xref: /openbsd-src/usr.sbin/tcpdump/print-ip.c (revision daf88648c0e349d5c02e1504293082072c981640) 
1 /*	$OpenBSD: print-ip.c,v 1.32 2006/06/01 17:18:39 moritz Exp $	*/
2 
3 /*
4  * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997
5  *	The Regents of the University of California.  All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that: (1) source code distributions
9  * retain the above copyright notice and this paragraph in its entirety, (2)
10  * distributions including binary code include the above copyright notice and
11  * this paragraph in its entirety in the documentation or other materials
12  * provided with the distribution, and (3) all advertising materials mentioning
13  * features or use of this software display the following acknowledgement:
14  * ``This product includes software developed by the University of California,
15  * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
16  * the University nor the names of its contributors may be used to endorse
17  * or promote products derived from this software without specific prior
18  * written permission.
19  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
20  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
21  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
22  */
23 
24 #ifndef lint
25 static const char rcsid[] =
26     "@(#) $Header: /home/cvs/src/usr.sbin/tcpdump/print-ip.c,v 1.32 2006/06/01 17:18:39 moritz Exp $ (LBL)";
27 #endif
28 
29 #include <sys/param.h>
30 #include <sys/time.h>
31 #include <sys/socket.h>
32 
33 #include <netinet/in.h>
34 #include <netinet/in_systm.h>
35 #include <netinet/ip.h>
36 #include <netinet/ip_var.h>
37 #include <netinet/udp.h>
38 #include <netinet/udp_var.h>
39 #include <netinet/tcp.h>
40 #include <netinet/tcpip.h>
41 
42 #include <inttypes.h>
43 #include <stdio.h>
44 #include <stdlib.h>
45 #include <string.h>
46 #include <unistd.h>
47 
48 #include "addrtoname.h"
49 #include "interface.h"
50 #include "extract.h"			/* must come after interface.h */
51 
52 /* Compatibility */
53 #ifndef	IPPROTO_ND
54 #define	IPPROTO_ND	77
55 #endif
56 
57 #ifndef IN_CLASSD
58 #define IN_CLASSD(i) (((int32_t)(i) & 0xf0000000) == 0xe0000000)
59 #endif
60 
61 /* Definitions required for ECN
62    for use if the OS running tcpdump does not have ECN */
63 #ifndef IPTOS_ECT
64 #define IPTOS_ECT	0x02	/* ECN Capable Transport in IP header*/
65 #endif
66 #ifndef IPTOS_CE
67 #define IPTOS_CE	0x01	/* ECN Cong. Experienced in IP header*/
68 #endif
69 
70 /* (following from ipmulti/mrouted/prune.h) */
71 
72 /*
73  * The packet format for a traceroute request.
74  */
75 struct tr_query {
76 	u_int  tr_src;			/* traceroute source */
77 	u_int  tr_dst;			/* traceroute destination */
78 	u_int  tr_raddr;		/* traceroute response address */
79 #if BYTE_ORDER == BIG_ENDIAN
80 	struct {
81 		u_int   ttl : 8;	/* traceroute response ttl */
82 		u_int   qid : 24;	/* traceroute query id */
83 	} q;
84 #else
85 	struct {
86 		u_int	qid : 24;	/* traceroute query id */
87 		u_int	ttl : 8;	/* traceroute response ttl */
88 	} q;
89 #endif
90 };
91 
92 #define tr_rttl q.ttl
93 #define tr_qid  q.qid
94 
95 /*
96  * Traceroute response format.  A traceroute response has a tr_query at the
97  * beginning, followed by one tr_resp for each hop taken.
