xref: /openbsd-src/usr.sbin/tcpdump/print-ip.c (revision a28daedfc357b214be5c701aa8ba8adb29a7f1c2) 
1 /*	$OpenBSD: print-ip.c,v 1.34 2007/10/07 16:41:05 deraadt Exp $	*/
2 
3 /*
4  * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997
5  *	The Regents of the University of California.  All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that: (1) source code distributions
9  * retain the above copyright notice and this paragraph in its entirety, (2)
10  * distributions including binary code include the above copyright notice and
11  * this paragraph in its entirety in the documentation or other materials
12  * provided with the distribution, and (3) all advertising materials mentioning
13  * features or use of this software display the following acknowledgement:
14  * ``This product includes software developed by the University of California,
15  * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
16  * the University nor the names of its contributors may be used to endorse
17  * or promote products derived from this software without specific prior
18  * written permission.
19  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
20  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
21  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
22  */
23 
24 #ifndef lint
25 static const char rcsid[] =
26     "@(#) $Id: print-ip.c,v 1.34 2007/10/07 16:41:05 deraadt Exp $ (LBL)";
27 #endif
28 
29 #include <sys/param.h>
30 #include <sys/time.h>
31 #include <sys/socket.h>
32 
33 #include <netinet/in.h>
34 #include <netinet/in_systm.h>
35 #include <netinet/ip.h>
36 #include <netinet/ip_var.h>
37 #include <netinet/udp.h>
38 #include <netinet/udp_var.h>
39 #include <netinet/tcp.h>
40 #include <netinet/tcpip.h>
41 
42 #include <inttypes.h>
43 #include <stdio.h>
44 #include <stdlib.h>
45 #include <string.h>
46 #include <unistd.h>
47 
48 #include "addrtoname.h"
49 #include "interface.h"
50 #include "extract.h"			/* must come after interface.h */
51 
52 /* Compatibility */
53 #ifndef	IPPROTO_ND
54 #define	IPPROTO_ND	77
55 #endif
56 
57 #ifndef IN_CLASSD
58 #define IN_CLASSD(i) (((int32_t)(i) & 0xf0000000) == 0xe0000000)
59 #endif
60 
61 /* Definitions required for ECN
62    for use if the OS running tcpdump does not have ECN */
63 #ifndef IPTOS_ECT
64 #define IPTOS_ECT	0x02	/* ECN Capable Transport in IP header*/
65 #endif
66 #ifndef IPTOS_CE
67 #define IPTOS_CE	0x01	/* ECN Cong. Experienced in IP header*/
68 #endif
69 
70 /* (following from ipmulti/mrouted/prune.h) */
71 
72 /*
73  * The packet format for a traceroute request.
74  */
75 struct tr_query {
76 	u_int  tr_src;			/* traceroute source */
77 	u_int  tr_dst;			/* traceroute destination */
78 	u_int  tr_raddr;		/* traceroute response address */
79 #if BYTE_ORDER == BIG_ENDIAN
80 	struct {
81 		u_int   ttl : 8;	/* traceroute response ttl */
82 		u_int   qid : 24;	/* traceroute query id */
83 	} q;
84 #else
85 	struct {
86 		u_int	qid : 24;	/* traceroute query id */
87 		u_int	ttl : 8;	/* traceroute response ttl */
88 	} q;
89 #endif
90 };
91 
92 #define tr_rttl q.ttl
93 #define tr_qid  q.qid
94 
95 /*
96  * Traceroute response format.  A traceroute response has a tr_query at the
97  * beginning, followed by one tr_resp for each hop taken.
