1 /* $OpenBSD: print-udp.c,v 1.21 2002/01/22 18:33:07 mickey Exp $ */ 2 3 /* 4 * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996 5 * The Regents of the University of California. All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that: (1) source code distributions 9 * retain the above copyright notice and this paragraph in its entirety, (2) 10 * distributions including binary code include the above copyright notice and 11 * this paragraph in its entirety in the documentation or other materials 12 * provided with the distribution, and (3) all advertising materials mentioning 13 * features or use of this software display the following acknowledgement: 14 * ``This product includes software developed by the University of California, 15 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of 16 * the University nor the names of its contributors may be used to endorse 17 * or promote products derived from this software without specific prior 18 * written permission. 19 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED 20 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF 21 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 22 */ 23 24 #ifndef lint 25 static const char rcsid[] = 26 "@(#) $Header: /home/cvs/src/usr.sbin/tcpdump/print-udp.c,v 1.21 2002/01/22 18:33:07 mickey Exp $ (LBL)"; 27 #endif 28 29 #include <sys/param.h> 30 #include <sys/time.h> 31 #include <sys/socket.h> 32 33 #include <netinet/in.h> 34 #include <netinet/in_systm.h> 35 #include <netinet/ip.h> 36 #include <netinet/ip_var.h> 37 #include <netinet/udp.h> 38 #include <netinet/udp_var.h> 39 40 #ifdef NOERROR 41 #undef NOERROR /* Solaris sucks */ 42 #endif 43 #ifdef T_UNSPEC 44 #undef T_UNSPEC /* SINIX does too */ 45 #endif 46 #include <arpa/nameser.h> 47 #ifdef SEGSIZE 48 #undef SEGSIZE 49 #endif 50 #include <arpa/tftp.h> 51 52 #include <rpc/rpc.h> 53 54 #include <stdio.h> 55 #include <string.h> 56 57 #ifdef INET6 58 #include <netinet/ip6.h> 59 #endif 60 61 #include "interface.h" 62 #include "addrtoname.h" 63 #include "appletalk.h" 64 65 #include "nfsv2.h" 66 #include "bootp.h" 67 68 struct rtcphdr { 69 u_short rh_flags; /* T:2 P:1 CNT:5 PT:8 */ 70 u_short rh_len; /* length of message (in words) */ 71 u_int rh_ssrc; /* synchronization src id */ 72 }; 73 74 typedef struct { 75 u_int upper; /* more significant 32 bits */ 76 u_int lower; /* less significant 32 bits */ 77 } ntp64; 78 79 /* 80 * Sender report. 81 */ 82 struct rtcp_sr { 83 ntp64 sr_ntp; /* 64-bit ntp timestamp */ 84 u_int sr_ts; /* reference media timestamp */ 85 u_int sr_np; /* no. packets sent */ 86 u_int sr_nb; /* no. bytes sent */ 87 }; 88 89 /* 90 * Receiver report. 91 * Time stamps are middle 32-bits of ntp timestamp. 