]> The Tcpdump Group git mirrors - tcpdump/blobdiff - print-tcp.c
projects / tcpdump / blobdiff
summary | shortlog | log | commit | commitdiff | tree
raw | inline | side by side
Fix a bound check
[tcpdump] / print-tcp.c
diff --git a/print-tcp.c b/print-tcp.c
index 61fb93e66c3314a8903153ac05c1f16e1a8e20a0..fb7b14a469e826b577cd1fc826c49137435cd9be 100644 (file)
--- a/print-tcp.c
+++ b/print-tcp.c
@@ -187,10 +187,8 @@ tcp_print(netdissect_options *ndo,
                 return;
         }
 
                 return;
         }
 
-        sport = EXTRACT_16BITS(&tp->th_sport);
-        dport = EXTRACT_16BITS(&tp->th_dport);
-
-        hlen = TH_OFF(tp) * 4;
+        sport = EXTRACT_BE_16BITS(&tp->th_sport);
+        dport = EXTRACT_BE_16BITS(&tp->th_dport);
 
         if (ip6) {
                 if (ip6->ip6_nxt == IPPROTO_TCP) {
 
         if (ip6) {
                 if (ip6->ip6_nxt == IPPROTO_TCP) {
@@ -216,18 +214,20 @@ tcp_print(netdissect_options *ndo,
                 }
         }
 
                 }
         }
 
+        ND_TCHECK(*tp);
+
+        hlen = TH_OFF(tp) * 4;
+
         if (hlen < sizeof(*tp)) {
                 ND_PRINT((ndo, " tcp %d [bad hdr length %u - too short, < %lu]",
                              length - hlen, hlen, (unsigned long)sizeof(*tp)));
                 return;
         }
 
         if (hlen < sizeof(*tp)) {
                 ND_PRINT((ndo, " tcp %d [bad hdr length %u - too short, < %lu]",
                              length - hlen, hlen, (unsigned long)sizeof(*tp)));
                 return;
         }
 
-        ND_TCHECK(*tp);
-
-        seq = EXTRACT_32BITS(&tp->th_seq);
-        ack = EXTRACT_32BITS(&tp->th_ack);
-        win = EXTRACT_16BITS(&tp->th_win);
-        urp = EXTRACT_16BITS(&tp->th_urp);
+        seq = EXTRACT_BE_32BITS(&tp->th_seq);
+        ack = EXTRACT_BE_32BITS(&tp->th_ack);
+        win = EXTRACT_BE_16BITS(&tp->th_win);
+        urp = EXTRACT_BE_16BITS(&tp->th_urp);
 
         if (ndo->ndo_qflag) {
                 ND_PRINT((ndo, "tcp %d", length - hlen));
 
         if (ndo->ndo_qflag) {
                 ND_PRINT((ndo, "tcp %d", length - hlen));
@@ -252,12 +252,12 @@ tcp_print(netdissect_options *ndo,
                 if (ip6) {
                         register struct tcp_seq_hash6 *th;
                         struct tcp_seq_hash6 *tcp_seq_hash;
                 if (ip6) {
                         register struct tcp_seq_hash6 *th;
                         struct tcp_seq_hash6 *tcp_seq_hash;
-                        const struct in6_addr *src, *dst;
+                        const void *src, *dst;
                         struct tha6 tha;
 
                         tcp_seq_hash = tcp_seq_hash6;
                         struct tha6 tha;
 
                         tcp_seq_hash = tcp_seq_hash6;
-                        src = &ip6->ip6_src;
-                        dst = &ip6->ip6_dst;
+                        src = (const void *)&ip6->ip6_src;
+                        dst = (const void *)&ip6->ip6_dst;
                         if (sport > dport)
                                 rev = 1;
                         else if (sport == dport) {
                         if (sport > dport)
                                 rev = 1;
                         else if (sport == dport) {
@@ -372,7 +372,7 @@ tcp_print(netdissect_options *ndo,
                 if (IP_V(ip) == 4) {
                         if (ND_TTEST2(tp->th_sport, length)) {
                                 sum = tcp_cksum(ndo, ip, tp, length);
                 if (IP_V(ip) == 4) {
                         if (ND_TTEST2(tp->th_sport, length)) {
                                 sum = tcp_cksum(ndo, ip, tp, length);
-                                tcp_sum = EXTRACT_16BITS(&tp->th_sum);
+                                tcp_sum = EXTRACT_BE_16BITS(&tp->th_sum);
 
                                 ND_PRINT((ndo, ", cksum 0x%04x", tcp_sum));
                                 if (sum != 0)
 