98  */
99 struct tr_resp {
100 	u_int tr_qarr;			/* query arrival time */
101 	u_int tr_inaddr;		/* incoming interface address */
102 	u_int tr_outaddr;		/* outgoing interface address */
103 	u_int tr_rmtaddr;		/* parent address in source tree */
104 	u_int tr_vifin;			/* input packet count on interface */
105 	u_int tr_vifout;		/* output packet count on interface */
106 	u_int tr_pktcnt;		/* total incoming packets for src-grp */
107 	u_char  tr_rproto;		/* routing proto deployed on router */
108 	u_char  tr_fttl;		/* ttl required to forward on outvif */
109 	u_char  tr_smask;		/* subnet mask for src addr */
110 	u_char  tr_rflags;		/* forwarding error codes */
111 };
112 
113 /* defs within mtrace */
114 #define TR_QUERY 1
115 #define TR_RESP	2
116 
117 /* fields for tr_rflags (forwarding error codes) */
118 #define TR_NO_ERR	0
119 #define TR_WRONG_IF	1
120 #define TR_PRUNED	2
121 #define TR_OPRUNED	3
122 #define TR_SCOPED	4
123 #define TR_NO_RTE	5
124 #define TR_NO_FWD	7
125 #define TR_NO_SPACE	0x81
126 #define TR_OLD_ROUTER	0x82
127 
128 /* fields for tr_rproto (routing protocol) */
129 #define TR_PROTO_DVMRP	1
130 #define TR_PROTO_MOSPF	2
131 #define TR_PROTO_PIM	3
132 #define TR_PROTO_CBT	4
133 
134 static void print_mtrace(register const u_char *bp, register u_int len)
135 {
136 	register struct tr_query *tr = (struct tr_query *)(bp + 8);
137 
138 	printf("mtrace %d: %s to %s reply-to %s", tr->tr_qid,
139 		ipaddr_string(&tr->tr_src), ipaddr_string(&tr->tr_dst),
140 		ipaddr_string(&tr->tr_raddr));
141 	if (IN_CLASSD(ntohl(tr->tr_raddr)))
142 		printf(" with-ttl %d", tr->tr_rttl);
143 }
144 
145 static void print_mresp(register const u_char *bp, register u_int len)
146 {
147 	register struct tr_query *tr = (struct tr_query *)(bp + 8);
148 
149 	printf("mresp %d: %s to %s reply-to %s", tr->tr_qid,
150 		ipaddr_string(&tr->tr_src), ipaddr_string(&tr->tr_dst),
151 		ipaddr_string(&tr->tr_raddr));
152 	if (IN_CLASSD(ntohl(tr->tr_raddr)))
153 		printf(" with-ttl %d", tr->tr_rttl);
154 }
155 
156 static void
157 igmp_print(register const u_char *bp, register u_int len,
158 	   register const u_char *bp2)
159 {
160 	register const struct ip *ip;
161 
162 	ip = (const struct ip *)bp2;
163         (void)printf("%s > %s: ",
164 		ipaddr_string(&ip->ip_src),
165 		ipaddr_string(&ip->ip_dst));
166 
167 	TCHECK2(bp[0], 8);
168 	switch (bp[0]) {
169 	case 0x11:
170 		(void)printf("igmp query");
171 		if (*(int *)&bp[4])
172 			(void)printf(" [gaddr %s]", ipaddr_string(&bp[4]));
173 		if (len != 8)
174 			(void)printf(" [len %d]", len);
175 		break;
176 	case 0x12:
177 		(void)printf("igmp report %s", ipaddr_string(&bp[4]));
178 		if (len != 8)
179 			(void)printf(" [len %d]", len);
180 		break;
181 	case 0x16:
182 		(void)printf("igmp nreport %s", ipaddr_string(&bp[4]));
183 		break;
184 	case 0x17:
185 		(void)printf("igmp leave %s", ipaddr_string(&bp[4]));
186 		break;
187 	case 0x13:
188 		(void)printf("igmp dvmrp");
189 		if (len < 8)
190 			(void)printf(" [len %d]", len);
191 		else
192 			dvmrp_print(bp, len);
193 		break;
194 	case 0x14:
195 		(void)printf("igmp pim");
196 		pim_print(bp, len);
197   		break;
198 	case 0x1e:
199 		print_mresp(bp, len);
200 		break;
201 	case 0x1f:
202 		print_mtrace(bp, len);
203 		break;
204 	default:
205 		(void)printf("igmp-%d", bp[0] & 0xf);
206 		break;
207 	}
208 	if ((bp[0] >> 4) != 1)
209 		(void)printf(" [v%d]", bp[0] >> 4);
210 
211 	TCHECK2(bp[0], len);
212 	if (vflag) {
213 		/* Check the IGMP checksum */
214 		u_int32_t sum = 0;
215 		int count;
216 		const u_short *sp = (u_short *)bp;
217 
218 		for (count = len / 2; --count >= 0; )
219 			sum += *sp++;
220 		if (len & 1)
221 			sum += ntohs(*(u_char *) sp << 8);
222 		while (sum >> 16)
223 			sum = (sum & 0xffff) + (sum >> 16);
224 		sum = 0xffff & ~sum;
225 		if (sum != 0)
226 			printf(" bad igmp cksum %x!", EXTRACT_16BITS(&bp[2]));
227 	}
228 	return;
229 trunc:
230 	fputs("[|igmp]", stdout);
231 }
232 
233 /*
234  * print the recorded route in an IP RR, LSRR or SSRR option.
