The Tcpdump Group git mirrors - tcpdump/blob - print-ip.c

   1 /*
   2  * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997
   3  *      The Regents of the University of California.  All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that: (1) source code distributions
   7  * retain the above copyright notice and this paragraph in its entirety, (2)
   8  * distributions including binary code include the above copyright notice and
   9  * this paragraph in its entirety in the documentation or other materials
  10  * provided with the distribution, and (3) all advertising materials mentioning
  11  * features or use of this software display the following acknowledgement:
  12  * ``This product includes software developed by the University of California,
  13  * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
  14  * the University nor the names of its contributors may be used to endorse
  15  * or promote products derived from this software without specific prior
  16  * written permission.
  17  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
  18  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
  19  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  20  */
  21
  22 #ifndef lint
  23 static const char rcsid[] _U_ =
  24     "@(#) $Header: /tcpdump/master/tcpdump/print-ip.c,v 1.159 2007-09-14 01:29:28 guy Exp $ (LBL)";
  25 #endif
  26
  27 #ifdef HAVE_CONFIG_H
  28 #include "config.h"
  29 #endif
  30
  31 #include <tcpdump-stdinc.h>
  32
  33 #include <stdio.h>
  34 #include <stdlib.h>
  35 #include <string.h>
  36
  37 #include "addrtoname.h"
  38 #include "interface.h"
  39 #include "extract.h"                    /* must come after interface.h */
  40
  41 #include "ip.h"
  42 #include "ipproto.h"
  43
  44 struct tok ip_option_values[] = {
  45     { IPOPT_EOL, "EOL" },
  46     { IPOPT_NOP, "NOP" },
  47     { IPOPT_TS, "timestamp" },
  48     { IPOPT_SECURITY, "security" },
  49     { IPOPT_RR, "RR" },
  50     { IPOPT_SSRR, "SSRR" },
  51     { IPOPT_LSRR, "LSRR" },
  52     { IPOPT_RA, "RA" },
  53     { IPOPT_RFC1393, "traceroute" },
  54     { 0, NULL }
  55 };
  56
  57 /*
  58  * print the recorded route in an IP RR, LSRR or SSRR option.
  59  */
  60 static void
  61 ip_printroute(register const u_char *cp, u_int length)
  62 {
  63         register u_int ptr;
  64         register u_int len;
  65
  66         if (length < 3) {
  67                 printf(" [bad length %u]", length);
  68                 return;
  69         }
  70         if ((length + 1) & 3)
  71                 printf(" [bad length %u]", length);
  72         ptr = cp[2] - 1;
  73         if (ptr < 3 || ((ptr + 1) & 3) || ptr > length + 1)
  74                 printf(" [bad ptr %u]", cp[2]);
  75
  76         for (len = 3; len < length; len += 4) {
  77                 printf(" %s", ipaddr_string(&cp[len]));
  78                 if (ptr > len)
  79                         printf(",");
  80         }
  81 }
  82
  83 /*
  84  * If source-routing is present and valid, return the final destination.
  85  * Otherwise, return IP destination.
  86  *
  87  * This is used for UDP and TCP pseudo-header in the checksum
  88  * calculation.
  89  */
  90 static u_int32_t
  91 ip_finddst(const struct ip *ip)
  92 {
  93         int length;
  94         int len;
  95         const u_char *cp;
  96         u_int32_t retval;
  97
  98         cp = (const u_char *)(ip + 1);
  99         length = (IP_HL(ip) << 2) - sizeof(struct ip);
 100
 101         for (; length > 0; cp += len, length -= len) {
 102                 int tt;
 103
 104                 TCHECK(*cp);
 105                 tt = *cp;
 106                 if (tt == IPOPT_EOL)
 107                         break;
 108                 else if (tt == IPOPT_NOP)
 109                         len = 1;
 110                 else {
 111                         TCHECK(cp[1]);
 112                         len = cp[1];
 113                         if (len < 2)
 114                                 break;
 115                 }
 116                 TCHECK2(*cp, len);
 117                 switch (tt) {
 118
 119                 case IPOPT_SSRR:
 120                 case IPOPT_LSRR:
 121                         if (len < 7)
 122                                 break;
 123                         memcpy(&retval, cp + len - 4, 4);
 124                         return retval;
 125                 }
 126         }
 127 trunc:
 128         memcpy(&retval, &ip->ip_dst.s_addr, sizeof(u_int32_t));
 129         return retval;
 130 }
 131
 132 /*
 133  * Compute a V4-style checksum by building a pseudoheader.
