]> The Tcpdump Group git mirrors - tcpdump/blob - print-ip.c
NDOize BOOTP, DHCPv6, DNS, PIM and sFlow decoders
[tcpdump] / print-ip.c
1 /*
2 * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997
3 * The Regents of the University of California. All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
16 * written permission.
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
20 */
21
22 #ifdef HAVE_CONFIG_H
23 #include "config.h"
24 #endif
25
26 #include <tcpdump-stdinc.h>
27
28 #include <stdio.h>
29 #include <stdlib.h>
30 #include <string.h>
31
32 #include "addrtoname.h"
33 #include "interface.h"
34 #include "extract.h" /* must come after interface.h */
35
36 #include "ip.h"
37 #include "ipproto.h"
38
39 static const char tstr[] = "[|ip]";
40
41 static const struct tok ip_option_values[] = {
42 { IPOPT_EOL, "EOL" },
43 { IPOPT_NOP, "NOP" },
44 { IPOPT_TS, "timestamp" },
45 { IPOPT_SECURITY, "security" },
46 { IPOPT_RR, "RR" },
47 { IPOPT_SSRR, "SSRR" },
48 { IPOPT_LSRR, "LSRR" },
49 { IPOPT_RA, "RA" },
50 { IPOPT_RFC1393, "traceroute" },
51 { 0, NULL }
52 };
53
54 /*
55 * print the recorded route in an IP RR, LSRR or SSRR option.
56 */
57 static void
58 ip_printroute(register const u_char *cp, u_int length)
59 {
60 register u_int ptr;
61 register u_int len;
62
63 if (length < 3) {
64 printf(" [bad length %u]", length);
65 return;
66 }
67 if ((length + 1) & 3)
68 printf(" [bad length %u]", length);
69 ptr = cp[2] - 1;
70 if (ptr < 3 || ((ptr + 1) & 3) || ptr > length + 1)
71 printf(" [bad ptr %u]", cp[2]);
72
73 for (len = 3; len < length; len += 4) {
74 printf(" %s", ipaddr_string(&cp[len]));
75 if (ptr > len)
76 printf(",");
77 }
78 }
79
80 /*
81 * If source-routing is present and valid, return the final destination.
82 * Otherwise, return IP destination.
83 *
84 * This is used for UDP and TCP pseudo-header in the checksum
85 * calculation.
86 */
87 static u_int32_t
88 ip_finddst(const struct ip *ip)
89 {
90 int length;
91 int len;
92 const u_char *cp;
93 u_int32_t retval;
94
95 cp = (const u_char *)(ip + 1);
96 length = (IP_HL(ip) << 2) - sizeof(struct ip);
97
98 for (; length > 0; cp += len, length -= len) {
99 int tt;
100
101 TCHECK(*cp);
102 tt = *cp;
103 if (tt == IPOPT_EOL)
104 break;
105 else if (tt == IPOPT_NOP)
106 len = 1;
107 else {
108 TCHECK(cp[1]);
109 len = cp[1];
110 if (len < 2)
111 break;
112 }
113 TCHECK2(*cp, len);
114 switch (tt) {
115
116 case IPOPT_SSRR:
117 case IPOPT_LSRR:
118 if (len < 7)
119 break;
120 UNALIGNED_MEMCPY(&retval, cp + len - 4, 4);
121 return retval;
122 }
123 }
124 trunc:
125 UNALIGNED_MEMCPY(&retval, &ip->ip_dst.s_addr, sizeof(u_int32_t));
126 return retval;
127 }
128
129 /*
130 * Compute a V4-style checksum by building a pseudoheader.
