X-Git-Url: https://git.tcpdump.org/tcpdump/blobdiff_plain/90dc6cb57568f34f9f67832cc05d7ede213de433..6c8ef0eb86a39c277d1a43802dd8ea01b51cfb2a:/print-mobility.c

diff --git a/print-mobility.c b/print-mobility.c
index 71cc85b5..feb4c98f 100644
--- a/print-mobility.c
+++ b/print-mobility.c
@@ -28,6 +28,7 @@
  */
 
 /* \summary: IPv6 mobility printer */
+/* RFC 3775 */
 
 #ifdef HAVE_CONFIG_H
 #include "config.h"
@@ -35,11 +36,12 @@
 
 #include <netdissect-stdinc.h>
 
-#include "ip6.h"
 #include "netdissect.h"
 #include "addrtoname.h"
 #include "extract.h"
 
+#include "ip6.h"
+
 static const char tstr[] = "[|MOBILITY]";
 
 /* Mobility header */
@@ -148,6 +150,7 @@ mobility_opt_print(netdissect_options *ndo,
 				goto trunc;
 			}
 			/* units of 4 secs */
+			ND_TCHECK_16BITS(&bp[i+2]);
 			ND_PRINT((ndo, "(refresh: %u)",
 				EXTRACT_16BITS(&bp[i+2]) << 2));
 			break;
@@ -156,6 +159,7 @@ mobility_opt_print(netdissect_options *ndo,
 				ND_PRINT((ndo, "(altcoa: trunc)"));
 				goto trunc;
 			}
+			ND_TCHECK_128BITS(&bp[i+2]);
 			ND_PRINT((ndo, "(alt-CoA: %s)", ip6addr_string(ndo, &bp[i+2])));
 			break;
 		case IP6MOPT_NONCEID:
@@ -163,6 +167,8 @@ mobility_opt_print(netdissect_options *ndo,
 				ND_PRINT((ndo, "(ni: trunc)"));
 				goto trunc;
 			}
+			ND_TCHECK_16BITS(&bp[i+2]);
+			ND_TCHECK_16BITS(&bp[i+4]);
 			ND_PRINT((ndo, "(ni: ho=0x%04x co=0x%04x)",
 				EXTRACT_16BITS(&bp[i+2]),
 				EXTRACT_16BITS(&bp[i+4])));
@@ -241,7 +247,7 @@ mobility_print(netdissect_options *ndo,
 	case IP6M_CAREOF_TEST_INIT:
 		hlen = IP6M_MINLEN;
 		if (ndo->ndo_vflag) {
-			ND_TCHECK2(*mh, hlen + 8);
+			ND_TCHECK_32BITS(&bp[hlen + 4]);
 			ND_PRINT((ndo, " %s Init Cookie=%08x:%08x",
 			       type == IP6M_HOME_TEST_INIT ? "Home" : "Care-of",
 			       EXTRACT_32BITS(&bp[hlen]),
@@ -255,7 +261,7 @@ mobility_print(netdissect_options *ndo,
 		ND_PRINT((ndo, " nonce id=0x%x", EXTRACT_16BITS(&mh->ip6m_data16[0])));
 		hlen = IP6M_MINLEN;
 		if (ndo->ndo_vflag) {
-			ND_TCHECK2(*mh, hlen + 8);
+			ND_TCHECK_32BITS(&bp[hlen + 4]);
 			ND_PRINT((ndo, " %s Init Cookie=%08x:%08x",
 			       type == IP6M_HOME_TEST ? "Home" : "Care-of",
 			       EXTRACT_32BITS(&bp[hlen]),
@@ -263,7 +269,7 @@ mobility_print(netdissect_options *ndo,
 		}
 		hlen += 8;
 		if (ndo->ndo_vflag) {
-			ND_TCHECK2(*mh, hlen + 8);
+			ND_TCHECK_32BITS(&bp[hlen + 4]);
 			ND_PRINT((ndo, " %s Keygen Token=%08x:%08x",
 			       type == IP6M_HOME_TEST ? "Home" : "Care-of",
 			       EXTRACT_32BITS(&bp[hlen]),
@@ -275,22 +281,23 @@ mobility_print(netdissect_options *ndo,
 		ND_TCHECK(mh->ip6m_data16[0]);
 		ND_PRINT((ndo, " seq#=%u", EXTRACT_16BITS(&mh->ip6m_data16[0])));
 		hlen = IP6M_MINLEN;
-		ND_TCHECK2(*mh, hlen + 1);
-		if (bp[hlen] & 0xf0)
+		ND_TCHECK_16BITS(&bp[hlen]);
+		if (bp[hlen] & 0xf0) {
 			ND_PRINT((ndo, " "));
-		if (bp[hlen] & 0x80)
-			ND_PRINT((ndo, "A"));
-		if (bp[hlen] & 0x40)
-			ND_PRINT((ndo, "H"));
-		if (bp[hlen] & 0x20)
-			ND_PRINT((ndo, "L"));
-		if (bp[hlen] & 0x10)
-			ND_PRINT((ndo, "K"));
+			if (bp[hlen] & 0x80)
+				ND_PRINT((ndo, "A"));
+			if (bp[hlen] & 0x40)
+				ND_PRINT((ndo, "H"));
+			if (bp[hlen] & 0x20)
+				ND_PRINT((ndo, "L"));
+			if (bp[hlen] & 0x10)
+				ND_PRINT((ndo, "K"));
+		}
 		/* Reserved (4bits) */
 		hlen += 1;
 		/* Reserved (8bits) */
 		hlen += 1;
-		ND_TCHECK2(*mh, hlen + 2);
+		ND_TCHECK_16BITS(&bp[hlen]);
 		/* units of 4 secs */
 		ND_PRINT((ndo, " lifetime=%u", EXTRACT_16BITS(&bp[hlen]) << 2));
 		hlen += 2;
@@ -298,14 +305,15 @@ mobility_print(netdissect_options *ndo,
 	case IP6M_BINDING_ACK:
 		ND_TCHECK(mh->ip6m_data8[0]);
 		ND_PRINT((ndo, " status=%u", mh->ip6m_data8[0]));
+		ND_TCHECK(mh->ip6m_data8[1]);
 		if (mh->ip6m_data8[1] & 0x80)
 			ND_PRINT((ndo, " K"));
 		/* Reserved (7bits) */
 		hlen = IP6M_MINLEN;
-		ND_TCHECK2(*mh, hlen + 2);
+		ND_TCHECK_16BITS(&bp[hlen]);
 		ND_PRINT((ndo, " seq#=%u", EXTRACT_16BITS(&bp[hlen])));
 		hlen += 2;
-		ND_TCHECK2(*mh, hlen + 2);
+		ND_TCHECK_16BITS(&bp[hlen]);
 		/* units of 4 secs */
 		ND_PRINT((ndo, " lifetime=%u", EXTRACT_16BITS(&bp[hlen]) << 2));
 		hlen += 2;
@@ -315,7 +323,7 @@ mobility_print(netdissect_options *ndo,
 		ND_PRINT((ndo, " status=%u", mh->ip6m_data8[0]));
 		/* Reserved */
 		hlen = IP6M_MINLEN;
-		ND_TCHECK2(*mh, hlen + 16);
+		ND_TCHECK2(bp[hlen], 16);
 		ND_PRINT((ndo, " homeaddr %s", ip6addr_string(ndo, &bp[hlen])));
 		hlen += 16;
 		break;
@@ -332,5 +340,5 @@ mobility_print(netdissect_options *ndo,
 
  trunc:
 	ND_PRINT((ndo, "%s", tstr));
-	return(mhlen);
+	return(-1);
 }