 134  */
 135 int
 136 nextproto4_cksum(const struct ip *ip, const u_int8_t *data,
 137                  u_int len, u_int next_proto)
 138 {
 139         struct phdr {
 140                 u_int32_t src;
 141                 u_int32_t dst;
 142                 u_char mbz;
 143                 u_char proto;
 144                 u_int16_t len;
 145         } ph;
 146         struct cksum_vec vec[2];
 147
 148         /* pseudo-header.. */
 149         ph.len = htons((u_int16_t)len);
 150         ph.mbz = 0;
 151         ph.proto = next_proto;
 152         memcpy(&ph.src, &ip->ip_src.s_addr, sizeof(u_int32_t));
 153         if (IP_HL(ip) == 5)
 154                 memcpy(&ph.dst, &ip->ip_dst.s_addr, sizeof(u_int32_t));
 155         else
 156                 ph.dst = ip_finddst(ip);
 157
 158         vec[0].ptr = (const u_int8_t *)(void *)&ph;
 159         vec[0].len = sizeof(ph);
 160         vec[1].ptr = data;
 161         vec[1].len = len;
 162         return (in_cksum(vec, 2));
 163 }
 164
 165 static void
 166 ip_printts(register const u_char *cp, u_int length)
 167 {
 168         register u_int ptr;
 169         register u_int len;
 170         int hoplen;
 171         const char *type;
 172
 173         if (length < 4) {
 174                 printf("[bad length %u]", length);
 175                 return;
 176         }
 177         printf(" TS{");
 178         hoplen = ((cp[3]&0xF) != IPOPT_TS_TSONLY) ? 8 : 4;
 179         if ((length - 4) & (hoplen-1))
 180                 printf("[bad length %u]", length);
 181         ptr = cp[2] - 1;
 182         len = 0;
 183         if (ptr < 4 || ((ptr - 4) & (hoplen-1)) || ptr > length + 1)
 184                 printf("[bad ptr %u]", cp[2]);
 185         switch (cp[3]&0xF) {
 186         case IPOPT_TS_TSONLY:
 187                 printf("TSONLY");
 188                 break;
 189         case IPOPT_TS_TSANDADDR:
 190                 printf("TS+ADDR");
 191                 break;
 192         /*
 193          * prespecified should really be 3, but some ones might send 2
 194          * instead, and the IPOPT_TS_PRESPEC constant can apparently
 195          * have both values, so we have to hard-code it here.
 196          */
 197
 198         case 2:
 199                 printf("PRESPEC2.0");
 200                 break;
 201         case 3:                 /* IPOPT_TS_PRESPEC */
 202                 printf("PRESPEC");
 203                 break;
 204         default:
 205                 printf("[bad ts type %d]", cp[3]&0xF);
 206                 goto done;
 207         }
 208
 209         type = " ";
 210         for (len = 4; len < length; len += hoplen) {
 211                 if (ptr == len)
 212                         type = " ^ ";
 213                 printf("%s%d@%s", type, EXTRACT_32BITS(&cp[len+hoplen-4]),
 214                        hoplen!=8 ? "" : ipaddr_string(&cp[len]));
 215                 type = " ";
 216         }
 217
 218 done:
 219         printf("%s", ptr == len ? " ^ " : "");
 220
 221         if (cp[3]>>4)
 222                 printf(" [%d hops not recorded]} ", cp[3]>>4);
 223         else
 224                 printf("}");
 225 }
 226
 227 /*
 228  * print IP options.
