2 * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997
3 * The Regents of the University of California. All rights reserved.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
22 #include <sys/cdefs.h>
24 __RCSID("$NetBSD: print-ip.c,v 1.8 2015/03/31 21:59:35 christos Exp $");
27 #define NETDISSECT_REWORKED
32 #include <tcpdump-stdinc.h>
36 #include "interface.h"
37 #include "addrtoname.h"
38 #include "extract.h" /* must come after interface.h */
43 static const char tstr
[] = "[|ip]";
45 static const struct tok ip_option_values
[] = {
48 { IPOPT_TS
, "timestamp" },
49 { IPOPT_SECURITY
, "security" },
51 { IPOPT_SSRR
, "SSRR" },
52 { IPOPT_LSRR
, "LSRR" },
54 { IPOPT_RFC1393
, "traceroute" },
59 * print the recorded route in an IP RR, LSRR or SSRR option.
62 ip_printroute(netdissect_options
*ndo
,
63 register const u_char
*cp
, u_int length
)
69 ND_PRINT((ndo
, " [bad length %u]", length
));
73 ND_PRINT((ndo
, " [bad length %u]", length
));
75 if (ptr
< 3 || ((ptr
+ 1) & 3) || ptr
> length
+ 1)
76 ND_PRINT((ndo
, " [bad ptr %u]", cp
[2]));
78 for (len
= 3; len
< length
; len
+= 4) {
79 ND_PRINT((ndo
, " %s", ipaddr_string(ndo
, &cp
[len
])));
86 * If source-routing is present and valid, return the final destination.
87 * Otherwise, return IP destination.
89 * This is used for UDP and TCP pseudo-header in the checksum
93 ip_finddst(netdissect_options
*ndo
,
101 cp
= (const u_char
*)(ip
+ 1);
102 length
= (IP_HL(ip
) << 2) - sizeof(struct ip
);
104 for (; length
> 0; cp
+= len
, length
-= len
) {
111 else if (tt
== IPOPT_NOP
)
119 ND_TCHECK2(*cp
, len
);
126 UNALIGNED_MEMCPY(&retval
, cp
+ len
- 4, 4);
131 UNALIGNED_MEMCPY(&retval
, &ip
->ip_dst
.s_addr
, sizeof(uint32_t));
136 * Compute a V4-style checksum by building a pseudoheader.
139 nextproto4_cksum(netdissect_options
*ndo
,
140 const struct ip
*ip
, const uint8_t *data
,
141 u_int len
, u_int covlen
, u_int next_proto
)
150 struct cksum_vec vec
[2];
152 /* pseudo-header.. */
153 ph
.len
= htons((uint16_t)len
);
155 ph
.proto
= next_proto
;
156 UNALIGNED_MEMCPY(&ph
.src
, &ip
->ip_src
.s_addr
, sizeof(uint32_t));
158 UNALIGNED_MEMCPY(&ph
.dst
, &ip
->ip_dst
.s_addr
, sizeof(uint32_t));
160 ph
.dst
= ip_finddst(ndo
, ip
);
162 vec
[0].ptr
= (const uint8_t *)(void *)&ph
;
163 vec
[0].len
= sizeof(ph
);
166 return (in_cksum(vec
, 2));
170 ip_printts(netdissect_options
*ndo
,
171 register const u_char
*cp
, u_int length
)
179 ND_PRINT((ndo
, "[bad length %u]", length
));
182 ND_PRINT((ndo
, " TS{"));
183 hoplen
= ((cp
[3]&0xF) != IPOPT_TS_TSONLY
) ? 8 : 4;
184 if ((length
- 4) & (hoplen
-1))
185 ND_PRINT((ndo
, "[bad length %u]", length
));
188 if (ptr
< 4 || ((ptr
- 4) & (hoplen
-1)) || ptr
> length
+ 1)
189 ND_PRINT((ndo
, "[bad ptr %u]", cp
[2]));
191 case IPOPT_TS_TSONLY
:
192 ND_PRINT((ndo
, "TSONLY"));
194 case IPOPT_TS_TSANDADDR
:
195 ND_PRINT((ndo
, "TS+ADDR"));
198 * prespecified should really be 3, but some ones might send 2
199 * instead, and the IPOPT_TS_PRESPEC constant can apparently
200 * have both values, so we have to hard-code it here.
