h"
24 #endif
25
26 #include <tcpdump-stdinc.h>
27
28 #include <stdio.h>
29 #include <stdlib.h>
30 #include <string.h>
31
32 #include "addrtoname.h"
33 #include "interface.h"
34 #include "extract.h" /* must come after interface.h */
35
36 #include "ip.h"
37 #include "ipproto.h"
38
39 static const char tstr[] = "[|ip]";
40
41 static const struct tok ip_option_values[] = {
42 { IPOPT_EOL, "EOL" },
43 { IPOPT_NOP, "NOP" },
44 { IPOPT_TS, "timestamp" },
45 { IPOPT_SECURITY, "security" },
46 { IPOPT_RR, "RR" },
47 { IPOPT_SSRR, "SSRR" },
48 { IPOPT_LSRR, "LSRR" },
49 { IPOPT_RA, "RA" },
50 { IPOPT_RFC1393, "traceroute" },
51 { 0, NULL }
52 };
53
54 /*
55 * print the recorded route in an IP RR, LSRR or SSRR option.
56 */
57 static void
58 ip_printroute(register const u_char *cp, u_int length)
59 {
60 register u_int ptr;
61 register u_int len;
62
63 if (length < 3) {
64 printf(" [bad length %u]", length);
65 return;
66 }
67 if ((length + 1) & 3)
68 printf(" [bad length %u]", length);
69 ptr = cp[2] - 1;
70 if (ptr < 3 || ((ptr + 1) & 3) || ptr > length + 1)
71 printf(" [bad ptr %u]", cp[2]);
72
73 for (len = 3; len < length; len += 4) {
74 printf(" %s", ipaddr_string(&cp[len]));
75 if (ptr > len)
76 printf(",");
77 }
78 }
79
80 /*
81 * If source-routing is present and valid, return the final destination.
82 * Otherwise, return IP destination.
83 *
84 * This is used for UDP and TCP pseudo-header in the checksum
85 * calculation.
86 */
87 static u_int32_t
88 ip_finddst(const struct ip *ip)
89 {
90 int length;
91 int len;
92 const u_char *cp;
93 u_int32_t retval;
94
95 cp = (const u_char *)(ip + 1);
96 length = (IP_HL(ip) << 2) - sizeof(struct ip);
97
98 for (; length > 0; cp += len, length -= len) {
99 int tt;
100
101 TCHECK(*cp);
102 tt = *cp;
103 if (tt == IPOPT_EOL)
104 break;
105 else if (tt == IPOPT_NOP)
106 len = 1;
107 else {
108 TCHECK(cp[1]);
109 len = cp[1];
110 if (len < 2)
111 break;
112 }
113 TCHECK2(*cp, len);
114 switch (tt) {
115
116 case IPOPT_SSRR:
117 case IPOPT_LSRR:
118 if (len < 7)
119 break;
120 UNALIGNED_MEMCPY(&retval, cp + len - 4, 4);
121 return retval;
122 }
123 }
124 trunc:
125 UNALIGNED_MEMCPY(&retval, &ip->ip_dst.s_addr, sizeof(u_int32_t));
126 return retval;
127 }
128
129 /*
130 * Compute a V4-style checksum by building a pseudoheader.
131 */
132 int
133 nextproto4_cksum(const struct ip *ip, const u_int8_t *data,
134 u_int len, u_int covlen, u_int next_proto)
135 {
136 struct phdr {
137 u_int32_t src;
138 u_int32_t dst;
139 u_char mbz;
140 u_char proto;
141 u_int16_t len;
142 } ph;
143 struct cksum_vec vec[2];
144
145 /* pseudo-header.. */
146 ph.len = htons((u_int16_t)len);
147 ph.mbz = 0;
148 ph.proto = next_proto;
149 UNALIGNED_MEMCPY(&ph.src, &ip->ip_src.s_addr, sizeof(u_int32_t));
150 if (IP_HL(ip) == 5)
151 UNALIGNED_MEMCPY(&ph.dst, &ip->ip_dst.s_addr, sizeof(u_int32_t));
152 else
153 ph.dst = ip_finddst(ip);
154
155 vec[0].ptr = (const u_int8_t *)(void *)&ph;
156 vec[0].len = sizeof(ph);
157 vec[1].ptr = data;
158 vec[1].len = covlen;
159 return (in_cksum(vec, 2));
160 }
161
162 static void
163 ip_printts(register const u_char *cp, u_int length)
164 {
165 register u_int ptr;
166 register u_int len;
167 int hoplen;
168 const char *type;
169
170 if (length < 4) {
171 printf("[bad length %u]", length);
172 return;
173 }
174 printf(" TS{");
175 hoplen = ((cp[3]&0xF) != IPOPT_TS_TSONLY) ? 8 : 4;
176 if ((length - 4) & (hoplen-1))
177 printf("[bad length %u]", length);
178 ptr = cp[2] - 1;
179 len = 0;
180 if (ptr < 4 || ((ptr - 4) & (hoplen-1)) || ptr > length + 1)
181 printf("[bad ptr %u]", cp[2]);
182 switch (cp[3]&0xF) {
183 case IPOPT_TS_TSONLY:
184 printf("TSONLY");
185 break;
186 case IPOPT_TS_TSANDADDR:
187 printf("TS+ADDR");
188 break;
189 /*
190 * prespecified should really be 3, but some ones might send 2
191 * instead, and the IPOPT_TS_PRESPEC constant can apparently
192 * have both values, so we have to hard-code it here.