 229  */
 230 static void
 231 ip_optprint(register const u_char *cp, u_int length)
 232 {
 233         register u_int option_len;
 234         const char *sep = "";
 235
 236         for (; length > 0; cp += option_len, length -= option_len) {
 237                 u_int option_code;
 238
 239                 printf("%s", sep);
 240                 sep = ",";
 241
 242                 TCHECK(*cp);
 243                 option_code = *cp;
 244
 245                 printf("%s",
 246                         tok2str(ip_option_values,"unknown %u",option_code));
 247
 248                 if (option_code == IPOPT_NOP ||
 249                     option_code == IPOPT_EOL)
 250                         option_len = 1;
 251
 252                 else {
 253                         TCHECK(cp[1]);
 254                         option_len = cp[1];
 255                         if (option_len < 2) {
 256                                 printf(" [bad length %u]", option_len);
 257                                 return;
 258                         }
 259                 }
 260
 261                 if (option_len > length) {
 262                         printf(" [bad length %u]", option_len);
 263                         return;
 264                 }
 265
 266                 TCHECK2(*cp, option_len);
 267
 268                 switch (option_code) {
 269                 case IPOPT_EOL:
 270                         return;
 271
 272                 case IPOPT_TS:
 273                         ip_printts(cp, option_len);
 274                         break;
 275
 276                 case IPOPT_RR:       /* fall through */
 277                 case IPOPT_SSRR:
 278                 case IPOPT_LSRR:
 279                         ip_printroute(cp, option_len);
 280                         break;
 281
 282                 case IPOPT_RA:
 283                         if (option_len < 4) {
 284                                 printf(" [bad length %u]", option_len);
 285                                 break;
 286                         }
 287                         TCHECK(cp[3]);
 288                         if (EXTRACT_16BITS(&cp[2]) != 0)
 289                             printf(" value %u", EXTRACT_16BITS(&cp[2]));
 290                         break;
 291
 292                 case IPOPT_NOP:       /* nothing to print - fall through */
 293                 case IPOPT_SECURITY:
 294                 default:
 295                         break;
 296                 }
 297         }
 298         return;
 299
 300 trunc:
 301         printf("[|ip]");
 302 }
 303
 304 #define IP_RES 0x8000
 305
 306 static struct tok ip_frag_values[] = {
 307         { IP_MF,        "+" },
 308         { IP_DF,        "DF" },
 309         { IP_RES,       "rsvd" }, /* The RFC3514 evil ;-) bit */
 310         { 0,            NULL }
 311 };
 312
 313 struct ip_print_demux_state {
 314         const struct ip *ip;
 315         const u_char *cp;
 316         u_int   len, off;
 317         u_char  nh;
 318         int     advance;
 319 };
 320
 321 static void
 322 ip_print_demux(netdissect_options *ndo,
 323                struct ip_print_demux_state *ipds)
 324 {
 325         struct protoent *proto;
 326         struct cksum_vec vec[1];
 327
 328 again:
 329         switch (ipds->nh) {
 330
 331         case IPPROTO_AH:
 332                 ipds->nh = *ipds->cp;
 333                 ipds->advance = ah_print(ipds->cp);
 334                 if (ipds->advance <= 0)
 335                         break;
 336                 ipds->cp += ipds->advance;
 337                 ipds->len -= ipds->advance;
 338                 goto again;
 339
 340         case IPPROTO_ESP:
 341         {
 342                 int enh, padlen;
 343                 ipds->advance = esp_print(ndo, ipds->cp, ipds->len,
 344                                     (const u_char *)ipds->ip,
 345                                     &enh, &padlen);
 346                 if (ipds->advance <= 0)
 347                         break;
 348                 ipds->cp += ipds->advance;
 349                 ipds->len -= ipds->advance + padlen;
 350                 ipds->nh = enh & 0xff;
 351                 goto again;
 352         }
 353
 354         case IPPROTO_IPCOMP:
 355         {
 356                 int enh;
 357                 ipds->advance = ipcomp_print(ipds->cp, &enh);
 358                 if (ipds->advance <= 0)
 359                         break;
 360                 ipds->cp += ipds->advance;
 361                 ipds->len -= ipds->advance;
 362                 ipds->nh = enh & 0xff;
 363                 goto again;
 364         }
 365
 366         case IPPROTO_SCTP:
 367                 sctp_print(ipds->cp, (const u_char *)ipds->ip, ipds->len);
 368                 break;
 369
 370         case IPPROTO_DCCP:
 371                 dccp_print(ipds->cp, (const u_char *)ipds->ip, ipds->len);
 372                 break;
 373
 374         case IPPROTO_TCP:
 375                 /* pass on the MF bit plus the offset to detect fragments */
 376                 tcp_print(ipds->cp, ipds->len, (const u_char *)ipds->ip,
 377                           ipds->off & (IP_MF|IP_OFFMASK));
 378                 break;
 379
 380         case IPPROTO_UDP:
 381                 /* pass on the MF bit plus the offset to detect fragments */
 382                 udp_print(ipds->cp, ipds->len, (const u_char *)ipds->ip,
 383                           ipds->off & (IP_MF|IP_OFFMASK));
 384                 break;
 385
 386         case IPPROTO_ICMP:
 387                 /* pass on the MF bit plus the offset to detect fragments */
 388                 icmp_print(ipds->cp, ipds->len, (const u_char *)ipds->ip,
 389                            ipds->off & (IP_MF|IP_OFFMASK));
 390                 break;
 391
 392         case IPPROTO_PIGP:
 393                 /*
 394                  * XXX - the current IANA protocol number assignments
 395                  * page lists 9 as "any private interior gateway
 396                  * (used by Cisco for their IGRP)" and 88 as
 397                  * "EIGRP" from Cisco.
 398                  *
 399                  * Recent BSD <netinet/in.h> headers define
 400                  * IP_PROTO_PIGP as 9 and IP_PROTO_IGRP as 88.
 401                  * We define IP_PROTO_PIGP as 9 and
 402                  * IP_PROTO_EIGRP as 88; those names better
 403                  * match was the current protocol number
 404                  * assignments say.
 405                  */
 406                 igrp_print(ipds->cp, ipds->len, (const u_char *)ipds->ip);
 407                 break;
 408
 409         case IPPROTO_EIGRP:
 410                 eigrp_print(ipds->cp, ipds->len);
 411                 break;
 412
 413         case IPPROTO_ND:
 414                 ND_PRINT((ndo, " nd %d", ipds->len));
 415                 break;
 416
 417         case IPPROTO_EGP:
 418                 egp_print(ipds->cp, ipds->len);
 419                 break;
 420
 421         case IPPROTO_OSPF:
 422                 ospf_print(ipds->cp, ipds->len, (const u_char *)ipds->ip);
 423                 break;
 424
 425         case IPPROTO_IGMP:
 426                 igmp_print(ipds->cp, ipds->len);
 427                 break;
 428
 429         case IPPROTO_IPV4:
 430                 /* DVMRP multicast tunnel (ip-in-ip encapsulation) */
 431                 ip_print(ndo, ipds->cp, ipds->len);
 432                 if (! vflag) {
 433                         ND_PRINT((ndo, " (ipip-proto-4)"));
 434                         return;
 435                 }
 436                 break;
 437
 438 #ifdef INET6
 439         case IPPROTO_IPV6:
 440                 /* ip6-in-ip encapsulation */
 441                 ip6_print(ndo, ipds->cp, ipds->len);
 442                 break;
 443 #endif /*INET6*/
 444
 445         case IPPROTO_RSVP:
 446                 rsvp_print(ipds->cp, ipds->len);
 447                 break;
 448
 449         case IPPROTO_GRE:
 450                 /* do it */
 451                 gre_print(ipds->cp, ipds->len);
 452                 break;
 453
 454         case IPPROTO_MOBILE:
 455                 mobile_print(ipds->cp, ipds->len);
 456                 break;
 457
 458         case IPPROTO_PIM:
 459                 vec[0].ptr = ipds->cp;
 460                 vec[0].len = ipds->len;
 461                 pim_print(ipds->cp, ipds->len, in_cksum(vec, 1));
 462                 break;
 463
 464         case IPPROTO_VRRP:
 465                 vrrp_print(ipds->cp, ipds->len, ipds->ip->ip_ttl);
 466                 break;
 467
 468         case IPPROTO_PGM:
 469                 pgm_print(ipds->cp, ipds->len, (const u_char *)ipds->ip);
 470                 break;
 471
 472         default:
 473                 if ((proto = getprotobynumber(ipds->nh)) != NULL)
 474                         ND_PRINT((ndo, " %s", proto->p_name));
 475                 else
 476                         ND_PRINT((ndo, " ip-proto-%d", ipds->nh));
 477                 ND_PRINT((ndo, " %d", ipds->len));
 478                 break;
 479         }
 480 }
 481
 482 void
 483 ip_print_inner(netdissect_options *ndo,
 484                const u_char *bp,
 485                u_int length, u_int nh,
 486                const u_char *bp2)
 487 {
 488         struct ip_print_demux_state  ipd;
 489
 490         ipd.ip = (const struct ip *)bp2;
 491         ipd.cp = bp;
 492         ipd.len  = length;
 493         ipd.off  = 0;
 494         ipd.nh   = nh;
 495         ipd.advance = 0;
 496
 497         ip_print_demux(ndo, &ipd);
 498 }
 499
 500
 501 /*
 502  * print an IP datagram.