98  */
99 struct tr_resp {
100 	u_int tr_qarr;			/* query arrival time */
101 	u_int tr_inaddr;		/* incoming interface address */
102 	u_int tr_outaddr;		/* outgoing interface address */
103 	u_int tr_rmtaddr;		/* parent address in source tree */
104 	u_int tr_vifin;			/* input packet count on interface */
105 	u_int tr_vifout;		/* output packet count on interface */
106 	u_int tr_pktcnt;		/* total incoming packets for src-grp */
107 	u_char  tr_rproto;		/* routing proto deployed on router */
108 	u_char  tr_fttl;		/* ttl required to forward on outvif */
109 	u_char  tr_smask;		/* subnet mask for src addr */
110 	u_char  tr_rflags;		/* forwarding error codes */
111 };
112 
113 /* defs within mtrace */
114 #define TR_QUERY 1
115 #define TR_RESP	2
116 
117 /* fields for tr_rflags (forwarding error codes) */
118 #define TR_NO_ERR	0
119 #define TR_WRONG_IF	1
120 #define TR_PRUNED	2
121 #define TR_OPRUNED	3
122 #define TR_SCOPED	4
123 #define TR_NO_RTE	5
124 #define TR_NO_FWD	7
125 #define TR_NO_SPACE	0x81
126 #define TR_OLD_ROUTER	0x82
127 
128 /* fields for tr_rproto (routing protocol) */
129 #define TR_PROTO_DVMRP	1
130 #define TR_PROTO_MOSPF	2
131 #define TR_PROTO_PIM	3
132 #define TR_PROTO_CBT	4
133 
134 static void print_mtrace(register const u_char *bp, register u_int len)
135 {
136 	register struct tr_query *tr = (struct tr_query *)(bp + 8);
137 
138 	printf("mtrace %d: %s to %s reply-to %s", tr->tr_qid,
139 		ipaddr_string(&tr->tr_src), ipaddr_string(&tr->tr_dst),
140 		ipaddr_string(&tr->tr_raddr));
141 	if (IN_CLASSD(ntohl(tr->tr_raddr)))
142 		printf(" with-ttl %d", tr->tr_rttl);
143 }
144 
145 static void print_mresp(register const u_char *bp, register u_int len)
146 {
147 	register struct tr_query *tr = (struct tr_query *)(bp + 8);
148 
149 	printf("mresp %d: %s to %s reply-to %s", tr->tr_qid,
150 		ipaddr_string(&tr->tr_src), ipaddr_string(&tr->tr_dst),
151 		ipaddr_string(&tr->tr_raddr));
152 	if (IN_CLASSD(ntohl(tr->tr_raddr)))
153 		printf(" with-ttl %d", tr->tr_rttl);
154 }
155 
156 static void
157 igmp_print(register const u_char *bp, register u_int len,
158 	   register const u_char *bp2)
159 {
160 	register const struct ip *ip;
161 
162 	ip = (const struct ip *)bp2;
163         (void)printf("%s > %s: ",
164 		ipaddr_string(&ip->ip_src),
165 		ipaddr_string(&ip->ip_dst));
166 
167 	TCHECK2(bp[0], 8);
168 	switch (bp[0]) {
169 	case 0x11:
170 		(void)printf("igmp query");
171 		if (*(int *)&bp[4])
172 			(void)printf(" [gaddr %s]", ipaddr_string(&bp[4]));
173 		if (len != 8)
174 			(void)printf(" [len %d]", len);
175 		break;
176 	case 0x12:
177 		(void)printf("igmp report %s", ipaddr_string(&bp[4]));
178 		if (len != 8)
179 			(void)printf(" [len %d]", len);
180 		break;
181 	case 0x16:
182 		(void)printf("igmp nreport %s", ipaddr_string(&bp[4]));
183 		break;
184 	case 0x17:
185 		(void)printf("igmp leave %s", ipaddr_string(&bp[4]));
186 		break;
187 	case 0x13:
188 		(void)printf("igmp dvmrp");
189 		if (len < 8)
190 			(void)printf(" [len %d]", len);
191 		else
192 			dvmrp_print(bp, len);
193 		break;
194 	case 0x14:
195 		(void)printf("igmp pim");
196 		pim_print(bp, len);
197   		break;
198 	case 0x1e:
199 		print_mresp(bp, len);
200 		break;
201 	case 0x1f:
202 		print_mtrace(bp, len);
203 		break;
204 	default:
205 		(void)printf("igmp-%d", bp[0] & 0xf);
206 		break;
207 	}
208 	if ((bp[0] >> 4) != 1)
209 		(void)printf(" [v%d]", bp[0] >> 4);
210 
211 	TCHECK2(bp[0], len);
212 	if (vflag) {
213 		/* Check the IGMP checksum */
214 		u_int32_t sum = 0;
215 		int count;
216 		const u_short *sp = (u_short *)bp;
217 
218 		for (count = len / 2; --count >= 0; )
219 			sum += *sp++;
220 		if (len & 1)
221 			sum += ntohs(*(u_char *) sp << 8);
222 		while (sum >> 16)
223 			sum = (sum & 0xffff) + (sum >> 16);
224 		sum = 0xffff & ~sum;
225 		if (sum != 0)
226 			printf(" bad igmp cksum %x!", EXTRACT_16BITS(&bp[2]));
227 	}
228 	return;
229 trunc:
230 	fputs("[|igmp]", stdout);
231 }
232 
233 /*
234  * print the recorded route in an IP RR, LSRR or SSRR option.