193 */
194
195 case 2:
196 printf("PRESPEC2.0");
197 break;
198 case 3: /* IPOPT_TS_PRESPEC */
199 printf("PRESPEC");
200 break;
201 default:
202 printf("[bad ts type %d]", cp[3]&0xF);
203 goto done;
204 }
205
206 type = " ";
207 for (len = 4; len < length; len += hoplen) {
208 if (ptr == len)
209 type = " ^ ";
210 printf("%s%d@%s", type, EXTRACT_32BITS(&cp[len+hoplen-4]),
211 hoplen!=8 ? "" : ipaddr_string(&cp[len]));
212 type = " ";
213 }
214
215 done:
216 printf("%s", ptr == len ? " ^ " : "");
217
218 if (cp[3]>>4)
219 printf(" [%d hops not recorded]} ", cp[3]>>4);
220 else
221 printf("}");
222 }
223
224 /*
225 * print IP options.
226 */
227 static void
228 ip_optprint(register const u_char *cp, u_int length)
229 {
230 register u_int option_len;
231 const char *sep = "";
232
233 for (; length > 0; cp += option_len, length -= option_len) {
234 u_int option_code;
235
236 printf("%s", sep);
237 sep = ",";
238
239 TCHECK(*cp);
240 option_code = *cp;
241
242 printf("%s",
243 tok2str(ip_option_values,"unknown %u",option_code));
244
245 if (option_code == IPOPT_NOP ||
246 option_code == IPOPT_EOL)
247 option_len = 1;
248
249 else {
250 TCHECK(cp[1]);
251 option_len = cp[1];
252 if (option_len < 2) {
253 printf(" [bad length %u]", option_len);
254 return;
255 }
256 }
257
258 if (option_len > length) {
259 printf(" [bad length %u]", option_len);
260 return;
261 }
262
263 TCHECK2(*cp, option_len);
264
265 switch (option_code) {
266 case IPOPT_EOL:
267 return;
268
269 case IPOPT_TS:
270 ip_printts(cp, option_len);
271 break;
272
273 case IPOPT_RR: /* fall through */
274 case IPOPT_SSRR:
275 case IPOPT_LSRR:
276 ip_printroute(cp, option_len);
277 break;
278
279 case IPOPT_RA:
280 if (option_len < 4) {
281 printf(" [bad length %u]", option_len);
282 break;
283 }
284 TCHECK(cp[3]);
285 if (EXTRACT_16BITS(&cp[2]) != 0)
286 printf(" value %u", EXTRACT_16BITS(&cp[2]));
287 break;
288
289 case IPOPT_NOP: /* nothing to print - fall through */
290 case IPOPT_SECURITY:
291 default:
292 break;
293 }
294 }
295 return;
296
297 trunc:
298 printf("%s", tstr);
299 }
300
301 #define IP_RES 0x8000
302
303 static const struct tok ip_frag_values[] = {
304 { IP_MF, "+" },
305 { IP_DF, "DF" },
306 { IP_RES, "rsvd" }, /* The RFC3514 evil ;-) bit */
307 { 0, NULL }
308 };
309
310 struct ip_print_demux_state {
311 const struct ip *ip;
312 const u_char *cp;
313 u_int len, off;
314 u_char nh;
315 int advance;
316 };
317
318 static void
319 ip_print_demux(netdissect_options *ndo,
320 struct ip_print_demux_state *ipds)
321 {
322 struct protoent *proto;
323 struct cksum_vec vec[1];
324
325 again:
326 switch (ipds->nh) {
327
328 case IPPROTO_AH:
329 ipds->nh = *ipds->cp;
330 ipds->advance = ah_print(gndo, ipds->cp);
331 if (ipds->advance <= 0)
332 break;
333 ipds->cp += ipds->advance;
334 ipds->len -= ipds->advance;
335 goto again;
336