 503  */
 504 void
 505 ip_print(netdissect_options *ndo,
 506          const u_char *bp,
 507          u_int length)
 508 {
 509         struct ip_print_demux_state  ipd;
 510         struct ip_print_demux_state *ipds=&ipd;
 511         const u_char *ipend;
 512         u_int hlen;
 513         struct cksum_vec vec[1];
 514         u_int16_t sum, ip_sum;
 515         struct protoent *proto;
 516
 517         ipds->ip = (const struct ip *)bp;
 518         if (IP_V(ipds->ip) != 4) { /* print version if != 4 */
 519             printf("IP%u ", IP_V(ipds->ip));
 520             if (IP_V(ipds->ip) == 6)
 521                 printf(", wrong link-layer encapsulation");
 522         }
 523         else if (!eflag)
 524             printf("IP ");
 525
 526         if ((u_char *)(ipds->ip + 1) > ndo->ndo_snapend) {
 527                 printf("[|ip]");
 528                 return;
 529         }
 530         if (length < sizeof (struct ip)) {
 531                 (void)printf("truncated-ip %u", length);
 532                 return;
 533         }
 534         hlen = IP_HL(ipds->ip) * 4;
 535         if (hlen < sizeof (struct ip)) {
 536                 (void)printf("bad-hlen %u", hlen);
 537                 return;
 538         }
 539
 540         ipds->len = EXTRACT_16BITS(&ipds->ip->ip_len);
 541         if (length < ipds->len)
 542                 (void)printf("truncated-ip - %u bytes missing! ",
 543                         ipds->len - length);
 544         if (ipds->len < hlen) {
 545 #ifdef GUESS_TSO
 546             if (ipds->len) {
 547                 (void)printf("bad-len %u", ipds->len);
 548                 return;
 549             }
 550             else {
 551                 /* we guess that it is a TSO send */
 552                 ipds->len = length;
 553             }
 554 #else
 555             (void)printf("bad-len %u", ipds->len);
 556             return;
 557 #endif /* GUESS_TSO */
 558         }
 559
 560         /*
 561          * Cut off the snapshot length to the end of the IP payload.
 562          */
 563         ipend = bp + ipds->len;
 564         if (ipend < ndo->ndo_snapend)
 565                 ndo->ndo_snapend = ipend;
 566
 567         ipds->len -= hlen;
 568
 569         ipds->off = EXTRACT_16BITS(&ipds->ip->ip_off);
 570
 571         if (vflag) {
 572             (void)printf("(tos 0x%x", (int)ipds->ip->ip_tos);
 573             /* ECN bits */
 574             if (ipds->ip->ip_tos & 0x03) {
 575                 switch (ipds->ip->ip_tos & 0x03) {
 576                 case 1:
 577                     (void)printf(",ECT(1)");
 578                     break;
 579                 case 2:
 580                     (void)printf(",ECT(0)");
 581                     break;
 582                 case 3:
 583                     (void)printf(",CE");
 584                 }
 585             }
 586
 587             if (ipds->ip->ip_ttl >= 1)
 588                 (void)printf(", ttl %u", ipds->ip->ip_ttl);
 589
 590             /*
 591              * for the firewall guys, print id, offset.
