]> The Tcpdump Group git mirrors - tcpdump/blob - print-bootp.c
Do more bounds checking.
[tcpdump] / print-bootp.c
1 /*
2 * Copyright (c) 1990, 1991, 1993, 1994, 1995, 1996, 1997
3 * The Regents of the University of California. All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
16 * written permission.
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
20 *
21 * Format and print bootp packets.
22 */
23 #ifndef lint
24 static const char rcsid[] _U_ =
25 "@(#) $Header: /tcpdump/master/tcpdump/print-bootp.c,v 1.80 2005-05-06 04:19:25 guy Exp $ (LBL)";
26 #endif
27
28 #ifdef HAVE_CONFIG_H
29 #include "config.h"
30 #endif
31
32 #include <tcpdump-stdinc.h>
33
34 #include <stdio.h>
35 #include <string.h>
36
37 #include "interface.h"
38 #include "addrtoname.h"
39 #include "extract.h"
40 #include "ether.h"
41 #include "bootp.h"
42
43 static void rfc1048_print(const u_char *);
44 static void cmu_print(const u_char *);
45
46 static char tstr[] = " [|bootp]";
47
48 static const struct tok bootp_flag_values[] = {
49 { 0x8000, "Broadcast" },
50 { 0, NULL}
51 };
52
53 static const struct tok bootp_op_values[] = {
54 { BOOTPREQUEST, "Request" },
55 { BOOTPREPLY, "Reply" },
56 { 0, NULL}
57 };
58
59 /*
60 * Print bootp requests
61 */
62 void
63 bootp_print(register const u_char *cp, u_int length)
64 {
65 register const struct bootp *bp;
66 static const u_char vm_cmu[4] = VM_CMU;
67 static const u_char vm_rfc1048[4] = VM_RFC1048;
68
69 bp = (const struct bootp *)cp;
70 TCHECK(bp->bp_op);
71
72 printf("BOOTP/DHCP, %s",
73 tok2str(bootp_op_values, "unknown (0x%02x)", bp->bp_op));
74
75 if (bp->bp_htype == 1 && bp->bp_hlen == 6 && bp->bp_op == BOOTPREQUEST) {
76 TCHECK2(bp->bp_chaddr[0], 6);
77 printf(" from %s", etheraddr_string(bp->bp_chaddr));
78 }
79
80 printf(", length: %u", length);
81
82 if (!vflag)
83 return;
84
85 TCHECK(bp->bp_secs);
86
87 /* The usual hardware address type is 1 (10Mb Ethernet) */
88 if (bp->bp_htype != 1)
89 printf(", htype-#%d", bp->bp_htype);
90
91 /* The usual length for 10Mb Ethernet address is 6 bytes */
92 if (bp->bp_htype != 1 || bp->bp_hlen != 6)
93 printf(", hlen:%d", bp->bp_hlen);
94
95 /* Only print interesting fields */
96 if (bp->bp_hops)
97 printf(", hops:%d", bp->bp_hops);
98 if (bp->bp_xid)
99 printf(", xid:0x%x", EXTRACT_32BITS(&bp->bp_xid));
100 if (bp->bp_secs)
101 printf(", secs:%d", EXTRACT_16BITS(&bp->bp_secs));
102
103 printf(", flags: [%s]",
104 bittok2str(bootp_flag_values, "none", EXTRACT_16BITS(&bp->bp_flags)));
105 if (vflag>1)
106 printf( " (0x%04x)", EXTRACT_16BITS(&bp->bp_flags));
107
108 /* Client's ip address */
109 TCHECK(bp->bp_ciaddr);