92 */ 93 struct rtcp_rr { 94 u_int rr_srcid; /* sender being reported */ 95 u_int rr_nl; /* no. packets lost */ 96 u_int rr_ls; /* extended last seq number received */ 97 u_int rr_dv; /* jitter (delay variance) */ 98 u_int rr_lsr; /* orig. ts from last rr from this src */ 99 u_int rr_dlsr; /* time from recpt of last rr to xmit time */ 100 }; 101 102 /*XXX*/ 103 #define RTCP_PT_SR 200 104 #define RTCP_PT_RR 201 105 #define RTCP_PT_SDES 202 106 #define RTCP_SDES_CNAME 1 107 #define RTCP_SDES_NAME 2 108 #define RTCP_SDES_EMAIL 3 109 #define RTCP_SDES_PHONE 4 110 #define RTCP_SDES_LOC 5 111 #define RTCP_SDES_TOOL 6 112 #define RTCP_SDES_NOTE 7 113 #define RTCP_SDES_PRIV 8 114 #define RTCP_PT_BYE 203 115 #define RTCP_PT_APP 204 116 117 static void 118 vat_print(const void *hdr, u_int len, register const struct udphdr *up) 119 { 120 /* vat/vt audio */ 121 u_int ts = *(u_short *)hdr; 122 if ((ts & 0xf060) != 0) { 123 /* probably vt */ 124 (void)printf(" udp/vt %u %d / %d", 125 (u_int32_t)(ntohs(up->uh_ulen) - sizeof(*up)), 126 ts & 0x3ff, ts >> 10); 127 } else { 128 /* probably vat */ 129 u_int i0 = ntohl(((u_int *)hdr)[0]); 130 u_int i1 = ntohl(((u_int *)hdr)[1]); 131 printf(" udp/vat %u c%d %u%s", 132 (u_int32_t)(ntohs(up->uh_ulen) - sizeof(*up) - 8), 133 i0 & 0xffff, 134 i1, i0 & 0x800000? "*" : ""); 135 /* audio format */ 136 if (i0 & 0x1f0000) 137 printf(" f%d", (i0 >> 16) & 0x1f); 138 if (i0 & 0x3f000000) 139 printf(" s%d", (i0 >> 24) & 0x3f); 140 } 141 } 142 143 static void 144 rtp_print(const void *hdr, u_int len, register const struct udphdr *up) 145 { 146 /* rtp v1 or v2 */ 147 u_int *ip = (u_int *)hdr; 148 u_int hasopt, hasext, contype, hasmarker; 149 u_int i0 = ntohl(((u_int *)hdr)[0]); 150 u_int i1 = ntohl(((u_int *)hdr)[1]); 151 u_int dlen = ntohs(up->uh_ulen) - sizeof(*up) - 8; 152 const char * ptype; 153 154 ip += 2; 155 len >>= 2; 156 len -= 2; 157 hasopt = 0; 158 hasext = 0; 159 if ((i0 >> 30) == 1) { 160 /* rtp v1 */ 161 hasopt = i0 & 0x800000; 162 contype = (i0 >> 16) & 0x3f; 163 hasmarker = i0 & 0x400000; 164 ptype = "rtpv1"; 165 } else { 166 /* rtp v2 */ 167 hasext = i0 & 0x10000000; 168 contype = (i0 >> 16) & 0x7f; 169 hasmarker = i0 & 0x800000; 170 dlen -= 4; 171 ptype = "rtp"; 172 ip += 1; 173 len -= 1; 174 } 175 printf(" udp/%s %d c%d %s%s %d %u", 176 ptype, 177 dlen, 178 contype, 179 (hasopt || hasext)? "+" : "", 180 hasmarker? "*" : "", 181 i0 & 0xffff, 182 i1); 183 if (vflag) { 184 printf(" %u", i1); 185 if (hasopt) { 186 u_int i2, optlen; 187 do { 188 i2 = ip[0]; 189 optlen = (i2 >> 16) & 0xff; 190 if (optlen == 0 || optlen > len) { 191 printf(" !opt"); 192 return; 193 } 194 ip += optlen; 195 len -= optlen; 196 } while ((int)i2 >= 0); 197 } 198 if (hasext) { 199 u_int i2, extlen; 200 i2 = ip[0]; 201 extlen = (i2 & 0xffff) + 1; 202 if (extlen > len) { 203 printf(" !ext"); 204 return; 205 } 206 ip += extlen; 207 } 208 if (contype == 0x1f) /*XXX H.261 */ 209 printf(" 0x%04x", ip[0] >> 16); 210 } 