235  */
236 static void
237 ip_printroute(const char *type, register const u_char *cp, u_int length)
238 {
239 	register u_int ptr = cp[2] - 1;
240 	register u_int len;
241 
242 	printf(" %s{", type);
243 	if ((length + 1) & 3)
244 		printf(" [bad length %d]", length);
245 	if (ptr < 3 || ((ptr + 1) & 3) || ptr > length + 1)
246 		printf(" [bad ptr %d]", cp[2]);
247 
248 	type = "";
249 	for (len = 3; len < length; len += 4) {
250 		if (ptr == len)
251 			type = "#";
252 		printf("%s%s", type, ipaddr_string(&cp[len]));
253 		type = " ";
254 	}
255 	printf("%s}", ptr == len? "#" : "");
256 }
257 
258 /*
259  * print IP options.
260  */
261 static void
262 ip_optprint(register const u_char *cp, u_int length)
263 {
264 	register u_int len;
265 	int tt;
266 
267 	for (; length > 0; cp += len, length -= len) {
268 		TCHECK(cp[1]);
269 		tt = *cp;
270 		len = (tt == IPOPT_NOP || tt == IPOPT_EOL) ? 1 : cp[1];
271 		if (len <= 0) {
272 			printf("[|ip op len %d]", len);
273 			return;
274 		}
275 		if (&cp[1] >= snapend || cp + len > snapend) {
276 			printf("[|ip]");
277 			return;
278 		}
279 		switch (tt) {
280 
281 		case IPOPT_EOL:
282 			printf(" EOL");
283 			if (length > 1)
284 				printf("-%d", length - 1);
285 			return;
286 
287 		case IPOPT_NOP:
288 			printf(" NOP");
289 			break;
290 
291 		case IPOPT_TS:
292 			printf(" TS{%d}", len);
293 			break;
294 
295 		case IPOPT_SECURITY:
296 			printf(" SECURITY{%d}", len);
297 			break;
298 
299 		case IPOPT_RR:
300 			printf(" RR{%d}=", len);
301 			ip_printroute("RR", cp, len);
302 			break;
303 
304 		case IPOPT_SSRR:
305 			ip_printroute("SSRR", cp, len);
306 			break;
307 
308 		case IPOPT_LSRR:
309 			ip_printroute("LSRR", cp, len);
310 			break;
311 
312 		default:
313 			printf(" IPOPT-%d{%d}", cp[0], len);
314 			break;
315 		}
316 	}
317 	return;
318 
319 trunc:
320 	printf("[|ip]");
321 }
322 
323 /*
324  * compute an IP header checksum.
325  * don't modifiy the packet.