235  */
236 static void
237 ip_printroute(const char *type, register const u_char *cp, u_int length)
238 {
239 	register u_int ptr = cp[2] - 1;
240 	register u_int len;
241 
242 	printf(" %s{", type);
243 	if ((length + 1) & 3)
244 		printf(" [bad length %d]", length);
245 	if (ptr < 3 || ((ptr + 1) & 3) || ptr > length + 1)
246 		printf(" [bad ptr %d]", cp[2]);
247 
248 	type = "";
249 	for (len = 3; len < length; len += 4) {
250 		if (ptr == len)
251 			type = "#";
252 		printf("%s%s", type, ipaddr_string(&cp[len]));
253 		type = " ";
254 	}
255 	printf("%s}", ptr == len? "#" : "");
256 }
257 
258 /*
259  * print IP options.
260  */
261 static void
262 ip_optprint(register const u_char *cp, u_int length)
263 {
264 	register u_int len;
265 	int tt;
266 
267 	for (; length > 0; cp += len, length -= len) {
268 		TCHECK(cp[1]);
269 		tt = *cp;
270 		len = (tt == IPOPT_NOP || tt == IPOPT_EOL) ? 1 : cp[1];
271 		if (len <= 0) {
272 			printf("[|ip op len %d]", len);
273 			return;
274 		}
275 		if (&cp[1] >= snapend || cp + len > snapend) {
276 			printf("[|ip]");
277 			return;
278 		}
279 		switch (tt) {
280 
281 		case IPOPT_EOL:
282 			printf(" EOL");
283 			if (length > 1)
284 				printf("-%d", length - 1);
285 			return;
286 
287 		case IPOPT_NOP:
288 			printf(" NOP");
289 			break;
290 
291 		case IPOPT_TS:
292 			printf(" TS{%d}", len);
293 			break;
294 
295 		case IPOPT_SECURITY:
296 			printf(" SECURITY{%d}", len);
297 			break;
298 
299 		case IPOPT_RR:
300 			printf(" RR{%d}=", len);
301 			ip_printroute("RR", cp, len);
302 			break;
303 
304 		case IPOPT_SSRR:
305 			ip_printroute("SSRR", cp, len);
306 			break;
307 
308 		case IPOPT_LSRR:
309 			ip_printroute("LSRR", cp, len);
310 			break;
311 
312 		default:
313 			printf(" IPOPT-%d{%d}", cp[0], len);
314 			break;
315 		}
316 	}
317 	return;
318 
319 trunc:
320 	printf("[|ip]");
321 }
322 
323 /*
324  * compute an IP header checksum.
325  * don't modifiy the packet.