211 } 212 213 static const u_char * 214 rtcp_print(const u_char *hdr, const u_char *ep) 215 { 216 /* rtp v2 control (rtcp) */ 217 struct rtcp_rr *rr = 0; 218 struct rtcp_sr *sr; 219 struct rtcphdr *rh = (struct rtcphdr *)hdr; 220 u_int len; 221 u_short flags; 222 int cnt; 223 double ts, dts; 224 if ((u_char *)(rh + 1) > ep) { 225 printf(" [|rtcp]"); 226 return (ep); 227 } 228 len = (ntohs(rh->rh_len) + 1) * 4; 229 flags = ntohs(rh->rh_flags); 230 cnt = (flags >> 8) & 0x1f; 231 switch (flags & 0xff) { 232 case RTCP_PT_SR: 233 sr = (struct rtcp_sr *)(rh + 1); 234 printf(" sr"); 235 if (len != cnt * sizeof(*rr) + sizeof(*sr) + sizeof(*rh)) 236 printf(" [%d]", len); 237 if (vflag) 238 printf(" %u", (u_int32_t)ntohl(rh->rh_ssrc)); 239 if ((u_char *)(sr + 1) > ep) { 240 printf(" [|rtcp]"); 241 return (ep); 242 } 243 ts = (double)((u_int32_t)ntohl(sr->sr_ntp.upper)) + 244 ((double)((u_int32_t)ntohl(sr->sr_ntp.lower)) / 245 4294967296.0); 246 printf(" @%.2f %u %up %ub", ts, (u_int32_t)ntohl(sr->sr_ts), 247 (u_int32_t)ntohl(sr->sr_np), (u_int32_t)ntohl(sr->sr_nb)); 248 rr = (struct rtcp_rr *)(sr + 1); 249 break; 250 case RTCP_PT_RR: 251 printf(" rr"); 252 if (len != cnt * sizeof(*rr) + sizeof(*rh)) 253 printf(" [%d]", len); 254 rr = (struct rtcp_rr *)(rh + 1); 255 if (vflag) 256 printf(" %u", (u_int32_t)ntohl(rh->rh_ssrc)); 257 break; 258 case RTCP_PT_SDES: 259 printf(" sdes %d", len); 260 if (vflag) 261 printf(" %u", (u_int32_t)ntohl(rh->rh_ssrc)); 262 cnt = 0; 263 break; 264 case RTCP_PT_BYE: 265 printf(" bye %d", len); 266 if (vflag) 267 printf(" %u", (u_int32_t)ntohl(rh->rh_ssrc)); 268 cnt = 0; 269 break; 270 default: 271 printf(" type-0x%x %d", flags & 0xff, len); 272 cnt = 0; 273 break; 274 } 275 if (cnt > 1) 276 printf(" c%d", cnt); 277 while (--cnt >= 0) { 278 if ((u_char *)(rr + 1) > ep) { 279 printf(" [|rtcp]"); 280 return (ep); 281 } 282 if (vflag) 283 printf(" %u", (u_int32_t)ntohl(rr->rr_srcid)); 284 ts = (double)((u_int32_t)ntohl(rr->rr_lsr)) / 65536.; 285 dts = (double)((u_int32_t)ntohl(rr->rr_dlsr)) / 65536.; 286 printf(" %ul %us %uj @%.2f+%.2f", 287 (u_int32_t)ntohl(rr->rr_nl) & 0x00ffffff, 288 (u_int32_t)ntohl(rr->rr_ls), 289 (u_int32_t)ntohl(rr->rr_dv), ts, dts); 290 } 291 return (hdr + len); 292 } 293 294 static int udp_cksum(register const struct ip *ip, 295 register const struct udphdr *up, 296 register int len) 297 { 298 int i, tlen; 299 union phu { 300 struct phdr { 301 u_int32_t src; 302 u_int32_t dst; 303 u_char mbz; 304 u_char proto; 305 u_int16_t len; 306 } ph; 307 u_int16_t pa[6]; 308 } phu; 309 register const u_int16_t *sp; 310 u_int32_t sum; 311 tlen = ntohs(ip->ip_len) - ((const char *)up-(const char*)ip); 312 313 /* pseudo-header.. */ 314 phu.ph.len = htons(tlen); 315 phu.ph.mbz = 0; 316 phu.ph.proto = ip->ip_p; 317 memcpy(&phu.ph.src, &ip->ip_src.s_addr, sizeof(u_int32_t)); 