326  */
327 u_short
328 in_cksum(const u_short *addr, register int len, u_short csum)
329 {
330 	int nleft = len;
331 	const u_short *w = addr;
332 	u_short answer;
333 	int sum = csum;
334 
335  	/*
336 	 *  Our algorithm is simple, using a 32 bit accumulator (sum),
337 	 *  we add sequential 16 bit words to it, and at the end, fold
338 	 *  back all the carry bits from the top 16 bits into the lower
339 	 *  16 bits.
340  	 */
341 	while (nleft > 1)  {
342 		sum += *w++;
343 		nleft -= 2;
344 	}
345 	if (nleft == 1)
346 		sum += htons(*(u_char *)w<<8);
347 
348 	/*
349 	 * add back carry outs from top 16 bits to low 16 bits
350 	 */
351 	sum = (sum >> 16) + (sum & 0xffff);	/* add hi 16 to low 16 */
352 	sum += (sum >> 16);			/* add carry */
353 	answer = ~sum;				/* truncate to 16 bits */
354 	return (answer);
355 }
356 
357 /*
358  * print an IP datagram.
359  */
360 void
361 ip_print(register const u_char *bp, register u_int length)
362 {
363 	register const struct ip *ip;
364 	register u_int hlen, len, off;
365 	register const u_char *cp;
366 
367 	ip = (const struct ip *)bp;
368 	/*
369 	 * If the IP header is not aligned, copy into abuf.
370 	 * This will never happen with BPF.  It does happen with raw packet
371 	 * dumps from -r.
372 	 */
373 	if ((intptr_t)ip & (sizeof(long)-1)) {
374 		static u_char *abuf = NULL;
375 		static int didwarn = 0;
376 
377 		if (abuf == NULL) {
378 			abuf = (u_char *)malloc(snaplen);
379 			if (abuf == NULL)
380 				error("ip_print: malloc");
381 		}
382 		memcpy((char *)abuf, (char *)ip, min(length, snaplen));
383 		snapend += abuf - (u_char *)ip;
384 		packetp = abuf;
385 		ip = (struct ip *)abuf;
386 		/* We really want libpcap to give us aligned packets */
387 		if (!didwarn) {
388 			warning("compensating for unaligned libpcap packets");
389 			++didwarn;
390 		}
391 	}
392 
393 	TCHECK(*ip);
394 	if (ip->ip_v != IPVERSION) {
395 		(void)printf("bad-ip-version %u", ip->ip_v);
396 		return;
397 	}
398 
399 	len = ntohs(ip->ip_len);
400 	if (length < len) {
401 		(void)printf("truncated-ip - %d bytes missing!",
402 			len - length);
403 		len = length;
404 	}
405 
406 	hlen = ip->ip_hl * 4;
407 	if (hlen < sizeof(struct ip) || hlen > len) {
408 		(void)printf("bad-hlen %d", hlen);
409 		return;
410 	}
411 
412 	len -= hlen;
413 
414 	/*
415 	 * If this is fragment zero, hand it to the next higher
416 	 * level protocol.
