CI: Clean in ../libpcap only if present. [skip ci]

[tcpdump] / print-tcp.c

diff --git a/print-tcp.c b/print-tcp.c
index 79dc6c619a67c67dbe6e205ddab69f0ff5b1eccd..59f30558dfece5ab75eca2d04bc786e056a1f214 100644 (file)
--- a/print-tcp.c
+++ b/print-tcp.c
@@ -43,6 +43,8 @@ __RCSID("$NetBSD: print-tcp.c,v 1.8 2007/07/24 11:53:48 drochner Exp $");
 #include "addrtoname.h"
 #include "extract.h"
 
+#include "diag-control.h"
+
 #include "tcp.h"
 
 #include "ip.h"
@@ -172,6 +174,7 @@ tcp_print(netdissect_options *ndo,
         uint16_t magic;
         int rev;
         const struct ip6_hdr *ip6;
+        u_int header_len;      /* Header length in bytes */
 
         ndo->ndo_protocol = "tcp";
         tp = (const struct tcphdr *)bp;
@@ -184,12 +187,12 @@ tcp_print(netdissect_options *ndo,
         if (!ND_TTEST_2(tp->th_dport)) {
                 if (ip6) {
                         ND_PRINT("%s > %s:",
-                                 ip6addr_string(ndo, ip6->ip6_src),
-                                 ip6addr_string(ndo, ip6->ip6_dst));
+                                 GET_IP6ADDR_STRING(ip6->ip6_src),
+                                 GET_IP6ADDR_STRING(ip6->ip6_dst));
                 } else {
                         ND_PRINT("%s > %s:",
-                                 ipaddr_string(ndo, ip->ip_src),
-                                 ipaddr_string(ndo, ip->ip_dst));
+                                 GET_IPADDR_STRING(ip->ip_src),
+                                 GET_IPADDR_STRING(ip->ip_dst));
                 }
                 nd_print_trunc(ndo);
                 return;
@@ -201,9 +204,9 @@ tcp_print(netdissect_options *ndo,
         if (ip6) {
                 if (GET_U_1(ip6->ip6_nxt) == IPPROTO_TCP) {
                         ND_PRINT("%s.%s > %s.%s: ",
-                                 ip6addr_string(ndo, ip6->ip6_src),
+                                 GET_IP6ADDR_STRING(ip6->ip6_src),
                                  tcpport_string(ndo, sport),
-                                 ip6addr_string(ndo, ip6->ip6_dst),
+                                 GET_IP6ADDR_STRING(ip6->ip6_dst),
                                  tcpport_string(ndo, dport));
                 } else {
                         ND_PRINT("%s > %s: ",
@@ -212,9 +215,9 @@ tcp_print(netdissect_options *ndo,
         } else {
                 if (GET_U_1(ip->ip_p) == IPPROTO_TCP) {
                         ND_PRINT("%s.%s > %s.%s: ",
-                                 ipaddr_string(ndo, ip->ip_src),
+                                 GET_IPADDR_STRING(ip->ip_src),
                                  tcpport_string(ndo, sport),
-                                 ipaddr_string(ndo, ip->ip_dst),
+                                 GET_IPADDR_STRING(ip->ip_dst),
                                  tcpport_string(ndo, dport));
                 } else {
                         ND_PRINT("%s > %s: ",
@@ -298,7 +301,7 @@ tcp_print(netdissect_options *ndo,
                                         if (th->nxt == NULL)
                                                 (*ndo->ndo_error)(ndo,
                                                         S_ERR_ND_MEM_ALLOC,
-                                                        "tcp_print: calloc");
+                                                        "%s: calloc", __func__);
                                 }
                                 th->addr = tha;
                                 if (rev)
@@ -356,7 +359,7 @@ tcp_print(netdissect_options *ndo,
                                         if (th->nxt == NULL)
                                                 (*ndo->ndo_error)(ndo,
                                                         S_ERR_ND_MEM_ALLOC,
-                                                        "tcp_print: calloc");
+                                                        "%s: calloc", __func__);
                                 }
                                 th->addr = tha;
                                 if (rev)
@@ -446,13 +449,11 @@ tcp_print(netdissect_options *ndo,
                 while (hlen > 0) {
                         if (ch != '\0')
                                 ND_PRINT("%c", ch);
-                        ND_TCHECK_1(cp);
                         opt = GET_U_1(cp);
                         cp++;
                         if (ZEROLENOPT(opt))
                                 len = 1;
                         else {
-                                ND_TCHECK_1(cp);
                                 len = GET_U_1(cp);
                                 cp++;  /* total including type, len */
                                 if (len < 2 || len > hlen)
@@ -614,11 +615,28 @@ tcp_print(netdissect_options *ndo,
                                 break;
 
                         case TCPOPT_MPTCP:
+                            {
+                                const u_char *snapend_save;
+                                int ret;
+
                                 datalen = len - 2;
                                 LENCHECK(datalen);
-                                if (!mptcp_print(ndo, cp-2, len, flags))
+                                /* Update the snapend to the end of the option
+                                 * before calling mptcp_print(). Some options
+                                 * (MPTCP or others) may be present after a
+                                 * MPTCP option. This prevents that, in
+                                 * mptcp_print(), the remaining length < the
+                                 * remaining caplen.
+                                 */
+                                snapend_save = ndo->ndo_snapend;
+                                ndo->ndo_snapend = ND_MIN(cp - 2 + len,
+                                                          ndo->ndo_snapend);
+                                ret = mptcp_print(ndo, cp - 2, len, flags);
+                                ndo->ndo_snapend = snapend_save;
+                                if (!ret)
                                         goto bad;
                                 break;
+                            }
 
                         case TCPOPT_FASTOPEN:
                                 datalen = len - 2;
@@ -688,7 +706,17 @@ tcp_print(netdissect_options *ndo,
         /*
          * Decode payload if necessary.
          */
-        bp += TH_OFF(tp) * 4;
+        header_len = TH_OFF(tp) * 4;
+        /*
+         * Do a bounds check before decoding the payload.
+         * At least the header data is required.
+         */
+        if (!ND_TTEST_LEN(bp, header_len)) {
+                ND_PRINT(" [remaining caplen(%u) < header length(%u)]",
+                         ND_BYTES_AVAILABLE_AFTER(bp), header_len);
+                nd_trunc_longjmp(ndo);
+        }
+        bp += header_len;
         if ((flags & TH_RST) && ndo->ndo_vflag) {
                 print_tcp_rst_data(ndo, bp, length);
                 return;
@@ -861,7 +889,7 @@ print_tcp_fastopen_option(netdissect_options *ndo, const u_char *cp,
 }
 
 #ifdef HAVE_LIBCRYPTO
-USES_APPLE_DEPRECATED_API
+DIAG_OFF_DEPRECATION
 static int
 tcp_verify_signature(netdissect_options *ndo,
                      const struct ip *ip, const struct tcphdr *tp,
@@ -941,5 +969,5 @@ tcp_verify_signature(netdissect_options *ndo,
         else
                 return (SIGNATURE_INVALID);
 }
-USES_APPLE_RST
+DIAG_ON_DEPRECATION
 #endif /* HAVE_LIBCRYPTO */