The Tcpdump Group git mirrors - tcpdump/blob - print-ip.c

   1 /*
   2  * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997
   3  *      The Regents of the University of California.  All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that: (1) source code distributions
   7  * retain the above copyright notice and this paragraph in its entirety, (2)
   8  * distributions including binary code include the above copyright notice and
   9  * this paragraph in its entirety in the documentation or other materials
  10  * provided with the distribution, and (3) all advertising materials mentioning
  11  * features or use of this software display the following acknowledgement:
  12  * ``This product includes software developed by the University of California,
  13  * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
  14  * the University nor the names of its contributors may be used to endorse
  15  * or promote products derived from this software without specific prior
  16  * written permission.
  17  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
  18  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
  19  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  20  */
  21
  22 /* \summary: IP printer */
  23
  24 #include <config.h>
  25
  26 #include "netdissect-stdinc.h"
  27
  28 #include "netdissect.h"
  29 #include "addrtoname.h"
  30 #include "extract.h"
  31
  32 #include "ip.h"
  33 #include "ipproto.h"
  34
  35
  36 static const struct tok ip_option_values[] = {
  37     { IPOPT_EOL, "EOL" },
  38     { IPOPT_NOP, "NOP" },
  39     { IPOPT_TS, "timestamp" },
  40     { IPOPT_SECURITY, "security" },
  41     { IPOPT_RR, "RR" },
  42     { IPOPT_SSRR, "SSRR" },
  43     { IPOPT_LSRR, "LSRR" },
  44     { IPOPT_RA, "RA" },
  45     { IPOPT_RFC1393, "traceroute" },
  46     { 0, NULL }
  47 };
  48
  49 /*
  50  * print the recorded route in an IP RR, LSRR or SSRR option.
  51  */
  52 static int
  53 ip_printroute(netdissect_options *ndo,
  54               const u_char *cp, u_int length)
  55 {
  56         u_int ptr;
  57         u_int len;
  58
  59         if (length < 3) {
  60                 ND_PRINT(" [bad length %u]", length);
  61                 return (0);
  62         }
  63         if ((length + 1) & 3)
  64                 ND_PRINT(" [bad length %u]", length);
  65         ptr = GET_U_1(cp + 2) - 1;
  66         if (ptr < 3 || ((ptr + 1) & 3) || ptr > length + 1)
  67                 ND_PRINT(" [bad ptr %u]", GET_U_1(cp + 2));
  68
  69         for (len = 3; len < length; len += 4) {
  70                 ND_TCHECK_4(cp + len);  /* Needed to print the IP addresses */
  71                 ND_PRINT(" %s", GET_IPADDR_STRING(cp + len));
  72                 if (ptr > len)
  73                         ND_PRINT(",");
  74         }
  75         return (0);
  76
  77 trunc:
  78         return (-1);
  79 }
  80
  81 /*
  82  * If source-routing is present and valid, return the final destination.
  83  * Otherwise, return IP destination.
  84  *
  85  * This is used for UDP and TCP pseudo-header in the checksum
  86  * calculation.
  87  */
  88 static uint32_t
  89 ip_finddst(netdissect_options *ndo,
  90            const struct ip *ip)
  91 {
  92         u_int length;
  93         u_int len;
  94         const u_char *cp;
  95
  96         cp = (const u_char *)(ip + 1);
  97         length = IP_HL(ip) * 4;
  98         if (length < sizeof(struct ip))
  99                 goto trunc;
 100         length -= sizeof(struct ip);
 101
 102         for (; length != 0; cp += len, length -= len) {
 103                 int tt;
 104
 105                 tt = GET_U_1(cp);
 106                 if (tt == IPOPT_EOL)
 107                         break;
 108                 else if (tt == IPOPT_NOP)
 109                         len = 1;
 110                 else {
 111                         len = GET_U_1(cp + 1);
 112                         if (len < 2)
 113                                 break;
 114                 }
 115                 if (length < len)
 116                         goto trunc;
 117                 ND_TCHECK_LEN(cp, len);
 118                 switch (tt) {
 119
 120                 case IPOPT_SSRR:
 121                 case IPOPT_LSRR:
 122                         if (len < 7)
 123                                 break;
 124                         return (GET_IPV4_TO_NETWORK_ORDER(cp + len - 4));
 125                 }
 126         }
 127 trunc:
 128         return (GET_IPV4_TO_NETWORK_ORDER(ip->ip_dst));
 129 }
 130
 131 /*
 132  * Compute a V4-style checksum by building a pseudoheader.
