]> The Tcpdump Group git mirrors - tcpdump/blob - print-tcp.c
projects / tcpdump / blob


536fd57ac09395e4081c14a7fab55baa7ccd3f65
[tcpdump] / print-tcp.c
1 /*
2 * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997
3 * The Regents of the University of California. All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
16 * written permission.
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
20 */
21
22 #ifndef lint
23 static const char rcsid[] =
24 "@(#) $Header: /tcpdump/master/tcpdump/print-tcp.c,v 1.102 2002-09-05 00:00:22 guy Exp $ (LBL)";
25 #endif
26
27 #ifdef HAVE_CONFIG_H
28 #include "config.h"
29 #endif
30
31 #include <tcpdump-stdinc.h>
32
33 #include <rpc/rpc.h>
34
35 #include <stdio.h>
36 #include <stdlib.h>
37 #include <string.h>
38
39 #include "interface.h"
40 #include "addrtoname.h"
41 #include "extract.h"
42
43 #include "tcp.h"
44
45 #include "ip.h"
46 #ifdef INET6
47 #include "ip6.h"
48 #endif
49
50 #include "nameser.h"
51
52 static void print_tcp_rst_data(register const u_char *sp, u_int length);
53
54 #define MAX_RST_DATA_LEN 30
55
56
57 struct tha {
58 #ifndef INET6
59 struct in_addr src;
60 struct in_addr dst;
61 #else
62 struct in6_addr src;
63 struct in6_addr dst;
64 #endif /*INET6*/
65 u_int port;
66 };
67
68 struct tcp_seq_hash {
69 struct tcp_seq_hash *nxt;
70 struct tha addr;
71 tcp_seq seq;
72 tcp_seq ack;
73 };
74
75 #define TSEQ_HASHSIZE 919
76
77 /* These tcp optinos do not have the size octet */
78 #define ZEROLENOPT(o) ((o) == TCPOPT_EOL || (o) == TCPOPT_NOP)
79
80 static struct tcp_seq_hash tcp_seq_hash[TSEQ_HASHSIZE];
81
82
83 #ifndef TELNET_PORT
84 #define TELNET_PORT 23
85 #endif
86 #ifndef BGP_PORT
87 #define BGP_PORT 179
88 #endif
89 #define NETBIOS_SSN_PORT 139
90 #ifndef PPTP_PORT
91 #define PPTP_PORT 1723
92 #endif
93 #define BEEP_PORT 10288
94 #ifndef NFS_PORT
95 #define NFS_PORT 2049
96 #endif
97 #define MSDP_PORT 639
98 #define LDP_PORT 646
99
100 static int tcp_cksum(register const struct ip *ip,
101 register const struct tcphdr *tp,
102 register int len)
103 {
104 union phu {
105 struct phdr {
106 u_int32_t src;
107 u_int32_t dst;
108 u_char mbz;
109 u_char proto;
110 u_int16_t len;
111 } ph;
112 u_int16_t pa[6];
113 } phu;
114 const u_int16_t *sp;
115
116 /* pseudo-header.. */
117 phu.ph.len = htons(len); /* XXX */
118 phu.ph.mbz = 0;
119 phu.ph.proto = IPPROTO_TCP;
120 memcpy(&phu.ph.src, &ip->ip_src.s_addr, sizeof(u_int32_t));
121 if (IP_HL(ip) == 5)
122 memcpy(&phu.ph.dst, &ip->ip_dst.s_addr, sizeof(u_int32_t));
123 else
124 phu.ph.dst = ip_finddst(ip);
125
126 sp = &phu.pa[0];
127 return in_cksum((u_short *)tp, len,
128 sp[0]+sp[1]+sp[2]+sp[3]+sp[4]+sp[5]);
129 }
130
131 #ifdef INET6
132 static int tcp6_cksum(const struct ip6_hdr *ip6, const struct tcphdr *tp,
133 int len)
134 {
135 int i, tlen;
136 register const u_int16_t *sp;
137 u_int32_t sum;
138 union {
139 struct {
140 struct in6_addr ph_src;
141 struct in6_addr ph_dst;
142 u_int32_t ph_len;
143 u_int8_t ph_zero[3];
144 u_int8_t ph_nxt;
145 } ph;
146 u_int16_t pa[20];
147 } phu;
148
149 tlen = ntohs(ip6->ip6_plen) + sizeof(struct ip6_hdr) -
150 ((const char *)tp - (const char*)ip6);
151
152 /* pseudo-header */
153 memset(&phu, 0, sizeof(phu));
154 phu.ph.ph_src = ip6->ip6_src;
155 phu.ph.ph_dst = ip6->ip6_dst;
156 phu.ph.ph_len = htonl(tlen);
157 phu.ph.ph_nxt = IPPROTO_TCP;
158
159 sum = 0;
160 for (i = 0; i < sizeof(phu.pa) / sizeof(phu.pa[0]); i++)
