]> The Tcpdump Group git mirrors - tcpdump/blob - print-ip.c
projects / tcpdump / blob


c88a2076d15d1b86a6079955b897ff0112c9dd36
[tcpdump] / print-ip.c
1 /*
2 * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997
3 * The Regents of the University of California. All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
16 * written permission.
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
20 */
21
22 #ifndef lint
23 static const char rcsid[] =
24 "@(#) $Header: /tcpdump/master/tcpdump/print-ip.c,v 1.114 2002-10-03 16:00:34 hannes Exp $ (LBL)";
25 #endif
26
27 #ifdef HAVE_CONFIG_H
28 #include "config.h"
29 #endif
30
31 #include <tcpdump-stdinc.h>
32
33 #include <stdio.h>
34 #include <stdlib.h>
35 #include <string.h>
36
37 #include "addrtoname.h"
38 #include "interface.h"
39 #include "extract.h" /* must come after interface.h */
40
41 #include "ip.h"
42
43 /* Compatibility */
44 #ifndef IPPROTO_ND
45 #define IPPROTO_ND 77
46 #endif
47
48 /*
49 * print the recorded route in an IP RR, LSRR or SSRR option.
50 */
51 static void
52 ip_printroute(const char *type, register const u_char *cp, u_int length)
53 {
54 register u_int ptr = cp[2] - 1;
55 register u_int len;
56
57 printf(" %s{", type);
58 if ((length + 1) & 3)
59 printf(" [bad length %d]", length);
60 if (ptr < 3 || ((ptr + 1) & 3) || ptr > length + 1)
61 printf(" [bad ptr %d]", cp[2]);
62
63 type = "";
64 for (len = 3; len < length; len += 4) {
65 if (ptr == len)
66 type = "#";
67 printf("%s%s", type, ipaddr_string(&cp[len]));
68 type = " ";
69 }
70 printf("%s}", ptr == len? "#" : "");
71 }
72
73 /*
74 * If source-routing is present, return the final destination.
75 * Otherwise, return IP destination.
76 *
77 * This is used for UDP and TCP pseudo-header in the checksum
78 * calculation.
79 */
80 u_int32_t
81 ip_finddst(const struct ip *ip)
82 {
83 int length;
84 int len;
85 const u_char *cp;
86 u_int32_t retval;
87
88 cp = (const u_char *)(ip + 1);
89 length = (IP_HL(ip) << 2) - sizeof(struct ip);
90
91 for (; length > 0; cp += len, length -= len) {
92 int tt = *cp;
93
94 if (tt == IPOPT_NOP || tt == IPOPT_EOL)
95 len = 1;
96 else {
97 if (&cp[1] >= snapend) {
98 return 0;
99 }
100 len = cp[1];
101 }
102 if (len <= 0) {
103 return 0;
104 }
105 if (&cp[1] >= snapend || cp + len > snapend) {
106 return 0;
107 }
108 switch (tt) {
109
110 case IPOPT_SSRR:
111 case IPOPT_LSRR:
112 memcpy(&retval, cp + len - 4, 4);
113 return retval;
114 }
115 }
116 return ip->ip_dst.s_addr;
117 }
118
119 static void
120 ip_printts(register const u_char *cp, u_int length)
121 {
122 register u_int ptr = cp[2] - 1;
123 register u_int len = 0;
124 int hoplen;
125 const char *type;
126
127 printf(" TS{");
128 hoplen = ((cp[3]&0xF) != IPOPT_TS_TSONLY) ? 8 : 4;
129 if ((length - 4) & (hoplen-1))
130 printf("[bad length %d]", length);
131 if (ptr < 4 || ((ptr - 4) & (hoplen-1)) || ptr > length + 1)
132 printf("[bad ptr %d]", cp[2]);
133 switch (cp[3]&0xF) {
134 case IPOPT_TS_TSONLY:
135 printf("TSONLY");
136 break;
137 case IPOPT_TS_TSANDADDR:
138 printf("TS+ADDR");
139 break;
140 /*
141 * prespecified should really be 3, but some ones might send 2
142 * instead, and the IPOPT_TS_PRESPEC constant can apparently
143 * have both values, so we have to hard-code it here.