131 */
132 int
133 nextproto4_cksum(const struct ip *ip, const u_int8_t *data,
134 u_int len, u_int covlen, u_int next_proto)
135 {
136 struct phdr {
137 u_int32_t src;
138 u_int32_t dst;
139 u_char mbz;
140 u_char proto;
141 u_int16_t len;
142 } ph;
143 struct cksum_vec vec[2];
144
145 /* pseudo-header.. */
146 ph.len = htons((u_int16_t)len);
147 ph.mbz = 0;
148 ph.proto = next_proto;
149 UNALIGNED_MEMCPY(&ph.src, &ip->ip_src.s_addr, sizeof(u_int32_t));
150 if (IP_HL(ip) == 5)
151 UNALIGNED_MEMCPY(&ph.dst, &ip->ip_dst.s_addr, sizeof(u_int32_t));
152 else
153 ph.dst = ip_finddst(ip);
154
155 vec[0].ptr = (const u_int8_t *)(void *)&ph;
156 vec[0].len = sizeof(ph);
157 vec[1].ptr = data;
158 vec[1].len = covlen;
159 return (in_cksum(vec, 2));
160 }
161
162 static void
163 ip_printts(register const u_char *cp, u_int length)
164 {
165 register u_int ptr;
166 register u_int len;
167 int hoplen;
168 const char *type;
169
170 if (length < 4) {
171 printf("[bad length %u]", length);
172 return;
173 }
174 printf(" TS{");
175 hoplen = ((cp[3]&0xF) != IPOPT_TS_TSONLY) ? 8 : 4;
176 if ((length - 4) & (hoplen-1))
177 printf("[bad length %u]", length);
178 ptr = cp[2] - 1;
179 len = 0;
180 if (ptr < 4 || ((ptr - 4) & (hoplen-1)) || ptr > length + 1)
181 printf("[bad ptr %u]", cp[2]);
182 switch (cp[3]&0xF) {
183 case IPOPT_TS_TSONLY:
184 printf("TSONLY");
185 break;
186 case IPOPT_TS_TSANDADDR:
187 printf("TS+ADDR");
188 break;
189 /*
190 * prespecified should really be 3, but some ones might send 2
191 * instead, and the IPOPT_TS_PRESPEC constant can apparently
192 * have both values, so we have to hard-code it here.
193 */
194
195 case 2:
196 printf("PRESPEC2.0");
197 break;
198 case 3: /* IPOPT_TS_PRESPEC */
199 printf("PRESPEC");
200 break;
201 default:
202 printf("[bad ts type %d]", cp[3]&0xF);
203 goto done;
204 }
205
206 type = " ";
207 for (len = 4; len < length; len += hoplen) {
208 if (ptr == len)
209 type = " ^ ";
210 printf("%s%d@%s", type, EXTRACT_32BITS(&cp[len+hoplen-4]),
211 hoplen!=8 ? "" : ipaddr_string(&cp[len]));
212 type = " ";
213 }
214
215 done:
216 printf("%s", ptr == len ? " ^ " : "");
217
218 if (cp[3]>>4)
219 printf(" [%d hops not recorded]} ", cp[3]>>4);
220 else
221 printf("}");
222 }
223
224 /*
225 * print IP options.
226 */
227 static void
228 ip_optprint(register const u_char *cp, u_int length)
229 {
230 register u_int option_len;
231 const char *sep = "";
232
233 for (; length > 0; cp += option_len, length -= option_len) {
234 u_int option_code;
235
236 printf("%s", sep);
237 sep = ",";
238
239 TCHECK(*cp);
240 option_code = *cp;
241
242 printf("%s",
243 tok2str(ip_option_values,"unknown %u",option_code));
244
245 if (option_code == IPOPT_NOP ||
246 option_code == IPOPT_EOL)
247 option_len = 1;
248
249 else {
250 TCHECK(cp[1]);
251 option_len = cp[1];
252 if (option_len < 2) {
253 printf(" [bad length %u]", option_len);
254 return;
255 }
256 }
257
258 if (option_len > length) {
259 printf(" [bad length %u]", option_len);
260 return;
261 }
262
263 TCHECK2(*cp, option_len);
264
265 switch (option_code) {
266 case IPOPT_EOL:
267 return;
268
269 case IPOPT_TS:
270 ip_printts(cp, option_len);
271 break;