                                 ND_PRINT((ndo, ", cksum 0x%04x", tcp_sum));
                                 if (sum != 0)
@@ -384,7 +384,7 @@ tcp_print(netdissect_options *ndo,
                 } else if (IP_V(ip) == 6 && ip6->ip6_plen) {
                         if (ND_TTEST2(tp->th_sport, length)) {
                                 sum = tcp6_cksum(ndo, ip6, tp, length);
                 } else if (IP_V(ip) == 6 && ip6->ip6_plen) {
                         if (ND_TTEST2(tp->th_sport, length)) {
                                 sum = tcp6_cksum(ndo, ip6, tp, length);
-                                tcp_sum = EXTRACT_16BITS(&tp->th_sum);
+                                tcp_sum = EXTRACT_BE_16BITS(&tp->th_sum);
 
                                 ND_PRINT((ndo, ", cksum 0x%04x", tcp_sum));
                                 if (sum != 0)
 
                                 ND_PRINT((ndo, ", cksum 0x%04x", tcp_sum));
                                 if (sum != 0)
@@ -453,7 +453,7 @@ tcp_print(netdissect_options *ndo,
                         case TCPOPT_MAXSEG:
                                 datalen = 2;
                                 LENCHECK(datalen);
                         case TCPOPT_MAXSEG:
                                 datalen = 2;
                                 LENCHECK(datalen);
-                                ND_PRINT((ndo, " %u", EXTRACT_16BITS(cp)));
+                                ND_PRINT((ndo, " %u", EXTRACT_BE_16BITS(cp)));
                                 break;
 
                         case TCPOPT_WSCALE:
                                 break;
 
                         case TCPOPT_WSCALE:
@@ -472,9 +472,9 @@ tcp_print(netdissect_options *ndo,
                                         ND_PRINT((ndo, " %d ", datalen / 8));
                                         for (i = 0; i < datalen; i += 8) {
                                                 LENCHECK(i + 4);
                                         ND_PRINT((ndo, " %d ", datalen / 8));
                                         for (i = 0; i < datalen; i += 8) {
                                                 LENCHECK(i + 4);
-                                                s = EXTRACT_32BITS(cp + i);
+                                                s = EXTRACT_BE_32BITS(cp + i);
                                                 LENCHECK(i + 8);
                                                 LENCHECK(i + 8);
-                                                e = EXTRACT_32BITS(cp + i + 4);
+                                                e = EXTRACT_BE_32BITS(cp + i + 4);
                                                 if (rev) {
                                                         s -= thseq;
                                                         e -= thseq;
                                                 if (rev) {
                                                         s -= thseq;
                                                         e -= thseq;
@@ -499,15 +499,15 @@ tcp_print(netdissect_options *ndo,
                                  */
                                 datalen = 4;
                                 LENCHECK(datalen);
                                  */
                                 datalen = 4;
                                 LENCHECK(datalen);
-                                ND_PRINT((ndo, " %u", EXTRACT_32BITS(cp)));
+                                ND_PRINT((ndo, " %u", EXTRACT_BE_32BITS(cp)));
                                 break;
 
                         case TCPOPT_TIMESTAMP:
                                 datalen = 8;
                                 LENCHECK(datalen);
                                 ND_PRINT((ndo, " val %u ecr %u",
                                 break;
 
                         case TCPOPT_TIMESTAMP:
                                 datalen = 8;
                                 LENCHECK(datalen);
                                 ND_PRINT((ndo, " val %u ecr %u",
-                                             EXTRACT_32BITS(cp),
-                                             EXTRACT_32BITS(cp + 4)));
+                                             EXTRACT_BE_32BITS(cp),
+                                             EXTRACT_BE_32BITS(cp + 4)));
                                 break;
 
                         case TCPOPT_SIGNATURE:
                                 break;
 
                         case TCPOPT_SIGNATURE:
@@ -546,7 +546,6 @@ tcp_print(netdissect_options *ndo,
 
                         case TCPOPT_TCPAO:
                                 datalen = len - 2;
 