326  */
327 u_short
328 in_cksum(const u_short *addr, register int len, u_short csum)
329 {
330 	int nleft = len;
331 	const u_short *w = addr;
332 	u_short answer;
333 	int sum = csum;
334 
335  	/*
336 	 *  Our algorithm is simple, using a 32 bit accumulator (sum),
337 	 *  we add sequential 16 bit words to it, and at the end, fold
338 	 *  back all the carry bits from the top 16 bits into the lower
339 	 *  16 bits.
340  	 */
341 	while (nleft > 1)  {
342 		sum += *w++;
343 		nleft -= 2;
344 	}
345 	if (nleft == 1)
346 		sum += htons(*(u_char *)w<<8);
347 
348 	/*
349 	 * add back carry outs from top 16 bits to low 16 bits
350 	 */
351 	sum = (sum >> 16) + (sum & 0xffff);	/* add hi 16 to low 16 */
352 	sum += (sum >> 16);			/* add carry */
353 	answer = ~sum;				/* truncate to 16 bits */
354 	return (answer);
355 }
356 
357 /*
358  * print an IP datagram.
359  */
360 void
361 ip_print(register const u_char *bp, register u_int length)
362 {
363 	register const struct ip *ip;
364 	register u_int hlen, len, off;
365 	register const u_char *cp;
366 
367 	ip = (const struct ip *)bp;
368 	/*
369 	 * If the IP header is not aligned, copy into abuf.
370 	 * This will never happen with BPF.  It does happen with raw packet
371 	 * dumps from -r.
372 	 */
373 	if ((intptr_t)ip & (sizeof(long)-1)) {
374 		static u_char *abuf = NULL;
375 		static int didwarn = 0;
376 		int clen = snapend - bp;
377 
378 		if (clen > snaplen)
379 			clen = snaplen;
380 		if (abuf == NULL) {
381 			abuf = (u_char *)malloc(snaplen);
382 			if (abuf == NULL)
383 				error("ip_print: malloc");
384 		}
385 		memmove((char *)abuf, (char *)ip, min(length, clen));
386 		snapend = abuf + clen;
387 		packetp = abuf;
388 		ip = (struct ip *)abuf;
389 		/* We really want libpcap to give us aligned packets */
390 		if (!didwarn) {
391 			warning("compensating for unaligned libpcap packets");
392 			++didwarn;
393 		}
394 	}
395 
396 	TCHECK(*ip);
397 	if (ip->ip_v != IPVERSION) {
398 		(void)printf("bad-ip-version %u", ip->ip_v);
399 		return;
400 	}
401 
402 	len = ntohs(ip->ip_len);
403 	if (length < len) {
404 		(void)printf("truncated-ip - %d bytes missing!",
405 			len - length);
406 		len = length;
407 	}
408 
409 	hlen = ip->ip_hl * 4;
410 	if (hlen < sizeof(struct ip) || hlen > len) {
411 		(void)printf("bad-hlen %d", hlen);
412 		return;
413 	}
414 
415 	len -= hlen;
416 
417 	/*
418 	 * If this is fragment zero, hand it to the next higher
419 	 * level protocol.