272
273 case IPOPT_RR: /* fall through */
274 case IPOPT_SSRR:
275 case IPOPT_LSRR:
276 ip_printroute(cp, option_len);
277 break;
278
279 case IPOPT_RA:
280 if (option_len < 4) {
281 printf(" [bad length %u]", option_len);
282 break;
283 }
284 TCHECK(cp[3]);
285 if (EXTRACT_16BITS(&cp[2]) != 0)
286 printf(" value %u", EXTRACT_16BITS(&cp[2]));
287 break;
288
289 case IPOPT_NOP: /* nothing to print - fall through */
290 case IPOPT_SECURITY:
291 default:
292 break;
293 }
294 }
295 return;
296
297 trunc:
298 printf("%s", tstr);
299 }
300
301 #define IP_RES 0x8000
302
303 static const struct tok ip_frag_values[] = {
304 { IP_MF, "+" },
305 { IP_DF, "DF" },
306 { IP_RES, "rsvd" }, /* The RFC3514 evil ;-) bit */
307 { 0, NULL }
308 };
309
310 struct ip_print_demux_state {
311 const struct ip *ip;
312 const u_char *cp;
313 u_int len, off;
314 u_char nh;
315 int advance;
316 };
317
318 static void
319 ip_print_demux(netdissect_options *ndo,
320 struct ip_print_demux_state *ipds)
321 {
322 struct protoent *proto;
323 struct cksum_vec vec[1];
324
325 again:
326 switch (ipds->nh) {
327
328 case IPPROTO_AH:
329 ipds->nh = *ipds->cp;
330 ipds->advance = ah_print(gndo, ipds->cp);
331 if (ipds->advance <= 0)
332 break;
333 ipds->cp += ipds->advance;
334 ipds->len -= ipds->advance;
335 goto again;
336
337 case IPPROTO_ESP:
338 {
339 int enh, padlen;
340 ipds->advance = esp_print(ndo, ipds->cp, ipds->len,
341 (const u_char *)ipds->ip,
342 &enh, &padlen);
343 if (ipds->advance <= 0)
344 break;
345 ipds->cp += ipds->advance;
346 ipds->len -= ipds->advance + padlen;
347 ipds->nh = enh & 0xff;
348 goto again;
349 }
350
351 case IPPROTO_IPCOMP:
352 {
353 int enh;
354 ipds->advance = ipcomp_print(ndo, ipds->cp, &enh);
355 if (ipds->advance <= 0)
356 break;
357 ipds->cp += ipds->advance;
358 ipds->len -= ipds->advance;
359 ipds->nh = enh & 0xff;
360 goto again;
361 }
362
363 case IPPROTO_SCTP:
364 sctp_print(ipds->cp, (const u_char *)ipds->ip, ipds->len);
365 break;
366
367 case IPPROTO_DCCP:
368 dccp_print(ndo, ipds->cp, (const u_char *)ipds->ip, ipds->len);
369 break;
370
371 case IPPROTO_TCP:
372 /* pass on the MF bit plus the offset to detect fragments */
373 tcp_print(ipds->cp, ipds->len, (const u_char *)ipds->ip,
374 ipds->off & (IP_MF|IP_OFFMASK));
375 break;
376
377 case IPPROTO_UDP:
378 /* pass on the MF bit plus the offset to detect fragments */
379 udp_print(ndo, ipds->cp, ipds->len, (const u_char *)ipds->ip,
380 ipds->off & (IP_MF|IP_OFFMASK));
381 break;
382
383 case IPPROTO_ICMP:
384 /* pass on the MF bit plus the offset to detect fragments */
385 icmp_print(ndo, ipds->cp, ipds->len, (const u_char *)ipds->ip,
386 ipds->off & (IP_MF|IP_OFFMASK));
387 break;
388
389 case IPPROTO_PIGP:
390 /*
391 * XXX - the current IANA protocol number assignments
392 * page lists 9 as "any private interior gateway
393 * (used by Cisco for their IGRP)" and 88 as
394 * "EIGRP" from Cisco.
395 *
396 * Recent BSD <netinet/in.h> headers define
397 * IP_PROTO_PIGP as 9 and IP_PROTO_IGRP as 88.
398 * We define IP_PROTO_PIGP as 9 and
399 * IP_PROTO_EIGRP as 88; those names better
400 * match was the current protocol number
401 * assignments say.