110 if (bp->bp_ciaddr.s_addr)
111 printf("\n\t Client IP: %s", ipaddr_string(&bp->bp_ciaddr));
112
113 /* 'your' ip address (bootp client) */
114 TCHECK(bp->bp_yiaddr);
115 if (bp->bp_yiaddr.s_addr)
116 printf("\n\t Your IP: %s", ipaddr_string(&bp->bp_yiaddr));
117
118 /* Server's ip address */
119 TCHECK(bp->bp_siaddr);
120 if (bp->bp_siaddr.s_addr)
121 printf("\n\t Server IP: %s", ipaddr_string(&bp->bp_siaddr));
122
123 /* Gateway's ip address */
124 TCHECK(bp->bp_giaddr);
125 if (bp->bp_giaddr.s_addr)
126 printf("\n\t Gateway IP: %s", ipaddr_string(&bp->bp_giaddr));
127
128 /* Client's Ethernet address */
129 if (bp->bp_htype == 1 && bp->bp_hlen == 6) {
130 TCHECK2(bp->bp_chaddr[0], 6);
131 printf("\n\t Client Ethernet Address: %s", etheraddr_string(bp->bp_chaddr));
132 }
133
134 TCHECK2(bp->bp_sname[0], 1); /* check first char only */
135 if (*bp->bp_sname) {
136 printf("\n\t sname \"");
137 if (fn_print(bp->bp_sname, snapend)) {
138 putchar('"');
139 fputs(tstr + 1, stdout);
140 return;
141 }
142 putchar('"');
143 }
144 TCHECK2(bp->bp_file[0], 1); /* check first char only */
145 if (*bp->bp_file) {
146 printf("\n\t file \"");
147 if (fn_print(bp->bp_file, snapend)) {
148 putchar('"');
149 fputs(tstr + 1, stdout);
150 return;
151 }
152 putchar('"');
153 }
154
155 /* Decode the vendor buffer */
156 TCHECK(bp->bp_vend[0]);
157 if (memcmp((const char *)bp->bp_vend, vm_rfc1048,
158 sizeof(u_int32_t)) == 0)
159 rfc1048_print(bp->bp_vend);
160 else if (memcmp((const char *)bp->bp_vend, vm_cmu,
161 sizeof(u_int32_t)) == 0)
162 cmu_print(bp->bp_vend);
163 else {
164 u_int32_t ul;
165
166 ul = EXTRACT_32BITS(&bp->bp_vend);
167 if (ul != 0)
168 printf("\n\t Vendor-#0x%x", ul);
169 }
170
171 return;
172 trunc:
173 fputs(tstr, stdout);
174 }
175
176 /*
177 * The first character specifies the format to print:
178 * i - ip address (32 bits)
179 * p - ip address pairs (32 bits + 32 bits)
180 * l - long (32 bits)
181 * L - unsigned long (32 bits)
182 * s - short (16 bits)
183 * b - period-seperated decimal bytes (variable length)
184 * x - colon-seperated hex bytes (variable length)
185 * a - ascii string (variable length)
186 * B - on/off (8 bits)
187 * $ - special (explicit code to handle)
188 */
189 static struct tok tag2str[] = {
190 /* RFC1048 tags */
191 { TAG_PAD, " PAD" },
192 { TAG_SUBNET_MASK, "iSM" }, /* subnet mask (RFC950) */
193 { TAG_TIME_OFFSET, "LTZ" }, /* seconds from UTC */
194 { TAG_GATEWAY, "iDG" }, /* default gateway */
195 { TAG_TIME_SERVER, "iTS" }, /* time servers (RFC868) */
196 { TAG_NAME_SERVER, "iIEN" }, /* IEN name servers (IEN116) */
197 { TAG_DOMAIN_SERVER, "iNS" }, /* domain name (RFC1035) */