                         case TCPOPT_TCPAO:
                                 datalen = len - 2;
-                                LENCHECK(datalen);
                                 /* RFC 5925 Section 2.2:
                                  * "The Length value MUST be greater than or equal to 4."
                                  * (This includes the Kind and Length fields already processed
                                 /* RFC 5925 Section 2.2:
                                  * "The Length value MUST be greater than or equal to 4."
                                  * (This includes the Kind and Length fields already processed
@@ -555,11 +554,16 @@ tcp_print(netdissect_options *ndo,
                                 if (datalen < 2) {
                                         ND_PRINT((ndo, " invalid"));
                                 } else {
                                 if (datalen < 2) {
                                         ND_PRINT((ndo, " invalid"));
                                 } else {
-                                        ND_PRINT((ndo, " keyid %u rnextkeyid %u", cp[0], cp[1]));
+                                        LENCHECK(1);
+                                        ND_PRINT((ndo, " keyid %u", cp[0]));
+                                        LENCHECK(2);
+                                        ND_PRINT((ndo, " rnextkeyid %u", cp[1]));
                                         if (datalen > 2) {
                                         if (datalen > 2) {
-                                                ND_PRINT((ndo, " mac "));
-                                                for (i = 2; i < datalen; i++)
+                                                ND_PRINT((ndo, " mac 0x"));
+                                                for (i = 2; i < datalen; i++) {
+                                                        LENCHECK(i + 1);
                                                         ND_PRINT((ndo, "%02x", cp[i]));
                                                         ND_PRINT((ndo, "%02x", cp[i]));
+                                                }
                                         }
                                 }
                                 break;
                                         }
                                 }
                                 break;
@@ -576,7 +580,7 @@ tcp_print(netdissect_options *ndo,
                         case TCPOPT_UTO:
                                 datalen = 2;
                                 LENCHECK(datalen);
                         case TCPOPT_UTO:
                                 datalen = 2;
                                 LENCHECK(datalen);
-                                utoval = EXTRACT_16BITS(cp);
+                                utoval = EXTRACT_BE_16BITS(cp);
                                 ND_PRINT((ndo, " 0x%x", utoval));
                                 if (utoval & 0x0001)
                                         utoval = (utoval >> 1) * 60;
                                 ND_PRINT((ndo, " 0x%x", utoval));
                                 if (utoval & 0x0001)
                                         utoval = (utoval >> 1) * 60;
@@ -605,7 +609,7 @@ tcp_print(netdissect_options *ndo,
                                 if (datalen < 2)
                                         goto bad;
                                 /* RFC6994 */
                                 if (datalen < 2)
                                         goto bad;
                                 /* RFC6994 */
-                                magic = EXTRACT_16BITS(cp);
+                                magic = EXTRACT_BE_16BITS(cp);
                                 ND_PRINT((ndo, "-"));
 
                                 switch(magic) {
                                 ND_PRINT((ndo, "-"));
 
                                 switch(magic) {
@@ -626,7 +630,7 @@ tcp_print(netdissect_options *ndo,
                                 if (datalen)
                                         ND_PRINT((ndo, " 0x"));
                                 for (i = 0; i < datalen; ++i) {
                                 if (datalen)
                                         ND_PRINT((ndo, " 0x"));
                                 for (i = 0; i < datalen; ++i) {
-                                        LENCHECK(i);
+                                        LENCHECK(i + 1);
                                         ND_PRINT((ndo, "%02x", cp[i]));
                                 }
                                 break;
                                         ND_PRINT((ndo, "%02x", cp[i]));
                                 }
                                 break;
@@ -683,6 +687,9 @@ tcp_print(netdissect_options *ndo,
         } else if (IS_SRC_OR_DST_PORT(SMTP_PORT)) {
                 ND_PRINT((ndo, ": "));
                 smtp_print(ndo, bp, length);
         } else if (IS_SRC_OR_DST_PORT(SMTP_PORT)) {
                 ND_PRINT((ndo, ": "));
                 smtp_print(ndo, bp, length);
+        } else if (IS_SRC_OR_DST_PORT(WHOIS_PORT)) {
+                ND_PRINT((ndo, ": "));
+                txtproto_print(ndo, bp, length, "whois", NULL, 0); /* RFC 3912 */
         } else if (IS_SRC_OR_DST_PORT(BGP_PORT))
                 bgp_print(ndo, bp, length);
         else if (IS_SRC_OR_DST_PORT(PPTP_PORT))
         } else if (IS_SRC_OR_DST_PORT(BGP_PORT))
                 bgp_print(ndo, bp, length);
         else if (IS_SRC_OR_DST_PORT(PPTP_PORT))
@@ -714,7 +721,7 @@ tcp_print(netdissect_options *ndo,
                  * TCP DNS query has 2byte length at the head.
                  * XXX packet could be unaligned, it can go strange
                  */
                  * TCP DNS query has 2byte length at the head.
                  * XXX packet could be unaligned, it can go strange
                  */
-                ns_print(ndo, bp + 2, length - 2, 0);
+                domain_print(ndo, bp + 2, length - 2, 0);
         } else if (IS_SRC_OR_DST_PORT(MSDP_PORT)) {
                 msdp_print(ndo, bp, length);
         } else if (IS_SRC_OR_DST_PORT(RPKI_RTR_PORT)) {
         } else if (IS_SRC_OR_DST_PORT(MSDP_PORT)) {
                 msdp_print(ndo, bp, length);
         } else if (IS_SRC_OR_DST_PORT(RPKI_RTR_PORT)) {
@@ -735,20 +742,20 @@ tcp_print(netdissect_options *ndo,
                 register const struct sunrpc_msg *rp;
                 enum sunrpc_msg_type direction;
 
                 register const struct sunrpc_msg *rp;
                 enum sunrpc_msg_type direction;
 