318 memcpy(&phu.ph.dst, &ip->ip_dst.s_addr, sizeof(u_int32_t)); 319 320 sp = &phu.pa[0]; 321 sum = sp[0]+sp[1]+sp[2]+sp[3]+sp[4]+sp[5]; 322 323 sp = (const u_int16_t *)up; 324 325 for (i=0; i<(tlen&~1); i+= 2) 326 sum += *sp++; 327 328 if (tlen & 1) { 329 sum += htons( (*(const char *)sp) << 8); 330 } 331 332 while (sum > 0xffff) 333 sum = (sum & 0xffff) + (sum >> 16); 334 sum = ~sum & 0xffff; 335 336 return (sum); 337 } 338 339 340 341 /* XXX probably should use getservbyname() and cache answers */ 342 #define TFTP_PORT 69 /*XXX*/ 343 #define KERBEROS_PORT 88 /*XXX*/ 344 #define SUNRPC_PORT 111 /*XXX*/ 345 #define SNMP_PORT 161 /*XXX*/ 346 #define NTP_PORT 123 /*XXX*/ 347 #define SNMPTRAP_PORT 162 /*XXX*/ 348 #define RIP_PORT 520 /*XXX*/ 349 #define KERBEROS_SEC_PORT 750 /*XXX*/ 350 #define L2TP_PORT 1701 /*XXX*/ 351 #define ISAKMP_PORT 500 /*XXX*/ 352 #define TIMED_PORT 525 /*XXX*/ 353 #define NETBIOS_NS_PORT 137 /*XXX*/ 354 #define NETBIOS_DGRAM_PORT 138 /*XXX*/ 355 #define OLD_RADIUS_AUTH_PORT 1645 356 #define OLD_RADIUS_ACCT_PORT 1646 357 #define RADIUS_AUTH_PORT 1812 358 #define RADIUS_ACCT_PORT 1813 359 #define HSRP_PORT 1985 /*XXX*/ 360 #define LWRES_PORT 921 361 362 #ifdef INET6 363 #define RIPNG_PORT 521 /*XXX*/ 364 #define DHCP6_PORT1 546 /*XXX*/ 365 #define DHCP6_PORT2 547 /*XXX*/ 366 #endif 367 368 void 369 udp_print(register const u_char *bp, u_int length, register const u_char *bp2) 370 { 371 register const struct udphdr *up; 372 register const struct ip *ip; 373 register const u_char *cp; 374 register const u_char *ep = bp + length; 375 u_int16_t sport, dport, ulen; 376 #ifdef INET6 377 register const struct ip6_hdr *ip6; 378 #endif 379 380 if (ep > snapend) 381 ep = snapend; 382 up = (struct udphdr *)bp; 383 ip = (struct ip *)bp2; 384 #ifdef INET6 385 if (ip->ip_v == 6) 386 ip6 = (struct ip6_hdr *)bp2; 387 else 388 ip6 = NULL; 389 #endif /*INET6*/ 390 cp = (u_char *)(up + 1); 391 if (cp > snapend) { 392 printf("[|udp]"); 393 return; 394 } 395 if (length < sizeof(struct udphdr)) { 396 (void)printf(" truncated-udp %d", length); 397 return; 398 } 399 length -= sizeof(struct udphdr); 400 401 sport = ntohs(up->uh_sport); 402 dport = ntohs(up->uh_dport); 403 ulen = ntohs(up->uh_ulen); 404 if (packettype) { 405 register struct rpc_msg *rp; 406 enum msg_type direction; 407 408 switch (packettype) { 409 410 case PT_VAT: 411 (void)printf("%s.%s > %s.%s:", 412 ipaddr_string(&ip->ip_src), 413 udpport_string(sport), 414 ipaddr_string(&ip->ip_dst), 415 udpport_string(dport)); 416 vat_print((void *)(up + 1), length, up); 417 break; 418 419 case PT_WB: 420 (void)printf("%s.%s > %s.%s:", 421 ipaddr_string(&ip->ip_src), 422 udpport_string(sport), 423 ipaddr_string(&ip->ip_dst), 424 udpport_string(dport)); 425 wb_print((void *)(up + 1), length); 426 break; 427 428 case PT_RPC: 429 (void)printf("%s.