204 ND_PRINT((ndo
, "PRESPEC2.0"));
206 case 3: /* IPOPT_TS_PRESPEC */
207 ND_PRINT((ndo
, "PRESPEC"));
210 ND_PRINT((ndo
, "[bad ts type %d]", cp
[3]&0xF));
215 for (len
= 4; len
< length
; len
+= hoplen
) {
218 ND_PRINT((ndo
, "%s%d@%s", type
, EXTRACT_32BITS(&cp
[len
+hoplen
-4]),
219 hoplen
!=8 ? "" : ipaddr_string(ndo
, &cp
[len
])));
224 ND_PRINT((ndo
, "%s", ptr
== len
? " ^ " : ""));
227 ND_PRINT((ndo
, " [%d hops not recorded]} ", cp
[3]>>4));
229 ND_PRINT((ndo
, "}"));
236 ip_optprint(netdissect_options
*ndo
,
237 register const u_char
*cp
, u_int length
)
239 register u_int option_len
;
240 const char *sep
= "";
242 for (; length
> 0; cp
+= option_len
, length
-= option_len
) {
245 ND_PRINT((ndo
, "%s", sep
));
252 tok2str(ip_option_values
,"unknown %u",option_code
)));
254 if (option_code
== IPOPT_NOP
||
255 option_code
== IPOPT_EOL
)
261 if (option_len
< 2) {
262 ND_PRINT((ndo
, " [bad length %u]", option_len
));
267 if (option_len
> length
) {
268 ND_PRINT((ndo
, " [bad length %u]", option_len
));
272 ND_TCHECK2(*cp
, option_len
);
274 switch (option_code
) {
279 ip_printts(ndo
, cp
, option_len
);
282 case IPOPT_RR
: /* fall through */
285 ip_printroute(ndo
, cp
, option_len
);
289 if (option_len
< 4) {
290 ND_PRINT((ndo
, " [bad length %u]", option_len
));
294 if (EXTRACT_16BITS(&cp
[2]) != 0)
295 ND_PRINT((ndo
, " value %u", EXTRACT_16BITS(&cp
[2])));
298 case IPOPT_NOP
: /* nothing to print - fall through */
307 ND_PRINT((ndo
, "%s", tstr
));
310 #define IP_RES 0x8000
312 static const struct tok ip_frag_values
[] = {
315 { IP_RES
, "rsvd" }, /* The RFC3514 evil ;-) bit */
319 struct ip_print_demux_state
{
328 ip_print_demux(netdissect_options
*ndo
,
329 struct ip_print_demux_state
*ipds
)
331 struct protoent
*proto
;
332 struct cksum_vec vec
[1];
338 ipds
->nh
= *ipds
->cp
;
339 ipds
->advance
= ah_print(ndo
, ipds
->cp
);
340 if (ipds
->advance
<= 0)
342 ipds
->cp
+= ipds
->advance
;
343 ipds
->len
-= ipds
->advance
;
349 ipds
->advance
= esp_print(ndo
, ipds
->cp
, ipds
->len
,
350 (const u_char
*)ipds
->ip
,
352 if (ipds
->advance
<= 0)
354 ipds
->cp
+= ipds
->advance
;
355 ipds
->len
-= ipds
->advance
+ padlen
;
356 ipds
->nh
= enh
& 0xff;
363 ipds
->advance
= ipcomp_print(ndo
, ipds
->cp
, &enh
);
364 if (ipds
->advance
<= 0)
366 ipds
->cp
+= ipds
->advance
;
367 ipds
->len
-= ipds
->advance
;
368 ipds
->nh
= enh
& 0xff;
373 sctp_print(ndo
, ipds
->cp
, (const u_char
*)ipds
->ip
, ipds
->len
);
377 dccp_print(ndo
, ipds
->cp
, (const u_char
*)ipds
->ip
, ipds
->len
);
381 /* pass on the MF bit plus the offset to detect fragments */
382 tcp_print(ndo
, ipds
->cp
, ipds
->len
, (const u_char
*)ipds
->ip
,
383 ipds
->off
& (IP_MF
|IP_OFFMASK
));
387 /* pass on the MF bit plus the offset to detect fragments */
388 udp_print(ndo
, ipds
->cp
, ipds
->len
, (const u_char
*)ipds
->ip
,
389 ipds
->off
& (IP_MF
|IP_OFFMASK
));
393 /* pass on the MF bit plus the offset to detect fragments */
394 icmp_print(ndo
, ipds
->cp
, ipds
->len
, (const u_char
*)ipds
->ip
,
395 ipds
->off
& (IP_MF
|IP_OFFMASK
));
400 * XXX - the current IANA protocol number assignments
401 * page lists 9 as "any private interior gateway
402 * (used by Cisco for their IGRP)" and 88 as
403 * "EIGRP" from Cisco.
405 * Recent BSD <netinet/in.h> headers define
406 * IP_PROTO_PIGP as 9 and IP_PROTO_IGRP as 88.