 133  */
 134 uint16_t
 135 nextproto4_cksum(netdissect_options *ndo,
 136                  const struct ip *ip, const uint8_t *data,
 137                  u_int len, u_int covlen, uint8_t next_proto)
 138 {
 139         struct phdr {
 140                 uint32_t src;
 141                 uint32_t dst;
 142                 uint8_t mbz;
 143                 uint8_t proto;
 144                 uint16_t len;
 145         } ph;
 146         struct cksum_vec vec[2];
 147
 148         /* pseudo-header.. */
 149         ph.len = htons((uint16_t)len);
 150         ph.mbz = 0;
 151         ph.proto = next_proto;
 152         ph.src = GET_IPV4_TO_NETWORK_ORDER(ip->ip_src);
 153         if (IP_HL(ip) == 5)
 154                 ph.dst = GET_IPV4_TO_NETWORK_ORDER(ip->ip_dst);
 155         else
 156                 ph.dst = ip_finddst(ndo, ip);
 157
 158         vec[0].ptr = (const uint8_t *)(void *)&ph;
 159         vec[0].len = sizeof(ph);
 160         vec[1].ptr = data;
 161         vec[1].len = covlen;
 162         return (in_cksum(vec, 2));
 163 }
 164
 165 static int
 166 ip_printts(netdissect_options *ndo,
 167            const u_char *cp, u_int length)
 168 {
 169         u_int ptr;
 170         u_int len;
 171         u_int hoplen;
 172         const char *type;
 173
 174         if (length < 4) {
 175                 ND_PRINT("[bad length %u]", length);
 176                 return (0);
 177         }
 178         ND_PRINT(" TS{");
 179         hoplen = ((GET_U_1(cp + 3) & 0xF) != IPOPT_TS_TSONLY) ? 8 : 4;
 180         if ((length - 4) & (hoplen-1))
 181                 ND_PRINT("[bad length %u]", length);
 182         ptr = GET_U_1(cp + 2) - 1;
 183         len = 0;
 184         if (ptr < 4 || ((ptr - 4) & (hoplen-1)) || ptr > length + 1)
 185                 ND_PRINT("[bad ptr %u]", GET_U_1(cp + 2));
 186         switch (GET_U_1(cp + 3)&0xF) {
 187         case IPOPT_TS_TSONLY:
 188                 ND_PRINT("TSONLY");
 189                 break;
 190         case IPOPT_TS_TSANDADDR:
 191                 ND_PRINT("TS+ADDR");
 192                 break;
 193         case IPOPT_TS_PRESPEC:
 194                 ND_PRINT("PRESPEC");
 195                 break;
 196         default:
 197                 ND_PRINT("[bad ts type %u]", GET_U_1(cp + 3)&0xF);
 198                 goto done;
 199         }
 200
 201         type = " ";
 202         for (len = 4; len < length; len += hoplen) {
 203                 if (ptr == len)
 204                         type = " ^ ";
 205                 ND_TCHECK_LEN(cp + len, hoplen);
 206                 ND_PRINT("%s%u@%s", type, GET_BE_U_4(cp + len + hoplen - 4),
 207                           hoplen!=8 ? "" : GET_IPADDR_STRING(cp + len));
 208                 type = " ";
 209         }
 210
 211 done:
 212         ND_PRINT("%s", ptr == len ? " ^ " : "");
 213
 214         if (GET_U_1(cp + 3) >> 4)
 215                 ND_PRINT(" [%u hops not recorded]} ", GET_U_1(cp + 3)>>4);
 216         else
 217                 ND_PRINT("}");
 218         return (0);
 219
 220 trunc:
 221         return (-1);
 222 }
 223
 224 /*
 225  * print IP options.