417 	 */
418 	off = ntohs(ip->ip_off);
419 	if ((off & 0x1fff) == 0) {
420 		cp = (const u_char *)ip + hlen;
421 		switch (ip->ip_p) {
422 
423 		case IPPROTO_TCP:
424 			tcp_print(cp, len, (const u_char *)ip);
425 			break;
426 
427 		case IPPROTO_UDP:
428 			udp_print(cp, len, (const u_char *)ip);
429 			break;
430 
431 		case IPPROTO_ICMP:
432 			icmp_print(cp, (const u_char *)ip);
433 			break;
434 
435 #ifndef IPPROTO_IGRP
436 #define IPPROTO_IGRP 9
437 #endif
438 		case IPPROTO_IGRP:
439 			igrp_print(cp, len, (const u_char *)ip);
440 			break;
441 
442 		case IPPROTO_ND:
443 			(void)printf("%s > %s:", ipaddr_string(&ip->ip_src),
444 				ipaddr_string(&ip->ip_dst));
445 			(void)printf(" nd %d", len);
446 			break;
447 
448 #ifndef IPPROTO_OSPF
449 #define IPPROTO_OSPF 89
450 #endif
451 		case IPPROTO_OSPF:
452 			ospf_print(cp, len, (const u_char *)ip);
453 			break;
454 
455 #ifndef IPPROTO_IGMP
456 #define IPPROTO_IGMP 2
457 #endif
458 		case IPPROTO_IGMP:
459 			igmp_print(cp, len, (const u_char *)ip);
460 			break;
461 
462 #ifndef IPPROTO_IPIP
463 #define IPPROTO_IPIP 4
464 #endif
465 		case IPPROTO_IPIP:
466 			/* ip-in-ip encapsulation */
467 			if (vflag)
468 				(void)printf("%s > %s: ",
469 					     ipaddr_string(&ip->ip_src),
470 					     ipaddr_string(&ip->ip_dst));
471 			ip_print(cp, len);
472 			if (! vflag) {
473 				printf(" (encap)");
474 				return;
475 			}
476 			break;
477 
478 #ifdef INET6
479 #ifndef IPPROTO_IPV6
480 #define IPPROTO_IPV6
481 #endif
482 		case IPPROTO_IPV6:
483 			/* ip6-in-ip encapsulation */
484 			if (vflag)
485 				(void)printf("%s > %s: ",
486 					     ipaddr_string(&ip->ip_src),
487 					     ipaddr_string(&ip->ip_dst));
488 			ip6_print(cp, len);
489 			if (! vflag) {
490  				printf(" (encap)");
491  				return;
492  			}
493  			break;
494 #endif /*INET6*/
495 
496 #ifndef IPPROTO_GRE
497 #define IPPROTO_GRE 47
498 #endif
499 		case IPPROTO_GRE:
500 			if (vflag)
501 				(void)printf("gre %s > %s: ",
502 					     ipaddr_string(&ip->ip_src),
503 					     ipaddr_string(&ip->ip_dst));
504 			/* do it */
505 			gre_print(cp, len);
506 			if (! vflag) {
507 				printf(" (gre encap)");
508 				return;
509   			}
510   			break;
511 
512 #ifndef IPPROTO_ESP
513 #define IPPROTO_ESP 50
514 #endif
515 		case IPPROTO_ESP:
516 			esp_print(cp, len, (const u_char *)ip);
517 			break;
518 
519 #ifndef IPPROTO_AH
520 #define IPPROTO_AH 51
521 #endif
522 		case IPPROTO_AH:
523 			ah_print(cp, len, (const u_char *)ip);
524 			break;
525 
526 #ifndef IPPROTO_MOBILE
527 #define IPPROTO_MOBILE 55
528 #endif
529 		case IPPROTO_MOBILE:
530 			if (vflag)
531 				(void)printf("mobile %s > %s: ",
532 					     ipaddr_string(&ip->ip_src),
533 					     ipaddr_string(&ip->ip_dst));
534 			mobile_print(cp, len);
535 			if (! vflag) {
536 				printf(" (mobile encap)");
537 				return;
538 			}
539 			break;
540 
541 #ifndef IPPROTO_ETHERIP
542 #define IPPROTO_ETHERIP	97
543 #endif
544 		case IPPROTO_ETHERIP:
545 			etherip_print(cp, snapend - cp, len,
546 			    (const u_char *)ip);
547 			break;
548 
549 #ifndef	IPPROTO_IPCOMP
550 #define	IPPROTO_IPCOMP	108
551 #endif
552 		case IPPROTO_IPCOMP:
553 			ipcomp_print(cp, len, (const u_char *)ip);
554 			break;
555 
556 #ifndef IPPROTO_CARP
557 #define IPPROTO_CARP 112
558 #endif
559 		case IPPROTO_CARP:
560 			if (packettype == PT_VRRP) {
561 				if (vflag)
562 					(void)printf("vrrp %s > %s: ",
563 					     ipaddr_string(&ip->ip_src),
564 					     ipaddr_string(&ip->ip_dst));
565 				vrrp_print(cp, len, ip->ip_ttl);
566 			} else {
567 				if (vflag)
568 					(void)printf("carp %s > %s: ",
569 					     ipaddr_string(&ip->ip_src),
570 					     ipaddr_string(&ip->ip_dst));
571 				carp_print(cp, len, ip->ip_ttl);
572 			}
573 			break;
574 
575 #ifndef IPPROTO_PFSYNC
576 #define IPPROTO_PFSYNC 240
577 #endif
578 		case IPPROTO_PFSYNC:
579 			pfsync_ip_print(cp,
580 			    (int)(snapend - (u_char *)ip) - hlen,
581 			    (const u_char *)ip);
582 			break;
583 
584 		default:
585 			(void)printf("%s > %s:", ipaddr_string(&ip->ip_src),
586 				ipaddr_string(&ip->ip_dst));
587 			(void)printf(" ip-proto-%d %d", ip->ip_p, len);
588 			break;
589 		}
590 	}
591 	/*
592 	 * for fragmented datagrams, print id:size@offset.  On all
593 	 * but the last stick a "+".  For unfragmented datagrams, note
594 	 * the don't fragment flag.