420 	 */
421 	off = ntohs(ip->ip_off);
422 	if ((off & 0x1fff) == 0) {
423 		cp = (const u_char *)ip + hlen;
424 		switch (ip->ip_p) {
425 
426 		case IPPROTO_TCP:
427 			tcp_print(cp, len, (const u_char *)ip);
428 			break;
429 
430 		case IPPROTO_UDP:
431 			udp_print(cp, len, (const u_char *)ip);
432 			break;
433 
434 		case IPPROTO_ICMP:
435 			icmp_print(cp, (const u_char *)ip);
436 			break;
437 
438 #ifndef IPPROTO_IGRP
439 #define IPPROTO_IGRP 9
440 #endif
441 		case IPPROTO_IGRP:
442 			igrp_print(cp, len, (const u_char *)ip);
443 			break;
444 
445 		case IPPROTO_ND:
446 			(void)printf("%s > %s:", ipaddr_string(&ip->ip_src),
447 				ipaddr_string(&ip->ip_dst));
448 			(void)printf(" nd %d", len);
449 			break;
450 
451 #ifndef IPPROTO_OSPF
452 #define IPPROTO_OSPF 89
453 #endif
454 		case IPPROTO_OSPF:
455 			ospf_print(cp, len, (const u_char *)ip);
456 			break;
457 
458 #ifndef IPPROTO_IGMP
459 #define IPPROTO_IGMP 2
460 #endif
461 		case IPPROTO_IGMP:
462 			igmp_print(cp, len, (const u_char *)ip);
463 			break;
464 
465 #ifndef IPPROTO_IPIP
466 #define IPPROTO_IPIP 4
467 #endif
468 		case IPPROTO_IPIP:
469 			/* ip-in-ip encapsulation */
470 			if (vflag)
471 				(void)printf("%s > %s: ",
472 					     ipaddr_string(&ip->ip_src),
473 					     ipaddr_string(&ip->ip_dst));
474 			ip_print(cp, len);
475 			if (! vflag) {
476 				printf(" (encap)");
477 				return;
478 			}
479 			break;
480 
481 #ifdef INET6
482 #ifndef IPPROTO_IPV6
483 #define IPPROTO_IPV6
484 #endif
485 		case IPPROTO_IPV6:
486 			/* ip6-in-ip encapsulation */
487 			if (vflag)
488 				(void)printf("%s > %s: ",
489 					     ipaddr_string(&ip->ip_src),
490 					     ipaddr_string(&ip->ip_dst));
491 			ip6_print(cp, len);
492 			if (! vflag) {
493  				printf(" (encap)");
494  				return;
495  			}
496  			break;
497 #endif /*INET6*/
498 
499 #ifndef IPPROTO_GRE
500 #define IPPROTO_GRE 47
501 #endif
502 		case IPPROTO_GRE:
503 			if (vflag)
504 				(void)printf("gre %s > %s: ",
505 					     ipaddr_string(&ip->ip_src),
506 					     ipaddr_string(&ip->ip_dst));
507 			/* do it */
508 			gre_print(cp, len);
509 			if (! vflag) {
510 				printf(" (gre encap)");
511 				return;
512   			}
513   			break;
514 
515 #ifndef IPPROTO_ESP
516 #define IPPROTO_ESP 50
517 #endif
518 		case IPPROTO_ESP:
519 			esp_print(cp, len, (const u_char *)ip);
520 			break;
521 
522 #ifndef IPPROTO_AH
523 #define IPPROTO_AH 51
524 #endif
525 		case IPPROTO_AH:
526 			ah_print(cp, len, (const u_char *)ip);
527 			break;
528 
529 #ifndef IPPROTO_MOBILE
530 #define IPPROTO_MOBILE 55
531 #endif
532 		case IPPROTO_MOBILE:
533 			if (vflag)
534 				(void)printf("mobile %s > %s: ",
535 					     ipaddr_string(&ip->ip_src),
536 					     ipaddr_string(&ip->ip_dst));
537 			mobile_print(cp, len);
538 			if (! vflag) {
539 				printf(" (mobile encap)");
540 				return;
541 			}
542 			break;
543 
544 #ifndef IPPROTO_ETHERIP
545 #define IPPROTO_ETHERIP	97
546 #endif
547 		case IPPROTO_ETHERIP:
548 			etherip_print(cp, snapend - cp, len,
549 			    (const u_char *)ip);
550 			break;
551 
552 #ifndef	IPPROTO_IPCOMP
553 #define	IPPROTO_IPCOMP	108
554 #endif
555 		case IPPROTO_IPCOMP:
556 			ipcomp_print(cp, len, (const u_char *)ip);
557 			break;
558 
559 #ifndef IPPROTO_CARP
560 #define IPPROTO_CARP 112
561 #endif
562 		case IPPROTO_CARP:
563 			if (packettype == PT_VRRP) {
564 				if (vflag)
565 					(void)printf("vrrp %s > %s: ",
566 					     ipaddr_string(&ip->ip_src),
567 					     ipaddr_string(&ip->ip_dst));
568 				vrrp_print(cp, len, ip->ip_ttl);
569 			} else {
570 				if (vflag)
571 					(void)printf("carp %s > %s: ",
572 					     ipaddr_string(&ip->ip_src),
573 					     ipaddr_string(&ip->ip_dst));
574 				carp_print(cp, len, ip->ip_ttl);
575 			}
576 			break;
577 
578 #ifndef IPPROTO_PFSYNC
579 #define IPPROTO_PFSYNC 240
580 #endif
581 		case IPPROTO_PFSYNC:
582 			pfsync_ip_print(cp,
583 			    (int)(snapend - (u_char *)ip) - hlen,
584 			    (const u_char *)ip);
585 			break;
586 
587 		default:
588 			(void)printf("%s > %s:", ipaddr_string(&ip->ip_src),
589 				ipaddr_string(&ip->ip_dst));
590 			(void)printf(" ip-proto-%d %d", ip->ip_p, len);
591 			break;
592 		}
593 	}
594 	/*
595 	 * for fragmented datagrams, print id:size@offset.  On all
596 	 * but the last stick a "+".  For unfragmented datagrams, note
597 	 * the don't fragment flag.