198 { TAG_LOG_SERVER, "iLOG" }, /* MIT log servers */
199 { TAG_COOKIE_SERVER, "iCS" }, /* cookie servers (RFC865) */
200 { TAG_LPR_SERVER, "iLPR" }, /* lpr server (RFC1179) */
201 { TAG_IMPRESS_SERVER, "iIM" }, /* impress servers (Imagen) */
202 { TAG_RLP_SERVER, "iRL" }, /* resource location (RFC887) */
203 { TAG_HOSTNAME, "aHN" }, /* ascii hostname */
204 { TAG_BOOTSIZE, "sBS" }, /* 512 byte blocks */
205 { TAG_END, " END" },
206 /* RFC1497 tags */
207 { TAG_DUMPPATH, "aDP" },
208 { TAG_DOMAINNAME, "aDN" },
209 { TAG_SWAP_SERVER, "iSS" },
210 { TAG_ROOTPATH, "aRP" },
211 { TAG_EXTPATH, "aEP" },
212 /* RFC2132 tags */
213 { TAG_IP_FORWARD, "BIPF" },
214 { TAG_NL_SRCRT, "BSRT" },
215 { TAG_PFILTERS, "pPF" },
216 { TAG_REASS_SIZE, "sRSZ" },
217 { TAG_DEF_TTL, "bTTL" },
218 { TAG_MTU_TIMEOUT, "lMA" },
219 { TAG_MTU_TABLE, "sMT" },
220 { TAG_INT_MTU, "sMTU" },
221 { TAG_LOCAL_SUBNETS, "BLSN" },
222 { TAG_BROAD_ADDR, "iBR" },
223 { TAG_DO_MASK_DISC, "BMD" },
224 { TAG_SUPPLY_MASK, "BMS" },
225 { TAG_DO_RDISC, "BRD" },
226 { TAG_RTR_SOL_ADDR, "iRSA" },
227 { TAG_STATIC_ROUTE, "pSR" },
228 { TAG_USE_TRAILERS, "BUT" },
229 { TAG_ARP_TIMEOUT, "lAT" },
230 { TAG_ETH_ENCAP, "BIE" },
231 { TAG_TCP_TTL, "bTT" },
232 { TAG_TCP_KEEPALIVE, "lKI" },
233 { TAG_KEEPALIVE_GO, "BKG" },
234 { TAG_NIS_DOMAIN, "aYD" },
235 { TAG_NIS_SERVERS, "iYS" },
236 { TAG_NTP_SERVERS, "iNTP" },
237 { TAG_VENDOR_OPTS, "bVO" },
238 { TAG_NETBIOS_NS, "iWNS" },
239 { TAG_NETBIOS_DDS, "iWDD" },
240 { TAG_NETBIOS_NODE, "$WNT" },
241 { TAG_NETBIOS_SCOPE, "aWSC" },
242 { TAG_XWIN_FS, "iXFS" },
243 { TAG_XWIN_DM, "iXDM" },
244 { TAG_NIS_P_DOMAIN, "sN+D" },
245 { TAG_NIS_P_SERVERS, "iN+S" },
246 { TAG_MOBILE_HOME, "iMH" },
247 { TAG_SMPT_SERVER, "iSMTP" },
248 { TAG_POP3_SERVER, "iPOP3" },
249 { TAG_NNTP_SERVER, "iNNTP" },
250 { TAG_WWW_SERVER, "iWWW" },
251 { TAG_FINGER_SERVER, "iFG" },
252 { TAG_IRC_SERVER, "iIRC" },
253 { TAG_STREETTALK_SRVR, "iSTS" },
254 { TAG_STREETTALK_STDA, "iSTDA" },
255 { TAG_REQUESTED_IP, "iRQ" },
256 { TAG_IP_LEASE, "lLT" },
257 { TAG_OPT_OVERLOAD, "$OO" },
258 { TAG_TFTP_SERVER, "aTFTP" },
259 { TAG_BOOTFILENAME, "aBF" },
260 { TAG_DHCP_MESSAGE, " DHCP" },
261 { TAG_SERVER_ID, "iSID" },
262 { TAG_PARM_REQUEST, "bPR" },
263 { TAG_MESSAGE, "aMSG" },
264 { TAG_MAX_MSG_SIZE, "sMSZ" },
265 { TAG_RENEWAL_TIME, "lRN" },
266 { TAG_REBIND_TIME, "lRB" },
267 { TAG_VENDOR_CLASS, "aVC" },
268 { TAG_CLIENT_ID, "$CID" },
269 /* RFC 2485 */
270 { TAG_OPEN_GROUP_UAP, "aUAP" },
271 /* RFC 2563 */
272 { TAG_DISABLE_AUTOCONF, "BNOAUTO" },
273 /* RFC 2610 */
274 { TAG_SLP_DA, "bSLP-DA" }, /*"b" is a little wrong */