407 * We define IP_PROTO_PIGP as 9 and
408 * IP_PROTO_EIGRP as 88; those names better
409 * match was the current protocol number
412 igrp_print(ndo
, ipds
->cp
, ipds
->len
);
416 eigrp_print(ndo
, ipds
->cp
, ipds
->len
);
420 ND_PRINT((ndo
, " nd %d", ipds
->len
));
424 egp_print(ndo
, ipds
->cp
, ipds
->len
);
428 ospf_print(ndo
, ipds
->cp
, ipds
->len
, (const u_char
*)ipds
->ip
);
432 igmp_print(ndo
, ipds
->cp
, ipds
->len
);
436 /* DVMRP multicast tunnel (ip-in-ip encapsulation) */
437 ip_print(ndo
, ipds
->cp
, ipds
->len
);
438 if (! ndo
->ndo_vflag
) {
439 ND_PRINT((ndo
, " (ipip-proto-4)"));
445 /* ip6-in-ip encapsulation */
446 ip6_print(ndo
, ipds
->cp
, ipds
->len
);
450 rsvp_print(ndo
, ipds
->cp
, ipds
->len
);
455 gre_print(ndo
, ipds
->cp
, ipds
->len
);
459 mobile_print(ndo
, ipds
->cp
, ipds
->len
);
463 vec
[0].ptr
= ipds
->cp
;
464 vec
[0].len
= ipds
->len
;
465 pim_print(ndo
, ipds
->cp
, ipds
->len
, in_cksum(vec
, 1));
469 if (ndo
->ndo_packettype
== PT_CARP
) {
471 ND_PRINT((ndo
, "carp %s > %s: ",
472 ipaddr_string(ndo
, &ipds
->ip
->ip_src
),
473 ipaddr_string(ndo
, &ipds
->ip
->ip_dst
)));
474 carp_print(ndo
, ipds
->cp
, ipds
->len
, ipds
->ip
->ip_ttl
);
477 ND_PRINT((ndo
, "vrrp %s > %s: ",
478 ipaddr_string(ndo
, &ipds
->ip
->ip_src
),
479 ipaddr_string(ndo
, &ipds
->ip
->ip_dst
)));
480 vrrp_print(ndo
, ipds
->cp
, ipds
->len
,
481 (const u_char
*)ipds
->ip
, ipds
->ip
->ip_ttl
);
486 pgm_print(ndo
, ipds
->cp
, ipds
->len
, (const u_char
*)ipds
->ip
);
490 pfsync_ip_print(ipds
->cp
, ipds
->len
, (const u_char
*)ipds
->ip
);
494 if (ndo
->ndo_nflag
==0 && (proto
= getprotobynumber(ipds
->nh
)) != NULL
)
495 ND_PRINT((ndo
, " %s", proto
->p_name
));
497 ND_PRINT((ndo
, " ip-proto-%d", ipds
->nh
));
498 ND_PRINT((ndo
, " %d", ipds
->len
));
504 ip_print_inner(netdissect_options
*ndo
,
506 u_int length
, u_int nh
,
509 struct ip_print_demux_state ipd
;
511 ipd
.ip
= (const struct ip
*)bp2
;
518 ip_print_demux(ndo
, &ipd
);
523 * print an IP datagram.
526 ip_print(netdissect_options
*ndo
,
530 struct ip_print_demux_state ipd
;
531 struct ip_print_demux_state
*ipds
=&ipd
;
534 struct cksum_vec vec
[1];
535 uint16_t sum
, ip_sum
;
536 struct protoent
*proto
;
538 ipds
->ip
= (const struct ip
*)bp
;
539 ND_TCHECK(ipds
->ip
->ip_vhl
);
540 if (IP_V(ipds
->ip
) != 4) { /* print version if != 4 */
541 if (IP_V(ipds
->ip
) == 6)
542 ND_PRINT((ndo
, "IP6, wrong link-layer encapsulation "));
544 ND_PRINT((ndo
, "IP%u ", IP_V(ipds
->ip
)));
546 else if (!ndo
->ndo_eflag
)
547 ND_PRINT((ndo
, "IP "));
549 ND_TCHECK(*ipds
->ip
);
550 if (length
< sizeof (struct ip
)) {
551 ND_PRINT((ndo
, "truncated-ip %u", length
));
554 hlen
= IP_HL(ipds
->ip
) * 4;
555 if (hlen
< sizeof (struct ip
)) {
556 ND_PRINT((ndo
, "bad-hlen %u", hlen
));
560 ipds
->len
= EXTRACT_16BITS(&ipds
->ip
->ip_len
);
561 if (length
< ipds
->len
)
562 ND_PRINT((ndo
, "truncated-ip - %u bytes missing! ",
563 ipds
->len
- length
));
564 if (ipds
->len
< hlen
) {
567 ND_PRINT((ndo
, "bad-len %u", ipds
->len
));
571 /* we guess that it is a TSO send */
575 ND_PRINT((ndo
, "bad-len %u", ipds
->len
));
577 #endif /* GUESS_TSO */
581 * Cut off the snapshot length to the end of the IP payload.