 226    If truncated return -1, else 0.
 227  */
 228 static int
 229 ip_optprint(netdissect_options *ndo,
 230             const u_char *cp, u_int length)
 231 {
 232         u_int option_len;
 233         const char *sep = "";
 234
 235         for (; length > 0; cp += option_len, length -= option_len) {
 236                 u_int option_code;
 237
 238                 ND_PRINT("%s", sep);
 239                 sep = ",";
 240
 241                 option_code = GET_U_1(cp);
 242
 243                 ND_PRINT("%s",
 244                           tok2str(ip_option_values,"unknown %u",option_code));
 245
 246                 if (option_code == IPOPT_NOP ||
 247                     option_code == IPOPT_EOL)
 248                         option_len = 1;
 249
 250                 else {
 251                         option_len = GET_U_1(cp + 1);
 252                         if (option_len < 2) {
 253                                 ND_PRINT(" [bad length %u]", option_len);
 254                                 return 0;
 255                         }
 256                 }
 257
 258                 if (option_len > length) {
 259                         ND_PRINT(" [bad length %u]", option_len);
 260                         return 0;
 261                 }
 262
 263                 ND_TCHECK_LEN(cp, option_len);
 264
 265                 switch (option_code) {
 266                 case IPOPT_EOL:
 267                         return 0;
 268
 269                 case IPOPT_TS:
 270                         if (ip_printts(ndo, cp, option_len) == -1)
 271                                 goto trunc;
 272                         break;
 273
 274                 case IPOPT_RR:       /* fall through */
 275                 case IPOPT_SSRR:
 276                 case IPOPT_LSRR:
 277                         if (ip_printroute(ndo, cp, option_len) == -1)
 278                                 goto trunc;
 279                         break;
 280
 281                 case IPOPT_RA:
 282                         if (option_len < 4) {
 283                                 ND_PRINT(" [bad length %u]", option_len);
 284                                 break;
 285                         }
 286                         ND_TCHECK_1(cp + 3);
 287                         if (GET_BE_U_2(cp + 2) != 0)
 288                                 ND_PRINT(" value %u", GET_BE_U_2(cp + 2));
 289                         break;
 290
 291                 case IPOPT_NOP:       /* nothing to print - fall through */
 292                 case IPOPT_SECURITY:
 293                 default:
 294                         break;
 295                 }
 296         }
 297         return 0;
 298
 299 trunc:
 300         return -1;
 301 }
 302
 303 #define IP_RES 0x8000
 304
 305 static const struct tok ip_frag_values[] = {
 306         { IP_MF,        "+" },
 307         { IP_DF,        "DF" },
 308         { IP_RES,       "rsvd" }, /* The RFC3514 evil ;-) bit */
 309         { 0,            NULL }
 310 };
 311
 312
 313 /*
 314  * print an IP datagram.
