Guy Harris [Mon, 8 Feb 2010 01:47:31 +0000 (17:47 -0800)]
Check the containing item length in some loops.
In some loops, don't loop just until we get an error, stop when we run
out of data to parse.
Also, add some comments to indicate what we know about lengths at
various points, before we do something with the length that happens to
assume what we know. Add some checks that this auditing found
necessary.
Guy Harris [Mon, 8 Feb 2010 00:05:46 +0000 (16:05 -0800)]
Use #defines rather than sizeof.
Use ForCES_HDRL, TLV_HDRL, and ILV_HDRL instead of various sizeof's, to
make it clearer what certain tests ensure are true (as, in other cases,
the #defines are subtracted from values that should be, at that point,
ensured not to be less than the #define in question).
Guy Harris [Wed, 27 Jan 2010 02:43:22 +0000 (18:43 -0800)]
Add TCHECKs, make length variables 32 bits.
Add TCHECK/TCHECK2 calls to make sure we are within the packet boundary
before fetching data. Make some length variables that could in theory
have values that don't fit in 16 bits 32 bits long.
Guy Harris [Wed, 27 Jan 2010 02:37:41 +0000 (18:37 -0800)]
Use EXTRACT_16BITS and EXTRACT_32BITS to extract values from a packet.
There's no guarantee that those values are aligned on the appropriate
boundary, nor is there a guarantee that accessing misaligned values will
behave as desired.
Guy Harris [Wed, 27 Jan 2010 02:35:53 +0000 (18:35 -0800)]
Use EXTRACT_16BITS to extract big-endian 16-bit quantities from the packet.
There's no guarantee that those quantities will be properly aligned, nor
is there any guarantee that fetching an improperly-aligned quantity will
work as desired.
Guy Harris [Wed, 27 Jan 2010 01:56:36 +0000 (17:56 -0800)]
Use EXTRACT_16BITS() and EXTRACT_32BITS() to fetch integral values.
Use EXTRACT_16BITS() and EXTRACT_32BITS() to fetch 16-bit and 32-bit
big-endian quantities from the packet, as there's no guarantee that a
given 16-bit quantity will be aligned on a 2-byte boundary or that a
given 32-bit quantity will be aligned on a 4-byte boundary, nor is there
a guarantee that unaligned accesses will succeed (they might trap, or
they might not fetch an unaligned quantity).
Lucas C. Villa Real [Tue, 26 Jan 2010 20:09:24 +0000 (12:09 -0800)]
Enhance NFS access request messages.
When debugging NFS operations one may find it easier to get the actual access
flags decoded rather than having to look up the NFS access flags to find which
permissions were requested by the client.
Guy Harris [Mon, 11 Jan 2010 02:00:08 +0000 (18:00 -0800)]
Get rid of BIG_ENDIAN and LITTLE_ENDIAN definitions.
The configure script doesn't define BYTE_ORDER, so they can't validly be
compared against BYTE_ORDER; don't leave them around for people to think
they can.
Guy Harris [Wed, 25 Nov 2009 21:26:52 +0000 (13:26 -0800)]
ether_encap_print() is a utility for use by printers for protocols that
use Ethernet types, to call the appropriate printer routine for the
encapsulated type. IPNET is the only protocol using IPNET types, so
ipnet_encap_print() isn't needed.
Guy Harris [Tue, 1 Dec 2009 08:39:54 +0000 (00:39 -0800)]
When printing a list of link-layer types for -L, give the name of the
device for which they're being reported, so if no -i flag was given
people don't think it's something such as the union of of all link-layer
types supported by all devices, and, if we can determine whether the
device supports monitor mode (with libpcap 1.0.0 and later), indicate
whether the link-layer types are the ones supported when not in monitor
mode (if -I wasn't specified) or when in monitor mode (if -I was
specified), so people don't wonder why some types aren't available (as
some are available only in monitor mode, and others are available only
when not in monitor mode, on some platforms).
Guy Harris [Wed, 25 Nov 2009 21:26:52 +0000 (13:26 -0800)]
ether_encap_print() is a utility for use by printers for protocols that
use Ethernet types, to call the appropriate printer routine for the
encapsulated type. IPNET is the only protocol using IPNET types, so
ipnet_encap_print() isn't needed.
Darren Reed [Wed, 25 Nov 2009 02:20:25 +0000 (21:20 -0500)]
The patches attached to this email are required to get a fully working tcpdump
on OpenSolaris, or Solaris Express Community Edition, build 125 and later.