144 */
145
146 case 2:
147 printf("PRESPEC2.0");
148 break;
149 case 3: /* IPOPT_TS_PRESPEC */
150 printf("PRESPEC");
151 break;
152 default:
153 printf("[bad ts type %d]", cp[3]&0xF);
154 goto done;
155 }
156
157 type = " ";
158 for (len = 4; len < length; len += hoplen) {
159 if (ptr == len)
160 type = " ^ ";
161 printf("%s%d@%s", type, EXTRACT_32BITS(&cp[len+hoplen-4]),
162 hoplen!=8 ? "" : ipaddr_string(&cp[len]));
163 type = " ";
164 }
165
166 done:
167 printf("%s", ptr == len ? " ^ " : "");
168
169 if (cp[3]>>4)
170 printf(" [%d hops not recorded]} ", cp[3]>>4);
171 else
172 printf("}");
173 }
174
175 /*
176 * print IP options.
177 */
178 static void
179 ip_optprint(register const u_char *cp, u_int length)
180 {
181 register u_int len;
182
183 for (; length > 0; cp += len, length -= len) {
184 int tt = *cp;
185
186 if (tt == IPOPT_NOP || tt == IPOPT_EOL)
187 len = 1;
188 else {
189 if (&cp[1] >= snapend) {
190 printf("[|ip]");
191 return;
192 }
193 len = cp[1];
194 }
195 if (len <= 0) {
196 printf("[|ip op len %d]", len);
197 return;
198 }
199 if (&cp[1] >= snapend || cp + len > snapend) {
200 printf("[|ip]");
201 return;
202 }
203 switch (tt) {
204
205 case IPOPT_EOL:
206 printf(" EOL");
207 if (length > 1)
208 printf("-%d", length - 1);
209 return;
210
211 case IPOPT_NOP:
212 printf(" NOP");
213 break;
214
215 case IPOPT_TS:
216 ip_printts(cp, len);
217 break;
218
219 #ifndef IPOPT_SECURITY
220 #define IPOPT_SECURITY 130
221 #endif /* IPOPT_SECURITY */
222 case IPOPT_SECURITY:
223 printf(" SECURITY{%d}", len);
224 break;
225
226 case IPOPT_RR:
227 ip_printroute("RR", cp, len);
228 break;
229
230 case IPOPT_SSRR:
231 ip_printroute("SSRR", cp, len);
232 break;
233
234 case IPOPT_LSRR:
235 ip_printroute("LSRR", cp, len);
236 break;
237
238 #ifndef IPOPT_RA
239 #define IPOPT_RA 148 /* router alert */
240 #endif
241 case IPOPT_RA:
242 printf(" RA");
243 if (len != 4)
244 printf("{%d}", len);
245 else if (cp[2] || cp[3])
246 printf("%d.%d", cp[2], cp[3]);
247 break;
248
249 default:
250 printf(" IPOPT-%d{%d}", cp[0], len);
251 break;
252 }
253 }
254 }
255
256 /*
257 * compute an IP header checksum.
258 * don't modifiy the packet.
259 */
260 u_short
261 in_cksum(const u_short *addr, register u_int len, int csum)
262 {
263 int nleft = len;
264 const u_short *w = addr;
265 u_short answer;
266 int sum = csum;
267
268 /*
269 * Our algorithm is simple, using a 32 bit accumulator (sum),
270 * we add sequential 16 bit words to it, and at the end, fold
271 * back all the carry bits from the top 16 bits into the lower
272 * 16 bits.
273 */
274 while (nleft > 1) {
275 sum += *w++;
276 nleft -= 2;
277 }
278 if (nleft == 1)
279 sum += htons(*(u_char *)w<<8);
280
281 /*
282 * add back carry outs from top 16 bits to low 16 bits
283 */
284 sum = (sum >> 16) + (sum & 0xffff); /* add hi 16 to low 16 */
285 sum += (sum >> 16); /* add carry */
286 answer = ~sum; /* truncate to 16 bits */
287 return (answer);
288 }
289
290 /*
291 * Given the host-byte-order value of the checksum field in a packet
292 * header, and the network-byte-order computed checksum of the data
293 * that the checksum covers (including the checksum itself), compute
294 * what the checksum field *should* have been.