 592              * On all but the last stick a "+" in the flags portion.
 593              * For unfragmented datagrams, note the don't fragment flag.
 594              */
 595
 596             (void)printf(", id %u, offset %u, flags [%s], proto %s (%u)",
 597                          EXTRACT_16BITS(&ipds->ip->ip_id),
 598                          (ipds->off & 0x1fff) * 8,
 599                          bittok2str(ip_frag_values, "none", ipds->off&0xe000),
 600                          tok2str(ipproto_values,"unknown",ipds->ip->ip_p),
 601                          ipds->ip->ip_p);
 602
 603             (void)printf(", length %u", EXTRACT_16BITS(&ipds->ip->ip_len));
 604
 605             if ((hlen - sizeof(struct ip)) > 0) {
 606                 printf(", options (");
 607                 ip_optprint((u_char *)(ipds->ip + 1), hlen - sizeof(struct ip));
 608                 printf(")");
 609             }
 610
 611             if (!Kflag && (u_char *)ipds->ip + hlen <= ndo->ndo_snapend) {
 612                 vec[0].ptr = (const u_int8_t *)(void *)ipds->ip;
 613                 vec[0].len = hlen;
 614                 sum = in_cksum(vec, 1);
 615                 if (sum != 0) {
 616                     ip_sum = EXTRACT_16BITS(&ipds->ip->ip_sum);
 617                     (void)printf(", bad cksum %x (->%x)!", ip_sum,
 618                              in_cksum_shouldbe(ip_sum, sum));
 619                 }
 620             }
 621
 622             printf(")\n    ");
 623         }
 624
 625         /*
 626          * If this is fragment zero, hand it to the next higher
 627          * level protocol.
 628          */
 629         if ((ipds->off & 0x1fff) == 0) {
 630                 ipds->cp = (const u_char *)ipds->ip + hlen;
 631                 ipds->nh = ipds->ip->ip_p;
 632
 633                 if (ipds->nh != IPPROTO_TCP && ipds->nh != IPPROTO_UDP &&
 634                     ipds->nh != IPPROTO_SCTP && ipds->nh != IPPROTO_DCCP) {
 635                         (void)printf("%s > %s: ",
 636                                      ipaddr_string(&ipds->ip->ip_src),
 637                                      ipaddr_string(&ipds->ip->ip_dst));
 638                 }
 639                 ip_print_demux(ndo, ipds);
 640         } else {
 641             /* Ultra quiet now means that all this stuff should be suppressed */
 642             if (qflag > 1) return;
 643
 644             /*
 645              * if this isn't the first frag, we're missing the
 646              * next level protocol header.  print the ip addr
 647              * and the protocol.
 648              */
 649             if (ipds->off & 0x1fff) {
 650                 (void)printf("%s > %s:", ipaddr_string(&ipds->ip->ip_src),
 651                              ipaddr_string(&ipds->ip->ip_dst));
 652                 if ((proto = getprotobynumber(ipds->ip->ip_p)) != NULL)
 653                     (void)printf(" %s", proto->p_name);
 654                 else
 655                     (void)printf(" ip-proto-%d", ipds->ip->ip_p);
 656             }
 657         }
 658 }
 659
 660 void
 661 ipN_print(register const u_char *bp, register u_int length)
 662 {
 663         struct ip *ip, hdr;
 664
 665         ip = (struct ip *)bp;
 666         if (length < 4) {
 667                 (void)printf("truncated-ip %d", length);
 668                 return;
 669         }
 670         memcpy (&hdr, (char *)ip, 4);
 671         switch (IP_V(&hdr)) {
 672         case 4:
 673                 ip_print (gndo, bp, length);
 674                 return;
 675 #ifdef INET6
 676         case 6:
 677                 ip6_print (gndo, bp, length);
 678                 return;
 679 #endif
 680         default:
 681                 (void)printf("unknown ip %d", IP_V(&hdr));
 682                 return;
 683         }
 684 }
 685
 686 /*
 687  * Local Variables:
 688  * c-style: whitesmith
 689  * c-basic-offset: 8
 690  * End:
 691  */
 692
 693