275 { TAG_SLP_SCOPE, "bSLP-SCOPE" }, /*"b" is a little wrong */
276 /* RFC 2937 */
277 { TAG_NS_SEARCH, "sNSSEARCH" }, /* XXX 's' */
278 /* RFC 3011 */
279 { TAG_IP4_SUBNET_SELECT, "iSUBNET" },
280 /* http://www.iana.org/assignments/bootp-dhcp-extensions/index.htm */
281 { TAG_USER_CLASS, "aCLASS" },
282 { TAG_SLP_NAMING_AUTH, "aSLP-NA" },
283 { TAG_CLIENT_FQDN, "$FQDN" },
284 { TAG_AGENT_CIRCUIT, "bACKT" },
285 { TAG_AGENT_REMOTE, "bARMT" },
286 { TAG_AGENT_MASK, "bAMSK" },
287 { TAG_TZ_STRING, "aTZSTR" },
288 { TAG_FQDN_OPTION, "bFQDNS" }, /* XXX 'b' */
289 { TAG_AUTH, "bAUTH" }, /* XXX 'b' */
290 { TAG_VINES_SERVERS, "iVINES" },
291 { TAG_SERVER_RANK, "sRANK" },
292 { TAG_CLIENT_ARCH, "sARCH" },
293 { TAG_CLIENT_NDI, "bNDI" }, /* XXX 'b' */
294 { TAG_CLIENT_GUID, "bGUID" }, /* XXX 'b' */
295 { TAG_LDAP_URL, "aLDAP" },
296 { TAG_6OVER4, "i6o4" },
297 { TAG_PRINTER_NAME, "aPRTR" },
298 { TAG_MDHCP_SERVER, "bMDHCP" }, /* XXX 'b' */
299 { TAG_IPX_COMPAT, "bIPX" }, /* XXX 'b' */
300 { TAG_NETINFO_PARENT, "iNI" },
301 { TAG_NETINFO_PARENT_TAG, "aNITAG" },
302 { TAG_URL, "aURL" },
303 { TAG_FAILOVER, "bFAIL" }, /* XXX 'b' */
304 { 0, NULL }
305 };
306 /* 2-byte extended tags */
307 static struct tok xtag2str[] = {
308 { 0, NULL }
309 };
310
311 /* DHCP "options overload" types */
312 static struct tok oo2str[] = {
313 { 1, "file" },
314 { 2, "sname" },
315 { 3, "file+sname" },
316 { 0, NULL }
317 };
318
319 /* NETBIOS over TCP/IP node type options */
320 static struct tok nbo2str[] = {
321 { 0x1, "b-node" },
322 { 0x2, "p-node" },
323 { 0x4, "m-node" },
324 { 0x8, "h-node" },
325 { 0, NULL }
326 };
327
328 /* ARP Hardware types, for Client-ID option */
329 static struct tok arp2str[] = {
330 { 0x1, "ether" },
331 { 0x6, "ieee802" },
332 { 0x7, "arcnet" },
333 { 0xf, "frelay" },
334 { 0x17, "strip" },
335 { 0x18, "ieee1394" },
336 { 0, NULL }
337 };
338
339 static void
340 rfc1048_print(register const u_char *bp)
341 {
342 register u_int16_t tag;
343 register u_int len, size;
344 register const char *cp;
345 register char c;
346 int first;
347 u_int32_t ul;
348 u_int16_t us;
349 u_int8_t uc;
350
351 printf("\n\t Vendor-rfc1048:");
352
353 /* Step over magic cookie */
354 bp += sizeof(int32_t);
355
356 /* Loop while we there is a tag left in the buffer */
357 while (bp + 1 < snapend) {
358 tag = *bp++;
359 if (tag == TAG_PAD)
360 continue;
361 if (tag == TAG_END)
362 return;
363 if (tag == TAG_EXTENDED_OPTION) {
364 TCHECK2(*(bp + 1), 2);
365 tag = EXTRACT_16BITS(bp + 1);
366 /* XXX we don't know yet if the IANA will
367 * preclude overlap of 1-byte and 2-byte spaces.
368 * If not, we need to offset tag after this step.