595 	 */
596 	if (off & 0x3fff) {
597 		/*
598 		 * if this isn't the first frag, we're missing the
599 		 * next level protocol header.  print the ip addr.
600 		 */
601 		if (off & 0x1fff)
602 			(void)printf("%s > %s:", ipaddr_string(&ip->ip_src),
603 				      ipaddr_string(&ip->ip_dst));
604 		(void)printf(" (frag %d:%d@%d%s)", ntohs(ip->ip_id), len,
605 			(off & 0x1fff) * 8,
606 			(off & IP_MF)? "+" : "");
607 	}
608 	if (off & IP_DF)
609 		(void)printf(" (DF)");
610 
611 	if (ip->ip_tos) {
612 		(void)printf(" [tos 0x%x", (int)ip->ip_tos);
613 		if (ip->ip_tos & (IPTOS_CE|IPTOS_ECT)) {
614 			(void)printf(" (");
615 			if (ip->ip_tos & IPTOS_ECT) {
616 				/* ECN-capable transport */
617 				putchar('E');
618 			}
619 			if (ip->ip_tos & IPTOS_CE) {
620 				/* _C_ongestion experienced (ECN) */
621 				putchar('C');
622 			}
623 			(void)printf(")");
624   		}
625 		(void)printf("]");
626 	}
627 
628 	if (ip->ip_ttl <= 1)
629 		(void)printf(" [ttl %d]", (int)ip->ip_ttl);
630 
631 	if (vflag) {
632 		int sum;
633 		char *sep = "";
634 
635 		printf(" (");
636 		if (ip->ip_ttl > 1) {
637 			(void)printf("%sttl %d", sep, (int)ip->ip_ttl);
638 			sep = ", ";
639 		}
640 		if ((off & 0x3fff) == 0) {
641 			(void)printf("%sid %d", sep, (int)ntohs(ip->ip_id));
642 			sep = ", ";
643 		}
644 		(void)printf("%slen %u", sep, ntohs(ip->ip_len));
645 		sep = ", ";
646 		if ((u_char *)ip + hlen <= snapend) {
647 			sum = in_cksum((const u_short *)ip, hlen, 0);
648 			if (sum != 0) {
649 				(void)printf("%sbad cksum %x!", sep,
650 					     ntohs(ip->ip_sum));
651 				if (vflag > 1)
652 					(void)printf(" differs by %x", htons(sum));
653 				sep = ", ";
654 			}
655 		}
656 		if (hlen > sizeof(struct ip)) {
657 			hlen -= sizeof(struct ip);
658 			(void)printf("%soptlen=%d", sep, hlen);
659 			ip_optprint((u_char *)(ip + 1), hlen);
660 		}
661 		printf(")");
662 	}
663 	return;
664 
665 trunc:
666 	printf("[|ip]");
667 }
668