The attached patch introduces support for printing out the IPNET headers used
for packet capture inside of zones that share their networking with the global
zone and for packets "transmitted" between zones.
tcpdump 4.0.0 will ship with builds 129 and later of OpenSolaris/SXCE and
when run as root with the '-L' option, should behave as below to indicate that
the system is fully functional:
Data link types (use option -y to set):
DOCSIS (DOCSIS) (printing not supported)
IPNET (Solaris IPNET)
EN10MB (Ethernet)
Guy Harris [Tue, 17 Nov 2009 00:36:37 +0000 (16:36 -0800)]
Remove print-X.out, as it collides with print-x.out on systems with
case-insensitive file systems; print-capX.out has the same contents as
the most recent version of print-X.out, and doesn't collide with
print-x.out.
updated print-flags test case to have new TCP flags
to print-capXX.out, prior to removing print-XX.out (again - see previous
commits; it collides with print-xx.out on systems with case-insensitive
file systems).
Guy Harris [Tue, 17 Nov 2009 00:34:14 +0000 (16:34 -0800)]
print-XX.out collides with print-xx.out on systems with case-insensitive
file systems; we've propagated the latest version of print-XX.out to
print-capXX.out, so get rid of print-XX.out.
updated print-flags test case to have new TCP flags
to print-capXX.out, prior to removing print-XX.out (again - see previous
commits; it collides with print-xx.out on systems with case-insensitive
file systems).
Guy Harris [Wed, 4 Nov 2009 22:55:05 +0000 (14:55 -0800)]
When parsing IEs in a management frame, save the *first* IE of a given
type we see, not the *last*, so the first one gets printed. If,
however, a rates IE has a zero-length list of rates, don't save that
one; some devices send out frames with two rates IEs, one zero-length
and a later one containing the actual rates.
Have parse_elements() return an indication of whether truncation
occurred - and pass it the frame length, so it doesn't just keep parsing
until an end-of-captured-data test fails, as that would make *every*
frame look truncated.
Guy Harris [Sun, 11 Oct 2009 19:49:05 +0000 (12:49 -0700)]
Use tok2strbuf() rather than doing it by hand (with potentially-unsafe
routines). Thanks and a tip of the Hatlo hat to OpenBSD's linker for
warning about that.
Guy Harris [Tue, 18 Aug 2009 22:02:37 +0000 (15:02 -0700)]
From Fang Wang:
RFC 5482 specifies a new TCP option -- the TCP User Timeout
Option (UTO) -- that allows one end of a TCP connection to
advertise its current user timeout value. The Kind of UTO
option is 28 and the Length is 4. The tcpdump currently does
not recognize UTO option.
Guy Harris [Tue, 18 Aug 2009 21:56:06 +0000 (14:56 -0700)]
Just use a u_char * to go through the packet data; don't try to be
clever and use a u_int16_t * - the generated code will be the same, and
this code works even if the Offset Size field value is odd.
Guy Harris [Wed, 8 Jul 2009 08:22:27 +0000 (01:22 -0700)]
Get rid of some autoconf macros not used, or no longer used, with
tcpdump.
Check whether __attribute__((format)) can be applied to function
pointers and, if not, don't apply it to function pointers; some older
versions of GCC appear to support applying it to functions, but not
pointers to functions.
As we've gotten rid of missing/getaddrinfo.c, don't use it.
Guy Harris [Sun, 5 Jul 2009 00:57:01 +0000 (17:57 -0700)]
In AC_LBL_C_INIT, don't explicitly set V_CCOPT, just set $1, as is done
elsewhere in the macro.
For the Alpha C compiler, don't set -std1 unless it's necessary for ANSI
mode - we don't want to limit the compiler only to C89 features and,
more importantly, C89 headers (<inttypes.h> doesn't work, on at least
some versions of Digital UNIX and some C compiler versions, with -std1).
Guy Harris [Thu, 2 Jul 2009 18:55:55 +0000 (11:55 -0700)]
As with libpcap, so with tcpdump; when testing whether "inline" works,
use the V_CCOPT flags, because some of those might disable inlining;
otherwise, the test for inlining will succeed, but inlining won't work
with the options we're using when compiling.
Guy Harris [Thu, 2 Jul 2009 18:55:00 +0000 (11:55 -0700)]
As with libpcap, so with tcpdump; when testing whether "inline" works,
use the V_CCOPT flags, because some of those might disable inlining;
otherwise, the test for inlining will succeed, but inlining won't work
with the options we're using when compiling.