369 */
370 cp = tok2str(xtag2str, "?xT%u", tag);
371 } else
372 cp = tok2str(tag2str, "?T%u", tag);
373 c = *cp++;
374 printf("\n\t %s:", cp);
375
376 /* Get the length; check for truncation */
377 if (bp + 1 >= snapend) {
378 fputs(tstr, stdout);
379 return;
380 }
381 len = *bp++;
382 if (bp + len >= snapend) {
383 printf("[|bootp %u]", len);
384 return;
385 }
386
387 if (tag == TAG_DHCP_MESSAGE && len == 1) {
388 uc = *bp++;
389 switch (uc) {
390 case DHCPDISCOVER: printf("DISCOVER"); break;
391 case DHCPOFFER: printf("OFFER"); break;
392 case DHCPREQUEST: printf("REQUEST"); break;
393 case DHCPDECLINE: printf("DECLINE"); break;
394 case DHCPACK: printf("ACK"); break;
395 case DHCPNAK: printf("NACK"); break;
396 case DHCPRELEASE: printf("RELEASE"); break;
397 case DHCPINFORM: printf("INFORM"); break;
398 default: printf("%u", uc); break;
399 }
400 continue;
401 }
402
403 if (tag == TAG_PARM_REQUEST) {
404 first = 1;
405 while (len-- > 0) {
406 uc = *bp++;
407 cp = tok2str(tag2str, "?T%u", uc);
408 if (!first)
409 putchar('+');
410 printf("%s", cp + 1);
411 first = 0;
412 }
413 continue;
414 }
415 if (tag == TAG_EXTENDED_REQUEST) {
416 first = 1;
417 while (len > 1) {
418 len -= 2;
419 us = EXTRACT_16BITS(bp);
420 bp += 2;
421 cp = tok2str(xtag2str, "?xT%u", us);
422 if (!first)
423 putchar('+');
424 printf("%s", cp + 1);
425 first = 0;
426 }
427 continue;
428 }
429
430 /* Print data */
431 size = len;
432 if (c == '?') {
433 /* Base default formats for unknown tags on data size */
434 if (size & 1)
435 c = 'b';
436 else if (size & 2)
437 c = 's';
438 else
439 c = 'l';
440 }
441 first = 1;
442 switch (c) {
443
444 case 'a':
445 /* ascii strings */
446 putchar('"');
447 if (fn_printn(bp, size, snapend)) {
448 putchar('"');
449 goto trunc;
450 }
451 putchar('"');
452 bp += size;
453 size = 0;
454 break;
455
456 case 'i':
457 case 'l':
458 case 'L':
459 /* ip addresses/32-bit words */
460 while (size >= sizeof(ul)) {
461 if (!first)
462 putchar(',');
463 ul = EXTRACT_32BITS(bp);
464 if (c == 'i') {
465 ul = htonl(ul);
466 printf("%s", ipaddr_string(&ul));
467 } else if (c == 'L')
468 printf("%d", ul);
469 else
470 printf("%u", ul);
471 bp += sizeof(ul);
472 size -= sizeof(ul);
473 first = 0;
474 }
475 break;
476
477 case 'p':
478 /* IP address pairs */
479 while (size >= 2*sizeof(ul)) {
480 if (!first)
481 putchar(',');
482 memcpy((char *)&ul, (const char *)bp, sizeof(ul));
483 printf("(%s:", ipaddr_string(&ul));
484 bp += sizeof(ul);
485 memcpy((char *)&ul, (const char *)bp, sizeof(ul));
486 printf("%s)", ipaddr_string(&ul));
487 bp += sizeof(ul);
488 size -= 2*sizeof(ul);
489 first = 0;
490 }
491 break;
492
493 case 's':
494 /* shorts */
495 while (size >= sizeof(us)) {
496 if (!first)
497 putchar(',');
498 us = EXTRACT_16BITS(bp);
499 printf("%u", us);
500 bp += sizeof(us);
501 size -= sizeof(us);
502 first = 0;
503 }
504 break;
505
506 case 'B':
507 /* boolean */