%s > %s.%s: ", 430 ipaddr_string(&ip->ip_src), 431 udpport_string(sport), 432 ipaddr_string(&ip->ip_dst), 433 udpport_string(dport)); 434 rp = (struct rpc_msg *)(up + 1); 435 direction = (enum msg_type)ntohl(rp->rm_direction); 436 if (direction == CALL) 437 sunrpcrequest_print((u_char *)rp, length, 438 (u_char *)ip); 439 else 440 nfsreply_print((u_char *)rp, length, 441 (u_char *)ip); /*XXX*/ 442 break; 443 444 case PT_RTP: 445 (void)printf("%s.%s > %s.%s:", 446 ipaddr_string(&ip->ip_src), 447 udpport_string(sport), 448 ipaddr_string(&ip->ip_dst), 449 udpport_string(dport)); 450 rtp_print((void *)(up + 1), length, up); 451 break; 452 453 case PT_RTCP: 454 (void)printf("%s.%s > %s.%s:", 455 ipaddr_string(&ip->ip_src), 456 udpport_string(sport), 457 ipaddr_string(&ip->ip_dst), 458 udpport_string(dport)); 459 while (cp < ep) 460 cp = rtcp_print(cp, ep); 461 break; 462 case PT_CNFP: 463 cnfp_print(cp, length, (u_char *)ip); 464 break; 465 } 466 return; 467 } 468 469 if (!qflag) { 470 register struct rpc_msg *rp; 471 enum msg_type direction; 472 473 rp = (struct rpc_msg *)(up + 1); 474 if (TTEST(rp->rm_direction)) { 475 direction = (enum msg_type)ntohl(rp->rm_direction); 476 if (dport == NFS_PORT && direction == CALL) { 477 (void)printf("%s.%s > %s.%s: ", 478 ipaddr_string(&ip->ip_src), 479 udpport_string(sport), 480 ipaddr_string(&ip->ip_dst), 481 udpport_string(dport)); 482 nfsreq_print((u_char *)rp, length, 483 (u_char *)ip); 484 return; 485 } 486 if (sport == NFS_PORT && direction == REPLY) { 487 (void)printf("%s.%s > %s.%s: ", 488 ipaddr_string(&ip->ip_src), 489 udpport_string(sport), 490 ipaddr_string(&ip->ip_dst), 491 udpport_string(dport)); 492 nfsreply_print((u_char *)rp, length, 493 (u_char *)ip); 494 return; 495 } 496 #ifdef notdef 497 if (dport == SUNRPC_PORT && direction == CALL) { 498 (void)printf("%s.%s > %s.%s: ", 499 ipaddr_string(&ip->ip_src), 500 udpport_string(sport), 501 ipaddr_string(&ip->ip_dst), 502 udpport_string(dport)); 503 sunrpcrequest_print((u_char *)rp, length, (u_char *)ip); 504 return; 505 } 506 #endif 507 } 508 if (TTEST(((struct LAP *)cp)->type) && 509 ((struct LAP *)cp)->type == lapDDP && 510 (atalk_port(sport) || atalk_port(dport))) { 511 if (vflag) 512 fputs("kip ", stdout); 513 atalk_print_llap(cp, length); 514 return; 515 } 516 } 517 #if 0 518 (void)printf("%s.%s > %s.%s:", 519 ipaddr_string(&ip->ip_src), udpport_string(sport), 520 ipaddr_string(&ip->ip_dst), udpport_string(dport)); 521 #else 522 #ifdef INET6 523 if (ip6) { 524 if (ip6->ip6_nxt == IPPROTO_UDP) { 525 (void)printf("%s.%s > %s.%s: ", 526 ip6addr_string(&ip6->ip6_src), 527 udpport_string(sport), 528 ip6addr_string(&ip6->ip6_dst), 529 udpport_string(dport)); 530 } else { 531 (void)printf("%s > %s: ", 532 udpport_string(sport), udpport_string(dport)); 533 } 534 } else 535 #endif /*INET6*/ 536 { 537 if (ip->ip_p == IPPROTO_UDP) { 538 (void)printf("%s.