1 /* $OpenBSD: print-udp.c,v 1.33 2009/11/04 09:43:11 jsing Exp $ */ 2 3 /* 4 * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996 5 * The Regents of the University of California. All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that: (1) source code distributions 9 * retain the above copyright notice and this paragraph in its entirety, (2) 10 * distributions including binary code include the above copyright notice and 11 * this paragraph in its entirety in the documentation or other materials 12 * provided with the distribution, and (3) all advertising materials mentioning 13 * features or use of this software display the following acknowledgement: 14 * ``This product includes software developed by the University of California, 15 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of 16 * the University nor the names of its contributors may be used to endorse 17 * or promote products derived from this software without specific prior 18 * written permission. 19 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED 20 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF 21 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 22 */ 23 24 #include <sys/param.h> 25 #include <sys/time.h> 26 #include <sys/socket.h> 27 28 #include <netinet/in.h> 29 #include <netinet/in_systm.h> 30 #include <netinet/ip.h> 31 #include <netinet/ip_var.h> 32 #include <netinet/udp.h> 33 #include <netinet/udp_var.h> 34 35 #include <net80211/ieee80211.h> 36 37 #ifdef NOERROR 38 #undef NOERROR /* Solaris sucks */ 39 #endif 40 #ifdef T_UNSPEC 41 #undef T_UNSPEC /* SINIX does too */ 42 #endif 43 #include <arpa/nameser.h> 44 #ifdef SEGSIZE 45 #undef SEGSIZE 46 #endif 47 #include <arpa/tftp.h> 48 49 #include <rpc/rpc.h> 50 51 #include <stdio.h> 52 #include <string.h> 53 54 #ifdef INET6 55 #include <netinet/ip6.h> 56 #endif 57 58 #include "interface.h" 59 #include "addrtoname.h" 60 #include "appletalk.h" 61 62 #include "nfsv2.h" 63 #include "bootp.h" 64 #include "iapp.h" 65 66 struct rtcphdr { 67 u_short rh_flags; /* T:2 P:1 CNT:5 PT:8 */ 68 u_short rh_len; /* length of message (in words) */ 69 u_int rh_ssrc; /* synchronization src id */ 70 }; 71 72 typedef struct { 73 u_int upper; /* more significant 32 bits */ 74 u_int lower; /* less significant 32 bits */ 75 } ntp64; 76 77 /* 78 * Sender report. 79 */ 80 struct rtcp_sr { 81 ntp64 sr_ntp; /* 64-bit ntp timestamp */ 82 u_int sr_ts; /* reference media timestamp */ 83 u_int sr_np; /* no. packets sent */ 84 u_int sr_nb; /* no. bytes sent */ 85 }; 86 87 /* 88 * Receiver report. 89 * Time stamps are middle 32-bits of ntp timestamp. 90 */ 91 struct rtcp_rr { 92 u_int rr_srcid; /* sender being reported */ 93 u_int rr_nl; /* no. packets lost */ 94 u_int rr_ls; /* extended last seq number received */ 95 u_int rr_dv; /* jitter (delay variance) */ 96 u_int rr_lsr; /* orig. ts from last rr from this src */ 97 u_int rr_dlsr; /* time from recpt of last rr to xmit time */ 98 }; 99 100 /*XXX*/ 101 #define RTCP_PT_SR 200 102 #define RTCP_PT_RR 201 103 #define RTCP_PT_SDES 202 104 #define RTCP_SDES_CNAME 1 105 #define RTCP_SDES_NAME 2 106 #define RTCP_SDES_EMAIL 3 107 #define RTCP_SDES_PHONE 4 108 #define RTCP_SDES_LOC 5 109 #define RTCP_SDES_TOOL 6 110 #define RTCP_SDES_NOTE 7 111 #define RTCP_SDES_PRIV 8 112 #define RTCP_PT_BYE 203 113 #define RTCP_PT_APP 204 114 115 static void 116 vat_print(const void *hdr, u_int len, register const struct udphdr *up) 117 { 118 /* vat/vt audio */ 