598 	 */
599 	if (off & 0x3fff) {
600 		/*
601 		 * if this isn't the first frag, we're missing the
602 		 * next level protocol header.  print the ip addr.
603 		 */
604 		if (off & 0x1fff)
605 			(void)printf("%s > %s:", ipaddr_string(&ip->ip_src),
606 				      ipaddr_string(&ip->ip_dst));
607 		(void)printf(" (frag %d:%d@%d%s)", ntohs(ip->ip_id), len,
608 			(off & 0x1fff) * 8,
609 			(off & IP_MF)? "+" : "");
610 	}
611 	if (off & IP_DF)
612 		(void)printf(" (DF)");
613 
614 	if (ip->ip_tos) {
615 		(void)printf(" [tos 0x%x", (int)ip->ip_tos);
616 		if (ip->ip_tos & (IPTOS_CE|IPTOS_ECT)) {
617 			(void)printf(" (");
618 			if (ip->ip_tos & IPTOS_ECT) {
619 				/* ECN-capable transport */
620 				putchar('E');
621 			}
622 			if (ip->ip_tos & IPTOS_CE) {
623 				/* _C_ongestion experienced (ECN) */
624 				putchar('C');
625 			}
626 			(void)printf(")");
627   		}
628 		(void)printf("]");
629 	}
630 
631 	if (ip->ip_ttl <= 1)
632 		(void)printf(" [ttl %d]", (int)ip->ip_ttl);
633 
634 	if (vflag) {
635 		int sum;
636 		char *sep = "";
637 
638 		printf(" (");
639 		if (ip->ip_ttl > 1) {
640 			(void)printf("%sttl %d", sep, (int)ip->ip_ttl);
641 			sep = ", ";
642 		}
643 		if ((off & 0x3fff) == 0) {
644 			(void)printf("%sid %d", sep, (int)ntohs(ip->ip_id));
645 			sep = ", ";
646 		}
647 		(void)printf("%slen %u", sep, ntohs(ip->ip_len));
648 		sep = ", ";
649 		if ((u_char *)ip + hlen <= snapend) {
650 			sum = in_cksum((const u_short *)ip, hlen, 0);
651 			if (sum != 0) {
652 				(void)printf("%sbad cksum %x!", sep,
653 					     ntohs(ip->ip_sum));
654 				if (vflag > 1)
655 					(void)printf(" differs by %x", htons(sum));
656 				sep = ", ";
657 			}
658 		}
659 		if (hlen > sizeof(struct ip)) {
660 			hlen -= sizeof(struct ip);
661 			(void)printf("%soptlen=%d", sep, hlen);
662 			ip_optprint((u_char *)(ip + 1), hlen);
663 		}
664 		printf(")");
665 	}
666 	return;
667 
668 trunc:
669 	printf("[|ip]");
670 }
671