%s > %s.%s: ", 539 ipaddr_string(&ip->ip_src), 540 udpport_string(sport), 541 ipaddr_string(&ip->ip_dst), 542 udpport_string(dport)); 543 } else { 544 (void)printf("%s > %s: ", 545 udpport_string(sport), udpport_string(dport)); 546 } 547 } 548 #endif 549 550 if (ip->ip_v == 4 && vflag) { 551 int sum = up->uh_sum; 552 if (sum == 0) { 553 (void)printf(" [no cksum]"); 554 } else if (TTEST2(cp[0], length)) { 555 sum = udp_cksum(ip, up, length); 556 if (sum != 0) 557 (void)printf(" [bad udp cksum %x!]", sum); 558 else 559 (void)printf(" [udp sum ok]"); 560 } 561 } 562 563 if (!qflag) { 564 #define ISPORT(p) (dport == (p) || sport == (p)) 565 if (ISPORT(NAMESERVER_PORT)) 566 ns_print((const u_char *)(up + 1), length); 567 else if (ISPORT(LWRES_PORT)) 568 lwres_print((const u_char *)(up + 1), length); 569 else if (ISPORT(TIMED_PORT)) 570 timed_print((const u_char *)(up + 1), length); 571 else if (ISPORT(TFTP_PORT)) 572 tftp_print((const u_char *)(up + 1), length); 573 else if (ISPORT(IPPORT_BOOTPC) || ISPORT(IPPORT_BOOTPS)) 574 bootp_print((const u_char *)(up + 1), length, 575 sport, dport); 576 else if (ISPORT(RIP_PORT)) 577 rip_print((const u_char *)(up + 1), length); 578 else if (ISPORT(SNMP_PORT) || ISPORT(SNMPTRAP_PORT)) 579 snmp_print((const u_char *)(up + 1), length); 580 else if (ISPORT(NTP_PORT)) 581 ntp_print((const u_char *)(up + 1), length); 582 else if (ISPORT(KERBEROS_PORT) || ISPORT(KERBEROS_SEC_PORT)) 583 krb_print((const void *)(up + 1), length); 584 else if (ISPORT(L2TP_PORT)) 585 l2tp_print((const u_char *)(up + 1), length); 586 else if (ISPORT(ISAKMP_PORT)) 587 ike_print((const u_char *)(up + 1), length); 588 #if 0 589 else if (ISPORT(NETBIOS_NS_PORT)) 590 nbt_udp137_print((const u_char *)(up + 1), length); 591 else if (ISPORT(NETBIOS_DGRAM_PORT)) 592 nbt_udp138_print((const u_char *)(up + 1), length); 593 #endif 594 else if (ISPORT(OLD_RADIUS_AUTH_PORT) || 595 ISPORT(OLD_RADIUS_ACCT_PORT) || 596 ISPORT(RADIUS_AUTH_PORT) || 597 ISPORT(RADIUS_ACCT_PORT)) 598 radius_print((const u_char *)(up + 1), length); 599 else if (dport == 3456) 600 vat_print((const void *)(up + 1), length, up); 601 #ifdef INET6 602 else if (ISPORT(RIPNG_PORT)) 603 ripng_print((const u_char *)(up + 1), length); 604 else if (ISPORT(DHCP6_PORT1) || ISPORT(DHCP6_PORT2)) { 605 dhcp6_print((const u_char *)(up + 1), length, 606 sport, dport); 607 } 608 #endif /*INET6*/ 609 /* 610 * Kludge in test for whiteboard packets. 611 */ 612 else if (dport == 4567) 613 wb_print((const void *)(up + 1), length); 614 else if (dport == HSRP_PORT) 615 hsrp_print((const u_char *)(up + 1), length); 616 else 617 (void)printf(" udp %u", 618 (u_int32_t)(ulen - sizeof(*up))); 619 #undef ISPORT 620 } else 621 (void)printf(" udp %u", (u_int32_t)(ulen - sizeof(*up))); 622 } 623