583 ipend
= bp
+ ipds
->len
;
584 if (ipend
< ndo
->ndo_snapend
)
585 ndo
->ndo_snapend
= ipend
;
589 ipds
->off
= EXTRACT_16BITS(&ipds
->ip
->ip_off
);
591 if (ndo
->ndo_vflag
) {
592 ND_PRINT((ndo
, "(tos 0x%x", (int)ipds
->ip
->ip_tos
));
594 if (ipds
->ip
->ip_tos
& 0x03) {
595 switch (ipds
->ip
->ip_tos
& 0x03) {
597 ND_PRINT((ndo
, ",ECT(1)"));
600 ND_PRINT((ndo
, ",ECT(0)"));
603 ND_PRINT((ndo
, ",CE"));
607 if (ipds
->ip
->ip_ttl
>= 1)
608 ND_PRINT((ndo
, ", ttl %u", ipds
->ip
->ip_ttl
));
611 * for the firewall guys, print id, offset.
612 * On all but the last stick a "+" in the flags portion.
613 * For unfragmented datagrams, note the don't fragment flag.
616 ND_PRINT((ndo
, ", id %u, offset %u, flags [%s], proto %s (%u)",
617 EXTRACT_16BITS(&ipds
->ip
->ip_id
),
618 (ipds
->off
& 0x1fff) * 8,
619 bittok2str(ip_frag_values
, "none", ipds
->off
&0xe000),
620 tok2str(ipproto_values
,"unknown",ipds
->ip
->ip_p
),
623 ND_PRINT((ndo
, ", length %u", EXTRACT_16BITS(&ipds
->ip
->ip_len
)));
625 if ((hlen
- sizeof(struct ip
)) > 0) {
626 ND_PRINT((ndo
, ", options ("));
627 ip_optprint(ndo
, (u_char
*)(ipds
->ip
+ 1), hlen
- sizeof(struct ip
));
628 ND_PRINT((ndo
, ")"));
631 if (!ndo
->ndo_Kflag
&& (u_char
*)ipds
->ip
+ hlen
<= ndo
->ndo_snapend
) {
632 vec
[0].ptr
= (const uint8_t *)(void *)ipds
->ip
;
634 sum
= in_cksum(vec
, 1);
636 ip_sum
= EXTRACT_16BITS(&ipds
->ip
->ip_sum
);
637 ND_PRINT((ndo
, ", bad cksum %x (->%x)!", ip_sum
,
638 in_cksum_shouldbe(ip_sum
, sum
)));
642 ND_PRINT((ndo
, ")\n "));
646 * If this is fragment zero, hand it to the next higher
649 if ((ipds
->off
& 0x1fff) == 0) {
650 ipds
->cp
= (const u_char
*)ipds
->ip
+ hlen
;
651 ipds
->nh
= ipds
->ip
->ip_p
;
653 if (ipds
->nh
!= IPPROTO_TCP
&& ipds
->nh
!= IPPROTO_UDP
&&
654 ipds
->nh
!= IPPROTO_SCTP
&& ipds
->nh
!= IPPROTO_DCCP
) {
655 ND_PRINT((ndo
, "%s > %s: ",
656 ipaddr_string(ndo
, &ipds
->ip
->ip_src
),
657 ipaddr_string(ndo
, &ipds
->ip
->ip_dst
)));
659 ip_print_demux(ndo
, ipds
);
661 /* Ultra quiet now means that all this stuff should be suppressed */
662 if (ndo
->ndo_qflag
> 1) return;
665 * if this isn't the first frag, we're missing the
666 * next level protocol header. print the ip addr
669 if (ipds
->off
& 0x1fff) {
670 ND_PRINT((ndo
, "%s > %s:", ipaddr_string(ndo
, &ipds
->ip
->ip_src
),
671 ipaddr_string(ndo
, &ipds
->ip
->ip_dst
)));
672 if (!ndo
->ndo_nflag
&& (proto
= getprotobynumber(ipds
->ip
->ip_p
)) != NULL
)
673 ND_PRINT((ndo
, " %s", proto
->p_name
));
675 ND_PRINT((ndo
, " ip-proto-%d", ipds
->ip
->ip_p
));
681 ND_PRINT((ndo
, "%s", tstr
));
686 ipN_print(netdissect_options
*ndo
, register const u_char
*bp
, register u_int length
)
691 ND_PRINT((ndo
, "truncated-ip %d", length
));
694 memcpy (&hdr
, bp
, 4);
695 switch (IP_V(&hdr
)) {
697 ip_print (ndo
, bp
, length
);
700 ip6_print (ndo
, bp
, length
);
703 ND_PRINT((ndo
, "unknown ip %d", IP_V(&hdr
)));
710 * c-style: whitesmith