337 case IPPROTO_ESP:
338 {
339 int enh, padlen;
340 ipds->advance = esp_print(ndo, ipds->cp, ipds->len,
341 (const u_char *)ipds->ip,
342 &enh, &padlen);
343 if (ipds->advance <= 0)
344 break;
345 ipds->cp += ipds->advance;
346 ipds->len -= ipds->advance + padlen;
347 ipds->nh = enh & 0xff;
348 goto again;
349 }
350
351 case IPPROTO_IPCOMP:
352 {
353 int enh;
354 ipds->advance = ipcomp_print(ipds->cp, &enh);
355 if (ipds->advance <= 0)
356 break;
357 ipds->cp += ipds->advance;
358 ipds->len -= ipds->advance;
359 ipds->nh = enh & 0xff;
360 goto again;
361 }
362
363 case IPPROTO_SCTP:
364 sctp_print(ipds->cp, (const u_char *)ipds->ip, ipds->len);
365 break;
366
367 case IPPROTO_DCCP:
368 dccp_print(ipds->cp, (const u_char *)ipds->ip, ipds->len);
369 break;
370
371 case IPPROTO_TCP:
372 /* pass on the MF bit plus the offset to detect fragments */
373 tcp_print(ipds->cp, ipds->len, (const u_char *)ipds->ip,
374 ipds->off & (IP_MF|IP_OFFMASK));
375 break;
376
377 case IPPROTO_UDP:
378 /* pass on the MF bit plus the offset to detect fragments */
379 udp_print(ipds->cp, ipds->len, (const u_char *)ipds->ip,
380 ipds->off & (IP_MF|IP_OFFMASK));
381 break;
382
383 case IPPROTO_ICMP:
384 /* pass on the MF bit plus the offset to detect fragments */
385 icmp_print(ipds->cp, ipds->len, (const u_char *)ipds->ip,
386 ipds->off & (IP_MF|IP_OFFMASK));
387 break;
388
389 case IPPROTO_PIGP:
390 /*
391 * XXX - the current IANA protocol number assignments
392 * page lists 9 as "any private interior gateway
393 * (used by Cisco for their IGRP)" and 88 as
394 * "EIGRP" from Cisco.
395 *
396 * Recent BSD <netinet/in.h> headers define
397 * IP_PROTO_PIGP as 9 and IP_PROTO_IGRP as 88.
398 * We define IP_PROTO_PIGP as 9 and
399 * IP_PROTO_EIGRP as 88; those names better
400 * match was the current protocol number
401 * assignments say.
402 */
403 igrp_print(ipds->cp, ipds->len, (const u_char *)ipds->ip);
404 break;
405
406 case IPPROTO_EIGRP:
407 eigrp_print(ipds->cp, ipds->len);
408 break;
409
410 case IPPROTO_ND:
411 ND_PRINT((ndo, " nd %d", ipds->len));
412 break;
413
414 case IPPROTO_EGP:
415 egp_print(ipds->cp, ipds->len);
416 break;
417
418 case IPPROTO_OSPF:
419 ospf_print(ipds->cp, ipds->len, (const u_char *)ipds->ip);
420 break;
421
422 case IPPROTO_IGMP:
423 igmp_print(ipds->cp, ipds->len);
424 break;
425
426 case IPPROTO_IPV4:
427 /* DVMRP multicast tunnel (ip-in-ip encapsulation) */
428 ip_print(ndo, ipds->cp, ipds->len);
429 if (! vflag) {
430 ND_PRINT((ndo, " (ipip-proto-4)"));
431 return;
432 }
433 break;
434
435 #ifdef INET6
436 case IPPROTO_IPV6:
437 /* ip6-in-ip encapsulation */
438 ip6_print(ndo, ipds->cp, ipds->len);
439 break;
440 #endif /*INET6*/
441
442 case IPPROTO_RSVP:
443 rsvp_print(ipds->cp, ipds->len);
444 break;
445
446 case IPPROTO_GRE:
447 /* do it */
448 gre_print(ipds->cp, ipds->len);
449 break;
450