161 sum += phu.pa[i];
162
163 sp = (const u_int16_t *)tp;
164
165 for (i = 0; i < (tlen & ~1); i += 2)
166 sum += *sp++;
167
168 if (tlen & 1)
169 sum += htons((*(const u_int8_t *)sp) << 8);
170
171 while (sum > 0xffff)
172 sum = (sum & 0xffff) + (sum >> 16);
173 sum = ~sum & 0xffff;
174
175 return (sum);
176 }
177 #endif
178
179 void
180 tcp_print(register const u_char *bp, register u_int length,
181 register const u_char *bp2, int fragmented)
182 {
183 register const struct tcphdr *tp;
184 register const struct ip *ip;
185 register u_char flags;
186 register u_int hlen;
187 register char ch;
188 u_int16_t sport, dport, win, urp;
189 u_int32_t seq, ack, thseq, thack;
190 int threv;
191 #ifdef INET6
192 register const struct ip6_hdr *ip6;
193 #endif
194
195 tp = (struct tcphdr *)bp;
196 ip = (struct ip *)bp2;
197 #ifdef INET6
198 if (IP_V(ip) == 6)
199 ip6 = (struct ip6_hdr *)bp2;
200 else
201 ip6 = NULL;
202 #endif /*INET6*/
203 ch = '\0';
204 if (!TTEST(tp->th_dport)) {
205 (void)printf("%s > %s: [|tcp]",
206 ipaddr_string(&ip->ip_src),
207 ipaddr_string(&ip->ip_dst));
208 return;
209 }
210
211 sport = ntohs(tp->th_sport);
212 dport = ntohs(tp->th_dport);
213
214 hlen = TH_OFF(tp) * 4;
215
216 /*
217 * If data present and NFS port used, assume NFS.
218 * Pass offset of data plus 4 bytes for RPC TCP msg length
219 * to NFS print routines.
220 */
221 if (!qflag) {
222 if ((u_char *)tp + 4 + sizeof(struct rpc_msg) <= snapend &&
223 dport == NFS_PORT) {
224 nfsreq_print((u_char *)tp + hlen + 4, length - hlen,
225 (u_char *)ip);
226 return;
227 } else if ((u_char *)tp + 4 + sizeof(struct rpc_msg)
228 <= snapend &&
229 sport == NFS_PORT) {
230 nfsreply_print((u_char *)tp + hlen + 4, length - hlen,
231 (u_char *)ip);
232 return;
233 }
234 }
235 #ifdef INET6
236 if (ip6) {
237 if (ip6->ip6_nxt == IPPROTO_TCP) {
238 (void)printf("%s.%s > %s.%s: ",
239 ip6addr_string(&ip6->ip6_src),
240 tcpport_string(sport),
241 ip6addr_string(&ip6->ip6_dst),
242 tcpport_string(dport));
243 } else {
244 (void)printf("%s > %s: ",
245 tcpport_string(sport), tcpport_string(dport));
246 }
247 } else
248 #endif /*INET6*/
249 {
250 if (ip->ip_p == IPPROTO_TCP) {
251 (void)printf("%s.%s > %s.%s: ",
252 ipaddr_string(&ip->ip_src),
253 tcpport_string(sport),
254 ipaddr_string(&ip->ip_dst),
255 tcpport_string(dport));
256 } else {
257 (void)printf("%s > %s: ",
258 tcpport_string(sport), tcpport_string(dport));
259 }
260 }
261
262 TCHECK(*tp);
263
264 seq = (u_int32_t)ntohl(tp->th_seq);
265 ack = (u_int32_t)ntohl(tp->th_ack);
266 win = ntohs(tp->th_win);
267 urp = ntohs(tp->th_urp);
268
269 if (qflag) {
270 (void)printf("tcp %d", length - TH_OFF(tp) * 4);
271 return;
272 }
273 if ((flags = tp->th_flags) & (TH_SYN|TH_FIN|TH_RST|TH_PUSH|
274 TH_ECNECHO|TH_CWR)) {
275 if (flags & TH_SYN)
276 putchar('S');
277 if (flags & TH_FIN)
278 putchar('F');
279 if (flags & TH_RST)
280 putchar('R');
281 if (flags & TH_PUSH)
282 putchar('P');
283 if (flags & TH_CWR)
284 putchar('W'); /* congestion _W_indow reduced (ECN) */
285 if (flags & TH_ECNECHO)
286 putchar('E'); /* ecn _E_cho sent (ECN) */
287 } else
288 putchar('.');
289
290 if (!Sflag && (flags & TH_ACK)) {
291 register struct tcp_seq_hash *th;
292 register int rev;
293 struct tha tha;
294 /*
295 * Find (or record) the initial sequence numbers for
296 * this conversation. (we pick an arbitrary
297 * collating order so there's only one entry for
298 * both directions).
