+/*
+ * Given the host-byte-order value of the checksum field in a packet
+ * header, and the network-byte-order computed checksum of the data
+ * that the checksum covers (including the checksum itself), compute
+ * what the checksum field *should* have been.
+ */
+u_int16_t
+in_cksum_shouldbe(u_int16_t sum, u_int16_t computed_sum)
+{
+ u_int32_t shouldbe;
+
+ /*
+ * The value that should have gone into the checksum field
+ * is the negative of the value gotten by summing up everything
+ * *but* the checksum field.
+ *
+ * We can compute that by subtracting the value of the checksum
+ * field from the sum of all the data in the packet, and then
+ * computing the negative of that value.
+ *
+ * "sum" is the value of the checksum field, and "computed_sum"
+ * is the negative of the sum of all the data in the packets,
+ * so that's -(-computed_sum - sum), or (sum + computed_sum).
+ *
+ * All the arithmetic in question is one's complement, so the
+ * addition must include an end-around carry; we do this by
+ * doing the arithmetic in 32 bits (with no sign-extension),
+ * and then adding the upper 16 bits of the sum, which contain
+ * the carry, to the lower 16 bits of the sum, and then do it
+ * again in case *that* sum produced a carry.
+ *
+ * As RFC 1071 notes, the checksum can be computed without
+ * byte-swapping the 16-bit words; summing 16-bit words
+ * on a big-endian machine gives a big-endian checksum, which
+ * can be directly stuffed into the big-endian checksum fields
+ * in protocol headers, and summing words on a little-endian
+ * machine gives a little-endian checksum, which must be
+ * byte-swapped before being stuffed into a big-endian checksum
+ * field.
+ *
+ * "computed_sum" is a network-byte-order value, so we must put
+ * it in host byte order before subtracting it from the
+ * host-byte-order value from the header; the adjusted checksum
+ * will be in host byte order, which is what we'll return.
+ */
+ shouldbe = sum;
+ shouldbe += ntohs(computed_sum);
+ shouldbe = (shouldbe & 0xFFFF) + (shouldbe >> 16);
+ shouldbe = (shouldbe & 0xFFFF) + (shouldbe >> 16);
+ return shouldbe;
+}
+
+#define IP_RES 0x8000
+
+static struct tok ip_frag_values[] = {
+ { IP_MF, "+" },
+ { IP_DF, "DF" },
+ { IP_RES, "rsvd" }, /* The RFC3514 evil ;-) bit */
+ { 0, NULL }
+};
+
+struct ip_print_demux_state {
+ const struct ip *ip;
+ const u_char *cp;
+ u_int len, off;
+ u_char nh;
+ int advance;
+};
+
+static void
+ip_print_demux(netdissect_options *ndo,
+ struct ip_print_demux_state *ipds)
+{
+ struct protoent *proto;
+
+again:
+ switch (ipds->nh) {
+
+ case IPPROTO_AH:
+ ipds->nh = *ipds->cp;
+ ipds->advance = ah_print(ipds->cp);
+ if (ipds->advance <= 0)
+ break;
+ ipds->cp += ipds->advance;
+ ipds->len -= ipds->advance;
+ goto again;
+
+ case IPPROTO_ESP:
+ {
+ int enh, padlen;
+ ipds->advance = esp_print(ndo, ipds->cp, ipds->len,
+ (const u_char *)ipds->ip,
+ &enh, &padlen);
+ if (ipds->advance <= 0)
+ break;
+ ipds->cp += ipds->advance;
+ ipds->len -= ipds->advance + padlen;
+ ipds->nh = enh & 0xff;
+ goto again;
+ }
+
+ case IPPROTO_IPCOMP:
+ {
+ int enh;
+ ipds->advance = ipcomp_print(ipds->cp, &enh);
+ if (ipds->advance <= 0)
+ break;
+ ipds->cp += ipds->advance;
+ ipds->len -= ipds->advance;
+ ipds->nh = enh & 0xff;
+ goto again;
+ }
+
+ case IPPROTO_SCTP:
+ sctp_print(ipds->cp, (const u_char *)ipds->ip, ipds->len);
+ break;
+
+ case IPPROTO_DCCP:
+ dccp_print(ipds->cp, (const u_char *)ipds->ip, ipds->len);
+ break;
+
+ case IPPROTO_TCP:
+ /* pass on the MF bit plus the offset to detect fragments */
+ tcp_print(ipds->cp, ipds->len, (const u_char *)ipds->ip,
+ ipds->off & (IP_MF|IP_OFFMASK));
+ break;
+
+ case IPPROTO_UDP:
+ /* pass on the MF bit plus the offset to detect fragments */
+ udp_print(ipds->cp, ipds->len, (const u_char *)ipds->ip,
+ ipds->off & (IP_MF|IP_OFFMASK));
+ break;
+
+ case IPPROTO_ICMP:
+ /* pass on the MF bit plus the offset to detect fragments */
+ icmp_print(ipds->cp, ipds->len, (const u_char *)ipds->ip,
+ ipds->off & (IP_MF|IP_OFFMASK));
+ break;
+
+ case IPPROTO_PIGP:
+ /*
+ * XXX - the current IANA protocol number assignments
+ * page lists 9 as "any private interior gateway
+ * (used by Cisco for their IGRP)" and 88 as
+ * "EIGRP" from Cisco.
+ *
+ * Recent BSD <netinet/in.h> headers define
+ * IP_PROTO_PIGP as 9 and IP_PROTO_IGRP as 88.
+ * We define IP_PROTO_PIGP as 9 and
+ * IP_PROTO_EIGRP as 88; those names better
+ * match was the current protocol number
+ * assignments say.
+ */
+ igrp_print(ipds->cp, ipds->len, (const u_char *)ipds->ip);
+ break;
+
+ case IPPROTO_EIGRP:
+ eigrp_print(ipds->cp, ipds->len);
+ break;
+
+ case IPPROTO_ND:
+ ND_PRINT((ndo, " nd %d", ipds->len));
+ break;
+
+ case IPPROTO_EGP:
+ egp_print(ipds->cp, ipds->len);
+ break;
+
+ case IPPROTO_OSPF:
+ ospf_print(ipds->cp, ipds->len, (const u_char *)ipds->ip);
+ break;
+
+ case IPPROTO_IGMP:
+ igmp_print(ipds->cp, ipds->len);
+ break;
+
+ case IPPROTO_IPV4:
+ /* DVMRP multicast tunnel (ip-in-ip encapsulation) */
+ ip_print(gndo, ipds->cp, ipds->len);
+ if (! vflag) {
+ ND_PRINT((ndo, " (ipip-proto-4)"));
+ return;
+ }
+ break;
+
+#ifdef INET6
+ case IPPROTO_IPV6:
+ /* ip6-in-ip encapsulation */
+ ip6_print(ipds->cp, ipds->len);
+ break;
+#endif /*INET6*/
+
+ case IPPROTO_RSVP:
+ rsvp_print(ipds->cp, ipds->len);
+ break;
+
+ case IPPROTO_GRE:
+ /* do it */
+ gre_print(ipds->cp, ipds->len);
+ break;
+
+ case IPPROTO_MOBILE:
+ mobile_print(ipds->cp, ipds->len);
+ break;
projects / tcpdump / blobdiff