402 */
403 igrp_print(ndo, ipds->cp, ipds->len);
404 break;
405
406 case IPPROTO_EIGRP:
407 eigrp_print(ndo, ipds->cp, ipds->len);
408 break;
409
410 case IPPROTO_ND:
411 ND_PRINT((ndo, " nd %d", ipds->len));
412 break;
413
414 case IPPROTO_EGP:
415 egp_print(ndo, ipds->cp, ipds->len);
416 break;
417
418 case IPPROTO_OSPF:
419 ospf_print(ipds->cp, ipds->len, (const u_char *)ipds->ip);
420 break;
421
422 case IPPROTO_IGMP:
423 igmp_print(ndo, ipds->cp, ipds->len);
424 break;
425
426 case IPPROTO_IPV4:
427 /* DVMRP multicast tunnel (ip-in-ip encapsulation) */
428 ip_print(ndo, ipds->cp, ipds->len);
429 if (! vflag) {
430 ND_PRINT((ndo, " (ipip-proto-4)"));
431 return;
432 }
433 break;
434
435 #ifdef INET6
436 case IPPROTO_IPV6:
437 /* ip6-in-ip encapsulation */
438 ip6_print(ndo, ipds->cp, ipds->len);
439 break;
440 #endif /*INET6*/
441
442 case IPPROTO_RSVP:
443 rsvp_print(ipds->cp, ipds->len);
444 break;
445
446 case IPPROTO_GRE:
447 /* do it */
448 gre_print(ndo, ipds->cp, ipds->len);
449 break;
450
451 case IPPROTO_MOBILE:
452 mobile_print(ndo, ipds->cp, ipds->len);
453 break;
454
455 case IPPROTO_PIM:
456 vec[0].ptr = ipds->cp;
457 vec[0].len = ipds->len;
458 pim_print(ndo, ipds->cp, ipds->len, in_cksum(vec, 1));
459 break;
460
461 case IPPROTO_VRRP:
462 if (packettype == PT_CARP) {
463 if (vflag)
464 (void)printf("carp %s > %s: ",
465 ipaddr_string(&ipds->ip->ip_src),
466 ipaddr_string(&ipds->ip->ip_dst));
467 carp_print(ndo, ipds->cp, ipds->len, ipds->ip->ip_ttl);
468 } else {
469 if (vflag)
470 (void)printf("vrrp %s > %s: ",
471 ipaddr_string(&ipds->ip->ip_src),
472 ipaddr_string(&ipds->ip->ip_dst));
473 vrrp_print(ndo, ipds->cp, ipds->len,
474 (const u_char *)ipds->ip, ipds->ip->ip_ttl);
475 }
476 break;
477
478 case IPPROTO_PGM:
479 pgm_print(ndo, ipds->cp, ipds->len, (const u_char *)ipds->ip);
480 break;
481
482 default:
483 if (ndo->ndo_nflag==0 && (proto = getprotobynumber(ipds->nh)) != NULL)
484 ND_PRINT((ndo, " %s", proto->p_name));
485 else
486 ND_PRINT((ndo, " ip-proto-%d", ipds->nh));
487 ND_PRINT((ndo, " %d", ipds->len));
488 break;
489 }
490 }
491
492 void
493 ip_print_inner(netdissect_options *ndo,
494 const u_char *bp,
495 u_int length, u_int nh,
496 const u_char *bp2)
497 {
498 struct ip_print_demux_state ipd;
499
500 ipd.ip = (const struct ip *)bp2;
501 ipd.cp = bp;
502 ipd.len = length;
503 ipd.off = 0;
504 ipd.nh = nh;
505 ipd.advance = 0;
506
507 ip_print_demux(ndo, &ipd);
508 }
509
510
511 /*
512 * print an IP datagram.
513 */
514 void
515 ip_print(netdissect_options *ndo,
516 const u_char *bp,
517 u_int length)
518 {
519 struct ip_print_demux_state ipd;
520 struct ip_print_demux_state *ipds=&ipd;
521 const u_char *ipend;
522 u_int hlen;
523 struct cksum_vec vec[1];
524 u_int16_t sum, ip_sum;
525 struct protoent *proto;
526
527 ipds->ip = (const struct ip *)bp;
528 if (IP_V(ipds->ip) != 4) { /* print version if != 4 */
529 printf("IP%u ", IP_V(ipds->ip));
530 if (IP_V(ipds->ip) == 6)
531 printf(", wrong link-layer encapsulation");
532 }
533 else if (!eflag)
534 printf("IP ");
535
536 if ((u_char *)(ipds->ip + 1) > ndo->ndo_snapend) {
537 printf("%s", tstr);
538 return;
539 }
540 if (length < sizeof (struct ip)) {
541 (void)printf("truncated-ip %u", length);
542 return;
543 }
544 hlen = IP_HL(ipds->ip) * 4;
545 if (hlen < sizeof (struct ip)) {
546 (void)printf("bad-hlen %u", hlen);
547 return;
548 }
549
550 ipds->len = EXTRACT_16BITS(&ipds->ip->ip_len);
551 if (length < ipds->len)
552 (void)printf("truncated-ip - %u bytes missing! ",
553 ipds->len - length);
554 if (ipds->len < hlen) {
555 #ifdef GUESS_TSO
556 if (ipds->len) {
557 (void)printf("bad-len %u", ipds->len);
558 return;
559 }
560 else {
561 /* we guess that it is a TSO send */
562 ipds->len = length;
563 }
564 #else
565 (void)printf("bad-len %u", ipds->len);
566 return;
567 #endif /* GUESS_TSO */
568 }
569
570 /*
571 * Cut off the snapshot length to the end of the IP payload.