119 u_int ts = *(u_short *)hdr; 120 if ((ts & 0xf060) != 0) { 121 /* probably vt */ 122 (void)printf(" udp/vt %u %d / %d", 123 (u_int32_t)(ntohs(up->uh_ulen) - sizeof(*up)), 124 ts & 0x3ff, ts >> 10); 125 } else { 126 /* probably vat */ 127 u_int i0 = ntohl(((u_int *)hdr)[0]); 128 u_int i1 = ntohl(((u_int *)hdr)[1]); 129 printf(" udp/vat %u c%d %u%s", 130 (u_int32_t)(ntohs(up->uh_ulen) - sizeof(*up) - 8), 131 i0 & 0xffff, 132 i1, i0 & 0x800000? "*" : ""); 133 /* audio format */ 134 if (i0 & 0x1f0000) 135 printf(" f%d", (i0 >> 16) & 0x1f); 136 if (i0 & 0x3f000000) 137 printf(" s%d", (i0 >> 24) & 0x3f); 138 } 139 } 140 141 static void 142 rtp_print(const void *hdr, u_int len, register const struct udphdr *up) 143 { 144 /* rtp v1 or v2 */ 145 u_int *ip = (u_int *)hdr; 146 u_int hasopt, hasext, contype, hasmarker; 147 u_int i0 = ntohl(((u_int *)hdr)[0]); 148 u_int i1 = ntohl(((u_int *)hdr)[1]); 149 u_int dlen = ntohs(up->uh_ulen) - sizeof(*up) - 8; 150 const char * ptype; 151 152 ip += 2; 153 len >>= 2; 154 len -= 2; 155 hasopt = 0; 156 hasext = 0; 157 if ((i0 >> 30) == 1) { 158 /* rtp v1 */ 159 hasopt = i0 & 0x800000; 160 contype = (i0 >> 16) & 0x3f; 161 hasmarker = i0 & 0x400000; 162 ptype = "rtpv1"; 163 } else { 164 /* rtp v2 */ 165 hasext = i0 & 0x10000000; 166 contype = (i0 >> 16) & 0x7f; 167 hasmarker = i0 & 0x800000; 168 dlen -= 4; 169 ptype = "rtp"; 170 ip += 1; 171 len -= 1; 172 } 173 printf(" udp/%s %d c%d %s%s %d %u", 174 ptype, 175 dlen, 176 contype, 177 (hasopt || hasext)? "+" : "", 178 hasmarker? "*" : "", 179 i0 & 0xffff, 180 i1); 181 if (vflag) { 182 printf(" %u", i1); 183 if (hasopt) { 184 u_int i2, optlen; 185 do { 186 i2 = ip[0]; 187 optlen = (i2 >> 16) & 0xff; 188 if (optlen == 0 || optlen > len) { 189 printf(" !opt"); 190 return; 191 } 192 ip += optlen; 193 len -= optlen; 194 } while ((int)i2 >= 0); 195 } 196 if (hasext) { 197 u_int i2, extlen; 198 i2 = ip[0]; 199 extlen = (i2 & 0xffff) + 1; 200 if (extlen > len) { 201 printf(" !ext"); 202 return; 203 } 204 ip += extlen; 205 } 206 if (contype == 0x1f) /*XXX H.261 */ 207 printf(" 0x%04x", ip[0] >> 16); 208 } 209 } 210 211 static const u_char * 212 rtcp_print(const u_char *hdr, const u_char *ep) 213 { 214 /* rtp v2 control (rtcp) */ 215 struct rtcp_rr *rr = 0; 216 struct rtcp_sr *sr; 217 struct rtcphdr *rh = (struct rtcphdr *)hdr; 218 u_int len; 219 u_short flags; 220 int cnt; 221 double ts, dts; 222 if ((u_char *)(rh + 1) > ep) { 223 printf(" [|rtcp]"); 224 return (ep); 225 } 226 len = (ntohs(rh->rh_len) + 1) * 4; 227 flags = ntohs(rh->rh_flags); 228 cnt = (flags >> 8) & 0x1f; 229 switch (flags & 0xff) { 230 case RTCP_PT_SR: 231 sr = (struct rtcp_sr *)(rh + 1); 232 printf(" sr"); 233 if (len != cnt * sizeof(*rr) + sizeof(*sr) + sizeof(*rh)) 234 printf(" [%d]", len); 235 if (vflag) 236 printf(" %u", (u_int32_t)ntohl(rh->rh_ssrc)); 237 if ((u_char *)(sr + 1) > ep) { 238 printf(" [|rtcp]"); 239 return (ep); 240 } 241 ts = (double)((u_int32_t)ntohl(sr->sr_ntp.upper)) + 242 ((double)((u_int32_t)ntohl(sr->sr_ntp.lower)) / 243 4294967296.0); 244 printf(" @%.2f %u %up %ub", ts, (u_int32_t)ntohl(sr->sr_ts), 245 (u_int32_t)ntohl(sr->sr_np), (u_int32_t)ntohl(sr->sr_nb)); 246 rr = (struct rtcp_rr *)(sr + 1); 247 break; 248 case RTCP_PT_RR: 249 printf(" rr"); 250 if (len != cnt * sizeof(*rr) + sizeof(*rh)) 251 printf(" [%d]", len); 252 rr = (struct rtcp_rr *)(rh + 1); 253 if (vflag) 254 printf(" %u", (u_int32_t)ntohl(rh->rh_ssrc)); 255 break; 256 