451 case IPPROTO_MOBILE:
452 mobile_print(ipds->cp, ipds->len);
453 break;
454
455 case IPPROTO_PIM:
456 vec[0].ptr = ipds->cp;
457 vec[0].len = ipds->len;
458 pim_print(ipds->cp, ipds->len, in_cksum(vec, 1));
459 break;
460
461 case IPPROTO_VRRP:
462 if (packettype == PT_CARP) {
463 if (vflag)
464 (void)printf("carp %s > %s: ",
465 ipaddr_string(&ipds->ip->ip_src),
466 ipaddr_string(&ipds->ip->ip_dst));
467 carp_print(ndo, ipds->cp, ipds->len, ipds->ip->ip_ttl);
468 } else {
469 if (vflag)
470 (void)printf("vrrp %s > %s: ",
471 ipaddr_string(&ipds->ip->ip_src),
472 ipaddr_string(&ipds->ip->ip_dst));
473 vrrp_print(ipds->cp, ipds->len, ipds->ip->ip_ttl);
474 }
475 break;
476
477 case IPPROTO_PGM:
478 pgm_print(ipds->cp, ipds->len, (const u_char *)ipds->ip);
479 break;
480
481 default:
482 if (ndo->ndo_nflag==0 && (proto = getprotobynumber(ipds->nh)) != NULL)
483 ND_PRINT((ndo, " %s", proto->p_name));
484 else
485 ND_PRINT((ndo, " ip-proto-%d", ipds->nh));
486 ND_PRINT((ndo, " %d", ipds->len));
487 break;
488 }
489 }
490
491 void
492 ip_print_inner(netdissect_options *ndo,
493 const u_char *bp,
494 u_int length, u_int nh,
495 const u_char *bp2)
496 {
497 struct ip_print_demux_state ipd;
498
499 ipd.ip = (const struct ip *)bp2;
500 ipd.cp = bp;
501 ipd.len = length;
502 ipd.off = 0;
503 ipd.nh = nh;
504 ipd.advance = 0;
505
506 ip_print_demux(ndo, &ipd);
507 }
508
509
510 /*
511 * print an IP datagram.
512 */
513 void
514 ip_print(netdissect_options *ndo,
515 const u_char *bp,
516 u_int length)
517 {
518 struct ip_print_demux_state ipd;
519 struct ip_print_demux_state *ipds=&ipd;
520 const u_char *ipend;
521 u_int hlen;
522 struct cksum_vec vec[1];
523 u_int16_t sum, ip_sum;
524 struct protoent *proto;
525
526 ipds->ip = (const struct ip *)bp;
527 if (IP_V(ipds->ip) != 4) { /* print version if != 4 */
528 printf("IP%u ", IP_V(ipds->ip));
529 if (IP_V(ipds->ip) == 6)
530 printf(", wrong link-layer encapsulation");
531 }
532 else if (!eflag)
533 printf("IP ");
534
535 if ((u_char *)(ipds->ip + 1) > ndo->ndo_snapend) {
536 printf("%s", tstr);
537 return;
538 }
539 if (length < sizeof (struct ip)) {
540 (void)printf("truncated-ip %u", length);
541 return;
542 }
543 hlen = IP_HL(ipds->ip) * 4;
544 if (hlen < sizeof (struct ip)) {
545 (void)printf("bad-hlen %u", hlen);
546 return;
547 }
548
549 ipds->len = EXTRACT_16BITS(&ipds->ip->ip_len);
550 if (length < ipds->len)
551 (void)printf("truncated-ip - %u bytes missing! ",
552 ipds->len - length);
553 if (ipds->len < hlen) {
554 #ifdef GUESS_TSO
555 if (ipds->len) {
556 (void)printf("bad-len %u", ipds->len);
557 return;
558 }
559 else {
560 /* we guess that it is a TSO send */
561 ipds->len = length;
562 }
563 #else
564 (void)printf("bad-len %u", ipds->len);
565 return;
566 #endif /* GUESS_TSO */
567 }
568
569 /*
570 * Cut off the snapshot length to the end of the IP payload.