 315  */
 316 void
 317 ip_print(netdissect_options *ndo,
 318          const u_char *bp,
 319          const u_int length)
 320 {
 321         const struct ip *ip;
 322         u_int off;
 323         u_int hlen;
 324         u_int len;
 325         struct cksum_vec vec[1];
 326         uint8_t ip_tos, ip_ttl, ip_proto;
 327         uint16_t sum, ip_sum;
 328         const char *p_name;
 329         int truncated = 0;
 330         int presumed_tso = 0;
 331
 332         ndo->ndo_protocol = "ip";
 333         ip = (const struct ip *)bp;
 334
 335         if (!ndo->ndo_eflag) {
 336                 nd_print_protocol_caps(ndo);
 337                 ND_PRINT(" ");
 338         }
 339
 340         ND_ICHECK_ZU(length, <, sizeof (struct ip));
 341         ND_ICHECKMSG_U("version", IP_V(ip), !=, 4);
 342
 343         hlen = IP_HL(ip) * 4;
 344         ND_ICHECKMSG_ZU("header length", hlen, <, sizeof (struct ip));
 345
 346         len = GET_BE_U_2(ip->ip_len);
 347         if (len > length) {
 348                 ND_PRINT("[total length %u > length %u]", len, length);
 349                 nd_print_invalid(ndo);
 350                 ND_PRINT(" ");
 351         }
 352         if (len == 0) {
 353                 /* we guess that it is a TSO send */
 354                 len = length;
 355                 presumed_tso = 1;
 356         } else
 357                 ND_ICHECKMSG_U("total length", len, <, hlen);
 358
 359         ND_TCHECK_SIZE(ip);
 360         /*
 361          * Cut off the snapshot length to the end of the IP payload
 362          * or the end of the data in which it's contained, whichever
 363          * comes first.
 364          */
 365         if (!nd_push_snaplen(ndo, bp, ND_MIN(length, len))) {
 366                 (*ndo->ndo_error)(ndo, S_ERR_ND_MEM_ALLOC,
 367                         "%s: can't push snaplen on buffer stack", __func__);
 368         }
 369
 370         len -= hlen;
 371
 372         off = GET_BE_U_2(ip->ip_off);
 373
 374         ip_proto = GET_U_1(ip->ip_p);
 375
 376         if (ndo->ndo_vflag) {
 377             ip_tos = GET_U_1(ip->ip_tos);
 378             ND_PRINT("(tos 0x%x", ip_tos);
 379             /* ECN bits */
 380             switch (ip_tos & 0x03) {
 381
 382             case 0:
 383                 break;
 384
 385             case 1:
 386                 ND_PRINT(",ECT(1)");
 387                 break;
 388
 389             case 2:
 390                 ND_PRINT(",ECT(0)");
 391                 break;
 392
 393             case 3:
 394                 ND_PRINT(",CE");
 395                 break;
 396             }
 397
 398             ip_ttl = GET_U_1(ip->ip_ttl);
 399             if (ip_ttl >= 1)
 400                 ND_PRINT(", ttl %u", ip_ttl);
 401
 402             /*
 403              * for the firewall guys, print id, offset.
 404              * On all but the last stick a "+" in the flags portion.
 405              * For unfragmented datagrams, note the don't fragment flag.
 406              */
 407             ND_PRINT(", id %u, offset %u, flags [%s], proto %s (%u)",
 408                          GET_BE_U_2(ip->ip_id),
 409                          (off & IP_OFFMASK) * 8,
 410                          bittok2str(ip_frag_values, "none", off & (IP_RES|IP_DF|IP_MF)),
 411                          tok2str(ipproto_values, "unknown", ip_proto),
 412                          ip_proto);
 413
 414             if (presumed_tso)
 415                 ND_PRINT(", length %u [was 0, presumed TSO]", length);
 416             else
 417                 ND_PRINT(", length %u", GET_BE_U_2(ip->ip_len));
 418
 419             if ((hlen > sizeof(struct ip))) {
 420                 ND_PRINT(", options (");
 421                 if (ip_optprint(ndo, (const u_char *)(ip + 1),
 422                     hlen - sizeof(struct ip)) == -1) {
 423                         ND_PRINT(" [truncated-option]");
 424                         truncated = 1;
 425                 }
 426                 ND_PRINT(")");
 427             }
 428
 429             if (!ndo->ndo_Kflag && ND_TTEST_LEN((const u_char *)ip, hlen)) {
 430                 vec[0].ptr = (const uint8_t *)(const void *)ip;
 431                 vec[0].len = hlen;
 432                 sum = in_cksum(vec, 1);
 433                 if (sum != 0) {
 434                     ip_sum = GET_BE_U_2(ip->ip_sum);
 435                     ND_PRINT(", bad cksum %x (->%x)!", ip_sum,
 436                              in_cksum_shouldbe(ip_sum, sum));
 437                 }
 438             }
 439
 440             ND_PRINT(")\n    ");
 441             if (truncated) {
 442                 ND_PRINT("%s > %s: ",
 443                          GET_IPADDR_STRING(ip->ip_src),
 444                          GET_IPADDR_STRING(ip->ip_dst));
 445                 nd_print_trunc(ndo);
 446                 nd_pop_packet_info(ndo);
 447                 return;
 448             }
 449         }
 450
 451         /*
 452          * If this is fragment zero, hand it to the next higher
 453          * level protocol.  Let them know whether there are more
 454          * fragments.