-                fraglen = EXTRACT_32BITS(bp) & 0x7FFFFFFF;
+                fraglen = EXTRACT_BE_32BITS(bp) & 0x7FFFFFFF;
                 if (fraglen > (length) - 4)
                         fraglen = (length) - 4;
                 rp = (const struct sunrpc_msg *)(bp + 4);
                 if (ND_TTEST(rp->rm_direction)) {
                 if (fraglen > (length) - 4)
                         fraglen = (length) - 4;
                 rp = (const struct sunrpc_msg *)(bp + 4);
                 if (ND_TTEST(rp->rm_direction)) {
-                        direction = (enum sunrpc_msg_type)EXTRACT_32BITS(&rp->rm_direction);
+                        direction = (enum sunrpc_msg_type) EXTRACT_BE_32BITS(&rp->rm_direction);
                         if (dport == NFS_PORT && direction == SUNRPC_CALL) {
                         if (dport == NFS_PORT && direction == SUNRPC_CALL) {
-                                ND_PRINT((ndo, ": NFS request xid %u ", EXTRACT_32BITS(&rp->rm_xid)));
-                                nfsreq_print_noaddr(ndo, (const u_char *)rp, fraglen, (const u_char *)ip);
+                                ND_PRINT((ndo, ": NFS request xid %u ", EXTRACT_BE_32BITS(&rp->rm_xid)));
+                                nfsreq_noaddr_print(ndo, (const u_char *)rp, fraglen, (const u_char *)ip);
                                 return;
                         }
                         if (sport == NFS_PORT && direction == SUNRPC_REPLY) {
                                 return;
                         }
                         if (sport == NFS_PORT && direction == SUNRPC_REPLY) {
-                                ND_PRINT((ndo, ": NFS reply xid %u ", EXTRACT_32BITS(&rp->rm_xid)));
-                                nfsreply_print_noaddr(ndo, (const u_char *)rp, fraglen, (const u_char *)ip);
+                                ND_PRINT((ndo, ": NFS reply xid %u ", EXTRACT_BE_32BITS(&rp->rm_xid)));
+                                nfsreply_noaddr_print(ndo, (const u_char *)rp, fraglen, (const u_char *)ip);
                                 return;
                         }
                 }
                                 return;
                         }
                 }
@@ -861,14 +868,14 @@ tcp_verify_signature(netdissect_options *ndo,
                 MD5_Update(&ctx, (const char *)&ip->ip_dst, sizeof(ip->ip_dst));
                 MD5_Update(&ctx, (const char *)&zero_proto, sizeof(zero_proto));
                 MD5_Update(&ctx, (const char *)&ip->ip_p, sizeof(ip->ip_p));
                 MD5_Update(&ctx, (const char *)&ip->ip_dst, sizeof(ip->ip_dst));
                 MD5_Update(&ctx, (const char *)&zero_proto, sizeof(zero_proto));
                 MD5_Update(&ctx, (const char *)&ip->ip_p, sizeof(ip->ip_p));
-                tlen = EXTRACT_16BITS(&ip->ip_len) - IP_HL(ip) * 4;
+                tlen = EXTRACT_BE_16BITS(&ip->ip_len) - IP_HL(ip) * 4;
                 tlen = htons(tlen);
                 MD5_Update(&ctx, (const char *)&tlen, sizeof(tlen));
         } else if (IP_V(ip) == 6) {
                 ip6 = (const struct ip6_hdr *)ip;
                 MD5_Update(&ctx, (const char *)&ip6->ip6_src, sizeof(ip6->ip6_src));
                 MD5_Update(&ctx, (const char *)&ip6->ip6_dst, sizeof(ip6->ip6_dst));
                 tlen = htons(tlen);
                 MD5_Update(&ctx, (const char *)&tlen, sizeof(tlen));
         } else if (IP_V(ip) == 6) {
                 ip6 = (const struct ip6_hdr *)ip;
                 MD5_Update(&ctx, (const char *)&ip6->ip6_src, sizeof(ip6->ip6_src));
                 MD5_Update(&ctx, (const char *)&ip6->ip6_dst, sizeof(ip6->ip6_dst));
-                len32 = htonl(EXTRACT_16BITS(&ip6->ip6_plen));
+                len32 = htonl(EXTRACT_BE_16BITS(&ip6->ip6_plen));
                 MD5_Update(&ctx, (const char *)&len32, sizeof(len32));
                 nxt = 0;
                 MD5_Update(&ctx, (const char *)&nxt, sizeof(nxt));
                 MD5_Update(&ctx, (const char *)&len32, sizeof(len32));
                 nxt = 0;
                 MD5_Update(&ctx, (const char *)&nxt, sizeof(nxt));
[mirror] the TCPdump network dissector