299 */
300 #ifdef INET6
301 memset(&tha, 0, sizeof(tha));
302 rev = 0;
303 if (ip6) {
304 if (sport > dport)
305 rev = 1;
306 else if (sport == dport) {
307 int i;
308
309 for (i = 0; i < 4; i++) {
310 if (((u_int32_t *)(&ip6->ip6_src))[i] >
311 ((u_int32_t *)(&ip6->ip6_dst))[i]) {
312 rev = 1;
313 break;
314 }
315 }
316 }
317 if (rev) {
318 tha.src = ip6->ip6_dst;
319 tha.dst = ip6->ip6_src;
320 tha.port = dport << 16 | sport;
321 } else {
322 tha.dst = ip6->ip6_dst;
323 tha.src = ip6->ip6_src;
324 tha.port = sport << 16 | dport;
325 }
326 } else {
327 if (sport > dport ||
328 (sport == dport &&
329 ip->ip_src.s_addr > ip->ip_dst.s_addr)) {
330 rev = 1;
331 }
332 if (rev) {
333 *(struct in_addr *)&tha.src = ip->ip_dst;
334 *(struct in_addr *)&tha.dst = ip->ip_src;
335 tha.port = dport << 16 | sport;
336 } else {
337 *(struct in_addr *)&tha.dst = ip->ip_dst;
338 *(struct in_addr *)&tha.src = ip->ip_src;
339 tha.port = sport << 16 | dport;
340 }
341 }
342 #else
343 if (sport < dport ||
344 (sport == dport &&
345 ip->ip_src.s_addr < ip->ip_dst.s_addr)) {
346 tha.src = ip->ip_src, tha.dst = ip->ip_dst;
347 tha.port = sport << 16 | dport;
348 rev = 0;
349 } else {
350 tha.src = ip->ip_dst, tha.dst = ip->ip_src;
351 tha.port = dport << 16 | sport;
352 rev = 1;
353 }
354 #endif
355
356 threv = rev;
357 for (th = &tcp_seq_hash[tha.port % TSEQ_HASHSIZE];
358 th->nxt; th = th->nxt)
359 if (!memcmp((char *)&tha, (char *)&th->addr,
360 sizeof(th->addr)))
361 break;
362
363 if (!th->nxt || (flags & TH_SYN)) {
364 /* didn't find it or new conversation */
365 if (th->nxt == NULL) {
366 th->nxt = (struct tcp_seq_hash *)
367 calloc(1, sizeof(*th));
368 if (th->nxt == NULL)
369 error("tcp_print: calloc");
370 }
371 th->addr = tha;
372 if (rev)
373 th->ack = seq, th->seq = ack - 1;
374 else
375 th->seq = seq, th->ack = ack - 1;
376 } else {
377 if (rev)
378 seq -= th->ack, ack -= th->seq;
379 else
380 seq -= th->seq, ack -= th->ack;
381 }
382
383 thseq = th->seq;
384 thack = th->ack;
385 } else {
386 /*fool gcc*/
387 thseq = thack = threv = 0;
388 }
389 if (hlen > length) {
390 (void)printf(" [bad hdr length]");
391 return;
392 }
393
394 if (IP_V(ip) == 4 && vflag && !fragmented) {
395 u_int16_t sum, tcp_sum;
396 if (TTEST2(tp->th_sport, length)) {
397 sum = tcp_cksum(ip, tp, length);
398 if (sum != 0) {
399 tcp_sum = ntohs(tp->th_sum);
400 (void)printf(" [bad tcp cksum %x (->%x)!]",
401 tcp_sum, in_cksum_shouldbe(tcp_sum, sum));
402 } else
403 (void)printf(" [tcp sum ok]");
404 }
405 }
406 #ifdef INET6
407 if (IP_V(ip) == 6 && ip6->ip6_plen && vflag && !fragmented) {
408 int sum;
409 if (TTEST2(tp->th_sport, length)) {
410 sum = tcp6_cksum(ip6, tp, length);
411 if (sum != 0)
412 (void)printf(" [bad tcp cksum %x!]", sum);
413 else
414 (void)printf(" [tcp sum ok]");
415 }
416 }
417 #endif
418
419 length -= hlen;
420 if (vflag > 1 || length > 0 || flags & (TH_SYN | TH_FIN | TH_RST))
421 (void)printf(" %u:%u(%u)", seq, seq + length, length);
422 if (flags & TH_ACK)
423 (void)printf(" ack %u", ack);
424
425 (void)printf(" win %d", win);
426
427 if (flags & TH_URG)
428 (void)printf(" urg %d", urp);
429 /*
430 * Handle any options.