 455          */
 456         if ((off & IP_OFFMASK) == 0) {
 457                 uint8_t nh = GET_U_1(ip->ip_p);
 458
 459                 if (nh != IPPROTO_TCP && nh != IPPROTO_UDP &&
 460                     nh != IPPROTO_SCTP && nh != IPPROTO_DCCP) {
 461                         ND_PRINT("%s > %s: ",
 462                                      GET_IPADDR_STRING(ip->ip_src),
 463                                      GET_IPADDR_STRING(ip->ip_dst));
 464                 }
 465                 /*
 466                  * Do a bounds check before calling ip_demux_print().
 467                  * At least the header data is required.
 468                  */
 469                 if (!ND_TTEST_LEN((const u_char *)ip, hlen)) {
 470                         ND_PRINT(" [remaining caplen(%u) < header length(%u)]",
 471                                  ND_BYTES_AVAILABLE_AFTER((const u_char *)ip),
 472                                  hlen);
 473                         nd_trunc_longjmp(ndo);
 474                 }
 475                 ip_demux_print(ndo, (const u_char *)ip + hlen, len, 4,
 476                                off & IP_MF, GET_U_1(ip->ip_ttl), nh, bp);
 477         } else {
 478                 /*
 479                  * Ultra quiet now means that all this stuff should be
 480                  * suppressed.
 481                  */
 482                 if (ndo->ndo_qflag > 1) {
 483                         nd_pop_packet_info(ndo);
 484                         return;
 485                 }
 486
 487                 /*
 488                  * This isn't the first frag, so we're missing the
 489                  * next level protocol header.  print the ip addr
 490                  * and the protocol.
 491                  */
 492                 ND_PRINT("%s > %s:", GET_IPADDR_STRING(ip->ip_src),
 493                           GET_IPADDR_STRING(ip->ip_dst));
 494                 if (!ndo->ndo_nflag && (p_name = netdb_protoname(ip_proto)) != NULL)
 495                         ND_PRINT(" %s", p_name);
 496                 else
 497                         ND_PRINT(" ip-proto-%u", ip_proto);
 498         }
 499         nd_pop_packet_info(ndo);
 500         return;
 501
 502 trunc:
 503         nd_print_trunc(ndo);
 504         return;
 505
 506 invalid:
 507         nd_print_invalid(ndo);
 508 }
 509
 510 void
 511 ipN_print(netdissect_options *ndo, const u_char *bp, u_int length)
 512 {
 513         ndo->ndo_protocol = "ipn";
 514         if (length < 1) {
 515                 ND_PRINT("truncated-ip %u", length);
 516                 return;
 517         }
 518
 519         switch (GET_U_1(bp) & 0xF0) {
 520         case 0x40:
 521                 ip_print(ndo, bp, length);
 522                 break;
 523         case 0x60:
 524                 ip6_print(ndo, bp, length);
 525                 break;
 526         default:
 527                 ND_PRINT("unknown ip %u", (GET_U_1(bp) & 0xF0) >> 4);
 528                 break;
 529         }
 530 }