571 */
572 ipend = bp + ipds->len;
573 if (ipend < ndo->ndo_snapend)
574 ndo->ndo_snapend = ipend;
575
576 ipds->len -= hlen;
577
578 ipds->off = EXTRACT_16BITS(&ipds->ip->ip_off);
579
580 if (vflag) {
581 (void)printf("(tos 0x%x", (int)ipds->ip->ip_tos);
582 /* ECN bits */
583 if (ipds->ip->ip_tos & 0x03) {
584 switch (ipds->ip->ip_tos & 0x03) {
585 case 1:
586 (void)printf(",ECT(1)");
587 break;
588 case 2:
589 (void)printf(",ECT(0)");
590 break;
591 case 3:
592 (void)printf(",CE");
593 }
594 }
595
596 if (ipds->ip->ip_ttl >= 1)
597 (void)printf(", ttl %u", ipds->ip->ip_ttl);
598
599 /*
600 * for the firewall guys, print id, offset.
601 * On all but the last stick a "+" in the flags portion.
602 * For unfragmented datagrams, note the don't fragment flag.
603 */
604
605 (void)printf(", id %u, offset %u, flags [%s], proto %s (%u)",
606 EXTRACT_16BITS(&ipds->ip->ip_id),
607 (ipds->off & 0x1fff) * 8,
608 bittok2str(ip_frag_values, "none", ipds->off&0xe000),
609 tok2str(ipproto_values,"unknown",ipds->ip->ip_p),
610 ipds->ip->ip_p);
611
612 (void)printf(", length %u", EXTRACT_16BITS(&ipds->ip->ip_len));
613
614 if ((hlen - sizeof(struct ip)) > 0) {
615 printf(", options (");
616 ip_optprint((u_char *)(ipds->ip + 1), hlen - sizeof(struct ip));
617 printf(")");
618 }
619
620 if (!Kflag && (u_char *)ipds->ip + hlen <= ndo->ndo_snapend) {
621 vec[0].ptr = (const u_int8_t *)(void *)ipds->ip;
622 vec[0].len = hlen;
623 sum = in_cksum(vec, 1);
624 if (sum != 0) {
625 ip_sum = EXTRACT_16BITS(&ipds->ip->ip_sum);
626 (void)printf(", bad cksum %x (->%x)!", ip_sum,
627 in_cksum_shouldbe(ip_sum, sum));
628 }
629 }
630
631 printf(")\n ");
632 }
633
634 /*
635 * If this is fragment zero, hand it to the next higher
636 * level protocol.
637 */
638 if ((ipds->off & 0x1fff) == 0) {
639 ipds->cp = (const u_char *)ipds->ip + hlen;
640 ipds->nh = ipds->ip->ip_p;
641
642 if (ipds->nh != IPPROTO_TCP && ipds->nh != IPPROTO_UDP &&
643 ipds->nh != IPPROTO_SCTP && ipds->nh != IPPROTO_DCCP) {
644 (void)printf("%s > %s: ",
645 ipaddr_string(&ipds->ip->ip_src),
646 ipaddr_string(&ipds->ip->ip_dst));
647 }
648 ip_print_demux(ndo, ipds);
649 } else {
650 /* Ultra quiet now means that all this stuff should be suppressed */
651 if (qflag > 1) return;
652
653 /*
654 * if this isn't the first frag, we're missing the
655 * next level protocol header. print the ip addr
656 * and the protocol.
657 */
658 if (ipds->off & 0x1fff) {
659 (void)printf("%s > %s:", ipaddr_string(&ipds->ip->ip_src),
660 ipaddr_string(&ipds->ip->ip_dst));
661 if (!ndo->ndo_nflag && (proto = getprotobynumber(ipds->ip->ip_p)) != NULL)
662 (void)printf(" %s", proto->p_name);
663 else
664 (void)printf(" ip-proto-%d", ipds->ip->ip_p);
665 }
666 }
667 }
668
669 void
670 ipN_print(register const u_char *bp, register u_int length)
671 {
672 struct ip hdr;
673
674 if (length < 4) {
675 (void)printf("truncated-ip %d", length);
676 return;
677 }
678 memcpy (&hdr, bp, 4);
679 switch (IP_V(&hdr)) {
680 case 4:
681 ip_print (gndo, bp, length);
682 return;
683 #ifdef INET6
684 case 6:
685 ip6_print (gndo, bp, length);
686 return;
687 #endif
688 default:
689 (void)printf("unknown ip %d", IP_V(&hdr));
690 return;
691 }
692 }
693
694 /*
695 * Local Variables:
696 * c-style: whitesmith
697 * c-basic-offset: 8
698 * End:
699 */
700
701