295 */
296 u_int16_t
297 in_cksum_shouldbe(u_int16_t sum, u_int16_t computed_sum)
298 {
299 u_int32_t shouldbe;
300
301 /*
302 * The value that should have gone into the checksum field
303 * is the negative of the value gotten by summing up everything
304 * *but* the checksum field.
305 *
306 * We can compute that by subtracting the value of the checksum
307 * field from the sum of all the data in the packet, and then
308 * computing the negative of that value.
309 *
310 * "sum" is the value of the checksum field, and "computed_sum"
311 * is the negative of the sum of all the data in the packets,
312 * so that's -(-computed_sum - sum), or (sum + computed_sum).
313 *
314 * All the arithmetic in question is one's complement, so the
315 * addition must include an end-around carry; we do this by
316 * doing the arithmetic in 32 bits (with no sign-extension),
317 * and then adding the upper 16 bits of the sum, which contain
318 * the carry, to the lower 16 bits of the sum, and then do it
319 * again in case *that* sum produced a carry.
320 *
321 * As RFC 1071 notes, the checksum can be computed without
322 * byte-swapping the 16-bit words; summing 16-bit words
323 * on a big-endian machine gives a big-endian checksum, which
324 * can be directly stuffed into the big-endian checksum fields
325 * in protocol headers, and summing words on a little-endian
326 * machine gives a little-endian checksum, which must be
327 * byte-swapped before being stuffed into a big-endian checksum
328 * field.
329 *
330 * "computed_sum" is a network-byte-order value, so we must put
331 * it in host byte order before subtracting it from the
332 * host-byte-order value from the header; the adjusted checksum
333 * will be in host byte order, which is what we'll return.
334 */
335 shouldbe = sum;
336 shouldbe += ntohs(computed_sum);
337 shouldbe = (shouldbe & 0xFFFF) + (shouldbe >> 16);
338 shouldbe = (shouldbe & 0xFFFF) + (shouldbe >> 16);
339 return shouldbe;
340 }
341
342 /*
343 * print an IP datagram.
344 */
345 void
346 ip_print(register const u_char *bp, register u_int length)
347 {
348 register const struct ip *ip;
349 register u_int hlen, len, len0, off;
350 register const u_char *cp;
351 u_char nh;
352 int advance;
353 struct protoent *proto;
354
355 ip = (const struct ip *)bp;
356 #ifdef LBL_ALIGN
357 /*
358 * If the IP header is not aligned, copy into abuf.
359 */
360 if ((long)ip & 3) {
361 static u_char *abuf = NULL;
362 static int didwarn = 0;
363
364 if (abuf == NULL) {
365 abuf = (u_char *)malloc(snaplen);
366 if (abuf == NULL)
367 error("ip_print: malloc");
368 }
369 memcpy((char *)abuf, (char *)ip, min(length, snaplen));
370 snapend += abuf - (u_char *)ip;
371 packetp = abuf;
372 ip = (struct ip *)abuf;
373 /* We really want libpcap to give us aligned packets */
374 if (!didwarn) {
375 warning("compensating for unaligned libpcap packets");
376 ++didwarn;
377 }
378 }
379 #endif
380 if ((u_char *)(ip + 1) > snapend) {
381 printf("[|ip]");
382 return;
383 }
384 if (length < sizeof (struct ip)) {
385 (void)printf("truncated-ip %d", length);
386 return;
387 }
388 hlen = IP_HL(ip) * 4;
389 if (hlen < sizeof (struct ip)) {
390 (void)printf("bad-hlen %d", hlen);
391 return;
392 }
393
394 len = ntohs(ip->ip_len);
395 if (length < len)
396 (void)printf("truncated-ip - %d bytes missing! ",
397 len - length);
398 len -= hlen;
399 len0 = len;
400
401 printf("IP ");
402
403 off = ntohs(ip->ip_off);
404
405 if (vflag) {
406 (void)printf("(tos 0x%x", (int)ip->ip_tos);
407 /* ECN bits */
408 if (ip->ip_tos & 0x03) {
409 switch (ip->ip_tos & 0x03) {
410 case 1:
411 (void)printf(",ECT(1)");
412 break;
413 case 2:
414 (void)printf(",ECT(0)");
415 break;
416 case 3:
417 (void)printf(",CE");
418 }
419 }
420
421 if (ip->ip_ttl >= 1)
422 (void)printf(", ttl %d", (int)ip->ip_ttl);
423
424 if ((off & 0x3fff) == 0)
425 (void)printf(", id %d", (int)ntohs(ip->ip_id));
426 (void)printf(", len %d) ", (int)ntohs(ip->ip_len));
427 }
428
429 /*
430 * If this is fragment zero, hand it to the next higher
431 * level protocol.