431 */
432 if (hlen > sizeof(*tp)) {
433 register const u_char *cp;
434 register u_int i, opt, datalen;
435 register u_int len;
436
437 hlen -= sizeof(*tp);
438 cp = (const u_char *)tp + sizeof(*tp);
439 putchar(' ');
440 ch = '<';
441 while (hlen > 0) {
442 putchar(ch);
443 TCHECK(*cp);
444 opt = *cp++;
445 if (ZEROLENOPT(opt))
446 len = 1;
447 else {
448 TCHECK(*cp);
449 len = *cp++; /* total including type, len */
450 if (len < 2 || len > hlen)
451 goto bad;
452 --hlen; /* account for length byte */
453 }
454 --hlen; /* account for type byte */
455 datalen = 0;
456
457 /* Bail if "l" bytes of data are not left or were not captured */
458 #define LENCHECK(l) { if ((l) > hlen) goto bad; TCHECK2(*cp, l); }
459
460 switch (opt) {
461
462 case TCPOPT_MAXSEG:
463 (void)printf("mss");
464 datalen = 2;
465 LENCHECK(datalen);
466 (void)printf(" %u", EXTRACT_16BITS(cp));
467
468 break;
469
470 case TCPOPT_EOL:
471 (void)printf("eol");
472 break;
473
474 case TCPOPT_NOP:
475 (void)printf("nop");
476 break;
477
478 case TCPOPT_WSCALE:
479 (void)printf("wscale");
480 datalen = 1;
481 LENCHECK(datalen);
482 (void)printf(" %u", *cp);
483 break;
484
485 case TCPOPT_SACKOK:
486 (void)printf("sackOK");
487 break;
488
489 case TCPOPT_SACK:
490 (void)printf("sack");
491 datalen = len - 2;
492 if (datalen % 8 != 0) {
493 (void)printf(" malformed sack ");
494 } else {
495 u_int32_t s, e;
496
497 (void)printf(" sack %d ", datalen / 8);
498 for (i = 0; i < datalen; i += 8) {
499 LENCHECK(i + 4);
500 s = EXTRACT_32BITS(cp + i);
501 LENCHECK(i + 8);
502 e = EXTRACT_32BITS(cp + i + 4);
503 if (threv) {
504 s -= thseq;
505 e -= thseq;
506 } else {
507 s -= thack;
508 e -= thack;
509 }
510 (void)printf("{%u:%u}", s, e);
511 }
512 (void)printf(" ");
513 }
514 break;
515
516 case TCPOPT_ECHO:
517 (void)printf("echo");
518 datalen = 4;
519 LENCHECK(datalen);
520 (void)printf(" %u", EXTRACT_32BITS(cp));
521 break;
522
523 case TCPOPT_ECHOREPLY:
524 (void)printf("echoreply");
525 datalen = 4;
526 LENCHECK(datalen);
527 (void)printf(" %u", EXTRACT_32BITS(cp));
528 break;
529
530 case TCPOPT_TIMESTAMP:
531 (void)printf("timestamp");
532 datalen = 8;
533 LENCHECK(4);
534 (void)printf(" %u", EXTRACT_32BITS(cp));
535 LENCHECK(datalen);
536 (void)printf(" %u", EXTRACT_32BITS(cp + 4));
537 break;
538
539 case TCPOPT_CC:
540 (void)printf("cc");
541 datalen = 4;
542 LENCHECK(datalen);
543 (void)printf(" %u", EXTRACT_32BITS(cp));
544 break;
545
546 case TCPOPT_CCNEW:
547 (void)printf("ccnew");
548 datalen = 4;
549 LENCHECK(datalen);
550 (void)printf(" %u", EXTRACT_32BITS(cp));
551 break;
552
553 case TCPOPT_CCECHO:
554 (void)printf("ccecho");
555 datalen = 4;
556 LENCHECK(datalen);
557 (void)printf(" %u", EXTRACT_32BITS(cp));
558 break;
559
560 default:
561 (void)printf("opt-%u:", opt);