508 while (size > 0) {
509 if (!first)
510 putchar(',');
511 switch (*bp) {
512 case 0:
513 putchar('N');
514 break;
515 case 1:
516 putchar('Y');
517 break;
518 default:
519 printf("%u?", *bp);
520 break;
521 }
522 ++bp;
523 --size;
524 first = 0;
525 }
526 break;
527
528 case 'b':
529 case 'x':
530 default:
531 /* Bytes */
532 while (size > 0) {
533 if (!first)
534 putchar(c == 'x' ? ':' : '.');
535 if (c == 'x')
536 printf("%02x", *bp);
537 else
538 printf("%u", *bp);
539 ++bp;
540 --size;
541 first = 0;
542 }
543 break;
544
545 case '$':
546 /* Guys we can't handle with one of the usual cases */
547 switch (tag) {
548
549 case TAG_NETBIOS_NODE:
550 tag = *bp++;
551 --size;
552 fputs(tok2str(nbo2str, NULL, tag), stdout);
553 break;
554
555 case TAG_OPT_OVERLOAD:
556 tag = *bp++;
557 --size;
558 fputs(tok2str(oo2str, NULL, tag), stdout);
559 break;
560
561 case TAG_CLIENT_FQDN:
562 /* option 81 should be at least 4 bytes long */
563 if (len < 4) {
564 printf("ERROR: options 81 len %u < 4 bytes", len);
565 break;
566 }
567 if (*bp++)
568 printf("[svrreg]");
569 if (*bp)
570 printf("%u/%u/", *bp, *(bp+1));
571 bp += 2;
572 putchar('"');
573 if (fn_printn(bp, size - 3, snapend)) {
574 putchar('"');
575 goto trunc;
576 }
577 putchar('"');
578 bp += size - 3;
579 size = 0;
580 break;
581
582 case TAG_CLIENT_ID:
583 { int type = *bp++;
584 size--;
585 if (type == 0) {
586 putchar('"');
587 if (fn_printn(bp, size, snapend)) {
588 putchar('"');
589 goto trunc;
590 }
591 putchar('"');
592 bp += size;
593 size = 0;
594 break;
595 } else {
596 printf("[%s]", tok2str(arp2str, "type-%d", type));
597 }
598 while (size > 0) {
599 if (!first)
600 putchar(':');
601 printf("%02x", *bp);
602 ++bp;
603 --size;
604 first = 0;
605 }
606 break;
607 }
608
609 default:
610 printf("[unknown special tag %u, size %u]",
611 tag, size);
612 bp += size;
613 size = 0;
614 break;
615 }
616 break;
617 }
618 /* Data left over? */
619 if (size) {
620 printf("[len %u]", len);
621 bp += size;
622 }
623 }
624 return;
625 trunc:
626 printf("|[rfc1048]");
627 }
628
629 static void
630 cmu_print(register const u_char *bp)
631 {
632 register const struct cmu_vend *cmu;
633
634 #define PRINTCMUADDR(m, s) { TCHECK(cmu->m); \
635 if (cmu->m.s_addr != 0) \
636 printf(" %s:%s", s, ipaddr_string(&cmu->m.s_addr)); }
637
638 printf(" vend-cmu");
639 cmu = (const struct cmu_vend *)bp;
640
641 /* Only print if there are unknown bits */
642 TCHECK(cmu->v_flags);
643 if ((cmu->v_flags & ~(VF_SMASK)) != 0)
644 printf(" F:0x%x", cmu->v_flags);
645 PRINTCMUADDR(v_dgate, "DG");
646 PRINTCMUADDR(v_smask, cmu->v_flags & VF_SMASK ? "SM" : "SM*");
647 PRINTCMUADDR(v_dns1, "NS1");
648 PRINTCMUADDR(v_dns2, "NS2");
649 PRINTCMUADDR(v_ins1, "IEN1");
650 PRINTCMUADDR(v_ins2, "IEN2");
651 PRINTCMUADDR(v_ts1, "TS1");
652 PRINTCMUADDR(v_ts2, "TS2");
653 return;
654
655 trunc:
656 fputs(tstr, stdout);
657 #undef PRINTCMUADDR
658 }