572 */
573 ipend = bp + ipds->len;
574 if (ipend < ndo->ndo_snapend)
575 ndo->ndo_snapend = ipend;
576
577 ipds->len -= hlen;
578
579 ipds->off = EXTRACT_16BITS(&ipds->ip->ip_off);
580
581 if (vflag) {
582 (void)printf("(tos 0x%x", (int)ipds->ip->ip_tos);
583 /* ECN bits */
584 if (ipds->ip->ip_tos & 0x03) {
585 switch (ipds->ip->ip_tos & 0x03) {
586 case 1:
587 (void)printf(",ECT(1)");
588 break;
589 case 2:
590 (void)printf(",ECT(0)");
591 break;
592 case 3:
593 (void)printf(",CE");
594 }
595 }
596
597 if (ipds->ip->ip_ttl >= 1)
598 (void)printf(", ttl %u", ipds->ip->ip_ttl);
599
600 /*
601 * for the firewall guys, print id, offset.
602 * On all but the last stick a "+" in the flags portion.
603 * For unfragmented datagrams, note the don't fragment flag.
604 */
605
606 (void)printf(", id %u, offset %u, flags [%s], proto %s (%u)",
607 EXTRACT_16BITS(&ipds->ip->ip_id),
608 (ipds->off & 0x1fff) * 8,
609 bittok2str(ip_frag_values, "none", ipds->off&0xe000),
610 tok2str(ipproto_values,"unknown",ipds->ip->ip_p),
611 ipds->ip->ip_p);
612
613 (void)printf(", length %u", EXTRACT_16BITS(&ipds->ip->ip_len));
614
615 if ((hlen - sizeof(struct ip)) > 0) {
616 printf(", options (");
617 ip_optprint((u_char *)(ipds->ip + 1), hlen - sizeof(struct ip));
618 printf(")");
619 }
620
621 if (!Kflag && (u_char *)ipds->ip + hlen <= ndo->ndo_snapend) {
622 vec[0].ptr = (const u_int8_t *)(void *)ipds->ip;
623 vec[0].len = hlen;
624 sum = in_cksum(vec, 1);
625 if (sum != 0) {
626 ip_sum = EXTRACT_16BITS(&ipds->ip->ip_sum);
627 (void)printf(", bad cksum %x (->%x)!", ip_sum,
628 in_cksum_shouldbe(ip_sum, sum));
629 }
630 }
631
632 printf(")\n ");
633 }
634
635 /*
636 * If this is fragment zero, hand it to the next higher
637 * level protocol.
638 */
639 if ((ipds->off & 0x1fff) == 0) {
640 ipds->cp = (const u_char *)ipds->ip + hlen;
641 ipds->nh = ipds->ip->ip_p;
642
643 if (ipds->nh != IPPROTO_TCP && ipds->nh != IPPROTO_UDP &&
644 ipds->nh != IPPROTO_SCTP && ipds->nh != IPPROTO_DCCP) {
645 (void)printf("%s > %s: ",
646 ipaddr_string(&ipds->ip->ip_src),
647 ipaddr_string(&ipds->ip->ip_dst));
648 }
649 ip_print_demux(ndo, ipds);
650 } else {
651 /* Ultra quiet now means that all this stuff should be suppressed */
652 if (qflag > 1) return;
653
654 /*
655 * if this isn't the first frag, we're missing the
656 * next level protocol header. print the ip addr
657 * and the protocol.
658 */
659 if (ipds->off & 0x1fff) {
660 (void)printf("%s > %s:", ipaddr_string(&ipds->ip->ip_src),
661 ipaddr_string(&ipds->ip->ip_dst));
662 if (!ndo->ndo_nflag && (proto = getprotobynumber(ipds->ip->ip_p)) != NULL)
663 (void)printf(" %s", proto->p_name);
664 else
665 (void)printf(" ip-proto-%d", ipds->ip->ip_p);
666 }
667 }
668 }
669
670 void
671 ipN_print(netdissect_options *ndo, register const u_char *bp, register u_int length)
672 {
673 struct ip hdr;
674
675 if (length < 4) {
676 (void)printf("truncated-ip %d", length);
677 return;
678 }
679 memcpy (&hdr, bp, 4);
680 switch (IP_V(&hdr)) {
681 case 4:
682 ip_print (ndo, bp, length);
683 return;
684 #ifdef INET6
685 case 6:
686 ip6_print (ndo, bp, length);
687 return;
688 #endif
689 default:
690 (void)printf("unknown ip %d", IP_V(&hdr));
691 return;
692 }
693 }
694
695 /*
696 * Local Variables:
697 * c-style: whitesmith
698 * c-basic-offset: 8
699 * End:
700 */
701
702