562 datalen = len - 2;
563 for (i = 0; i < datalen; ++i) {
564 LENCHECK(i);
565 (void)printf("%02x", cp[i]);
566 }
567 break;
568 }
569
570 /* Account for data printed */
571 cp += datalen;
572 hlen -= datalen;
573
574 /* Check specification against observed length */
575 ++datalen; /* option octet */
576 if (!ZEROLENOPT(opt))
577 ++datalen; /* size octet */
578 if (datalen != len)
579 (void)printf("[len %d]", len);
580 ch = ',';
581 if (opt == TCPOPT_EOL)
582 break;
583 }
584 putchar('>');
585 }
586
587 if (length <= 0)
588 return;
589
590 /*
591 * Decode payload if necessary.
592 */
593 bp += TH_OFF(tp) * 4;
594 if (flags & TH_RST) {
595 if (vflag)
596 print_tcp_rst_data(bp, length);
597 } else {
598 if (sport == TELNET_PORT || dport == TELNET_PORT) {
599 if (!qflag && vflag)
600 telnet_print(bp, length);
601 } else if (sport == BGP_PORT || dport == BGP_PORT)
602 bgp_print(bp, length);
603 else if (sport == PPTP_PORT || dport == PPTP_PORT)
604 pptp_print(bp, length);
605 #ifdef TCPDUMP_DO_SMB
606 else if (sport == NETBIOS_SSN_PORT || dport == NETBIOS_SSN_PORT)
607 nbt_tcp_print(bp, length);
608 #endif
609 else if (sport == BEEP_PORT || dport == BEEP_PORT)
610 beep_print(bp, length);
611 else if (length > 2 &&
612 (sport == NAMESERVER_PORT || dport == NAMESERVER_PORT ||
613 sport == MULTICASTDNS_PORT || dport == MULTICASTDNS_PORT)) {
614 /*
615 * TCP DNS query has 2byte length at the head.
616 * XXX packet could be unaligned, it can go strange
617 */
618 ns_print(bp + 2, length - 2);
619 } else if (sport == MSDP_PORT || dport == MSDP_PORT) {
620 msdp_print(bp, length);
621 }
622 else if (sport == LDP_PORT || dport == LDP_PORT)
623 printf(": LDP, length: %u", length);
624 }
625 return;
626 bad:
627 fputs("[bad opt]", stdout);
628 if (ch != '\0')
629 putchar('>');
630 return;
631 trunc:
632 fputs("[|tcp]", stdout);
633 if (ch != '\0')
634 putchar('>');
635 }
636
637 /*
638 * RFC1122 says the following on data in RST segments:
639 *
640 * 4.2.2.12 RST Segment: RFC-793 Section 3.4
641 *
642 * A TCP SHOULD allow a received RST segment to include data.
643 *
644 * DISCUSSION
645 * It has been suggested that a RST segment could contain
646 * ASCII text that encoded and explained the cause of the
647 * RST. No standard has yet been established for such
648 * data.
649 *
650 */
651
652 static void
653 print_tcp_rst_data(register const u_char *sp, u_int length)
654 {
655 int c;
656
657 if (TTEST2(*sp, length))
658 printf(" [RST");
659 else
660 printf(" [!RST");
661 if (length > MAX_RST_DATA_LEN) {
662 length = MAX_RST_DATA_LEN; /* can use -X for longer */
663 putchar('+'); /* indicate we truncate */
664 }
665 putchar(' ');
666 while (length-- && sp <= snapend) {
667 c = *sp++;
668 safeputchar(c);
669 }
670 putchar(']');
671 }
[mirror] the TCPdump network dissector