432 */
433 if ((off & 0x1fff) == 0) {
434 cp = (const u_char *)ip + hlen;
435 nh = ip->ip_p;
436
437 #ifndef IPPROTO_SCTP
438 #define IPPROTO_SCTP 132
439 #endif
440 if (nh != IPPROTO_TCP && nh != IPPROTO_UDP &&
441 nh != IPPROTO_SCTP) {
442 (void)printf("%s > %s: ", ipaddr_string(&ip->ip_src),
443 ipaddr_string(&ip->ip_dst));
444 }
445 again:
446 switch (nh) {
447
448 #ifndef IPPROTO_AH
449 #define IPPROTO_AH 51
450 #endif
451 case IPPROTO_AH:
452 nh = *cp;
453 advance = ah_print(cp);
454 cp += advance;
455 len -= advance;
456 goto again;
457
458 #ifndef IPPROTO_ESP
459 #define IPPROTO_ESP 50
460 #endif
461 case IPPROTO_ESP:
462 {
463 int enh, padlen;
464 advance = esp_print(cp, (const u_char *)ip, &enh, &padlen);
465 cp += advance;
466 len -= advance + padlen;
467 if (enh < 0)
468 break;
469 nh = enh & 0xff;
470 goto again;
471 }
472
473 #ifndef IPPROTO_IPCOMP
474 #define IPPROTO_IPCOMP 108
475 #endif
476 case IPPROTO_IPCOMP:
477 {
478 int enh;
479 advance = ipcomp_print(cp, &enh);
480 cp += advance;
481 len -= advance;
482 if (enh < 0)
483 break;
484 nh = enh & 0xff;
485 goto again;
486 }
487
488 case IPPROTO_SCTP:
489 sctp_print(cp, (const u_char *)ip, len);
490 break;
491
492 case IPPROTO_TCP:
493 tcp_print(cp, len, (const u_char *)ip, (off &~ 0x6000));
494 break;
495
496 case IPPROTO_UDP:
497 udp_print(cp, len, (const u_char *)ip, (off &~ 0x6000));
498 break;
499
500 case IPPROTO_ICMP:
501 icmp_print(cp, len, (const u_char *)ip);
502 break;
503
504 #ifndef IPPROTO_IGRP
505 #define IPPROTO_IGRP 9
506 #endif
507 case IPPROTO_IGRP:
508 igrp_print(cp, len, (const u_char *)ip);
509 break;
510
511 case IPPROTO_ND:
512 (void)printf(" nd %d", len);
513 break;
514
515 case IPPROTO_EGP:
516 egp_print(cp);
517 break;
518
519 #ifndef IPPROTO_OSPF
520 #define IPPROTO_OSPF 89
521 #endif
522 case IPPROTO_OSPF:
523 ospf_print(cp, len, (const u_char *)ip);
524 break;
525
526 #ifndef IPPROTO_IGMP
527 #define IPPROTO_IGMP 2
528 #endif
529 case IPPROTO_IGMP:
530 igmp_print(cp, len);
531 break;
532
533 case 4:
534 /* DVMRP multicast tunnel (ip-in-ip encapsulation) */
535 ip_print(cp, len);
536 if (! vflag) {
537 printf(" (ipip-proto-4)");
538 return;
539 }
540 break;
541
542 #ifdef INET6
543 #ifndef IP6PROTO_ENCAP
544 #define IP6PROTO_ENCAP 41
545 #endif
546 case IP6PROTO_ENCAP:
547 /* ip6-in-ip encapsulation */
548 ip6_print(cp, len);
549 break;
550 #endif /*INET6*/
551
552 #ifndef IPPROTO_RSVP
553 #define IPPROTO_RSVP 46
554 #endif
555 case IPPROTO_RSVP:
556 rsvp_print(cp, len);
557 break;
558
559 #ifndef IPPROTO_GRE
560 #define IPPROTO_GRE 47
561 #endif
562 case IPPROTO_GRE:
563 /* do it */
564 gre_print(cp, len);
565 break;
566
567 #ifndef IPPROTO_MOBILE
568 #define IPPROTO_MOBILE 55
569 #endif
570 case IPPROTO_MOBILE:
571 mobile_print(cp, len);
572 break;
573
574 #ifndef IPPROTO_PIM
575 #define IPPROTO_PIM 103
576 #endif
577 case IPPROTO_PIM:
578 pim_print(cp, len);
579 break;
580
581 #ifndef IPPROTO_VRRP
582 #define IPPROTO_VRRP 112
583 #endif
584 case IPPROTO_VRRP:
585 vrrp_print(cp, len, ip->ip_ttl);
586 break;
587
588 default:
589 if ((proto = getprotobynumber(nh)) != NULL)
590 (void)printf(" %s", proto->p_name);
591 else
592 (void)printf(" ip-proto-%d", nh);
593 printf(" %d", len);
594 break;
595 }
596 }
597
598 /* Ultra quiet now means that all this stuff should be suppressed */
599 /* res 3-Nov-98 */
600 if (qflag > 1) return;
601
602
603 /*
604 * for fragmented datagrams, print id:size@offset. On all
605 * but the last stick a "+". For unfragmented datagrams, note
606 * the don't fragment flag.
607 */
608 len = len0; /* get the original length */
609 if (off & 0x3fff) {
610 /*
611 * if this isn't the first frag, we're missing the
612 * next level protocol header. print the ip addr
613 * and the protocol.
614 */
615 if (off & 0x1fff) {
616 (void)printf("%s > %s:", ipaddr_string(&ip->ip_src),
617 ipaddr_string(&ip->ip_dst));
618 if ((proto = getprotobynumber(ip->ip_p)) != NULL)
619 (void)printf(" %s", proto->p_name);
620 else
621 (void)printf(" ip-proto-%d", ip->ip_p);
622 }
623 #ifndef IP_MF
624 #define IP_MF 0x2000
625 #endif /* IP_MF */
626 #ifndef IP_DF
627 #define IP_DF 0x4000
628 #endif /* IP_DF */
629 (void)printf(" (frag %d:%u@%d%s)", ntohs(ip->ip_id), len,
630 (off & 0x1fff) * 8,
631 (off & IP_MF)? "+" : "");
632
633 } else if (off & IP_DF)
634 (void)printf(" (DF)");
635
636 if (vflag) {
637 u_int16_t sum, ip_sum;
638 const char *sep = "";
639
640 if ((u_char *)ip + hlen <= snapend) {
641 sum = in_cksum((const u_short *)ip, hlen, 0);
642 if (sum != 0) {
643 ip_sum = ntohs(ip->ip_sum);
644 (void)printf("%sbad cksum %x (->%x)!", sep,
645 ip_sum,
646 in_cksum_shouldbe(ip_sum, sum));
647 sep = ", ";
648 }
649 }
650 if ((hlen -= sizeof(struct ip)) > 0) {
651 (void)printf("%soptlen=%d", sep, hlen);
652 ip_optprint((u_char *)(ip + 1), hlen);
653 }
654 }
655
656 }
657
658 void
659 ipN_print(register const u_char *bp, register u_int length)
660 {
661 struct ip *ip, hdr;
662
663 ip = (struct ip *)bp;
664 if (length < 4) {
665 (void)printf("truncated-ip %d", length);
666 return;
667 }
668 memcpy (&hdr, (char *)ip, 4);
669 switch (IP_V(&hdr)) {
670 case 4:
671 ip_print (bp, length);
672 return;
673 #ifdef INET6
674 case 6:
675 ip6_print (bp, length);
676 return;
677 #endif
678 default:
679 (void)printf("unknown ip %d", IP_V(&hdr));
680 return;
681 }
682 }
683
684
685
[mirror] the TCPdump network dissector