case RTCP_PT_SDES: 257 printf(" sdes %d", len); 258 if (vflag) 259 printf(" %u", (u_int32_t)ntohl(rh->rh_ssrc)); 260 cnt = 0; 261 break; 262 case RTCP_PT_BYE: 263 printf(" bye %d", len); 264 if (vflag) 265 printf(" %u", (u_int32_t)ntohl(rh->rh_ssrc)); 266 cnt = 0; 267 break; 268 default: 269 printf(" type-0x%x %d", flags & 0xff, len); 270 cnt = 0; 271 break; 272 } 273 if (cnt > 1) 274 printf(" c%d", cnt); 275 while (--cnt >= 0) { 276 if ((u_char *)(rr + 1) > ep) { 277 printf(" [|rtcp]"); 278 return (ep); 279 } 280 if (vflag) 281 printf(" %u", (u_int32_t)ntohl(rr->rr_srcid)); 282 ts = (double)((u_int32_t)ntohl(rr->rr_lsr)) / 65536.; 283 dts = (double)((u_int32_t)ntohl(rr->rr_dlsr)) / 65536.; 284 printf(" %ul %us %uj @%.2f+%.2f", 285 (u_int32_t)ntohl(rr->rr_nl) & 0x00ffffff, 286 (u_int32_t)ntohl(rr->rr_ls), 287 (u_int32_t)ntohl(rr->rr_dv), ts, dts); 288 } 289 return (hdr + len); 290 } 291 292 static int udp_cksum(register const struct ip *ip, 293 register const struct udphdr *up, 294 register int len) 295 { 296 int i, tlen; 297 union phu { 298 struct phdr { 299 u_int32_t src; 300 u_int32_t dst; 301 u_char mbz; 302 u_char proto; 303 u_int16_t len; 304 } ph; 305 u_int16_t pa[6]; 306 } phu; 307 register const u_int16_t *sp; 308 u_int32_t sum; 309 tlen = ntohs(ip->ip_len) - ((const char *)up-(const char*)ip); 310 311 /* pseudo-header.. */ 312 phu.ph.len = htons(tlen); 313 phu.ph.mbz = 0; 314 phu.ph.proto = ip->ip_p; 315 memcpy(&phu.ph.src, &ip->ip_src.s_addr, sizeof(u_int32_t)); 316 memcpy(&phu.ph.dst, &ip->ip_dst.s_addr, sizeof(u_int32_t)); 317 318 sp = &phu.pa[0]; 319 sum = sp[0]+sp[1]+sp[2]+sp[3]+sp[4]+sp[5]; 320 321 sp = (const u_int16_t *)up; 322 323 for (i=0; i<(tlen&~1); i+= 2) 324 sum += *sp++; 325 326 if (tlen & 1) { 327 sum += htons( (*(const char *)sp) << 8); 328 } 329 330 while (sum > 0xffff) 331 sum = (sum & 0xffff) + (sum >> 16); 332 sum = ~sum & 0xffff; 333 334 return (sum); 335 } 336 337 338 339 /* XXX probably should use getservbyname() and cache answers */ 340 #define TFTP_PORT 69 /*XXX*/ 341 #define KERBEROS_PORT 88 /*XXX*/ 342 #define SUNRPC_PORT 111 /*XXX*/ 343 #define NTP_PORT 123 /*XXX*/ 344 #define NETBIOS_NS_PORT 137 /*XXX*/ 345 #define NETBIOS_DGRAM_PORT 138 /*XXX*/ 346 #define SNMP_PORT 161 /*XXX*/ 347 #define SNMPTRAP_PORT 162 /*XXX*/ 348 #define ISAKMP_PORT 500 /*XXX*/ 349 #define RIP_PORT 520 /*XXX*/ 350 #define TIMED_PORT 525 /*XXX*/ 351 #define KERBEROS_SEC_PORT 750 /*XXX*/ 352 #define LWRES_PORT 921 353 #define VQP_PORT 1589 354 #define OLD_RADIUS_AUTH_PORT 1645 355 #define OLD_RADIUS_ACCT_PORT 1646 356 #define L2TP_PORT 1701 /*XXX*/ 357 #define RADIUS_AUTH_PORT 1812 358 #define RADIUS_ACCT_PORT 1813 359 #define HSRP_PORT 1985 /*XXX*/ 360 #define GTP_C_PORT 2123 361 #define GTP_U_PORT 2152 362 #define GTP_PRIME_PORT 3386 363 #define UDPENCAP_PORT 4500 /*XXX*/ 364 #define MULTICASTDNS_PORT 5353 365 366 #ifdef INET6 367 #define RIPNG_PORT 521 /*XXX*/ 368 #define DHCP6_PORT1 546 /*XXX*/ 369 #define DHCP6_PORT2 547 /*XXX*/ 370 #endif 371 372 void 373 udp_print(register const u_char *bp, u_int length, register const u_char *bp2) 374 { 375 register const struct udphdr *up; 376 register const struct ip *ip; 377 register const u_char *cp; 378 register const u_char *ep = bp + length; 379 u_int16_t sport, dport, ulen; 380 #ifdef INET6 381 register const struct ip6_hdr *ip6; 382 #endif 383 384 if (ep > snapend) 385 ep = snapend; 386 up = (struct udphdr *)bp; 387 ip = (struct ip *)bp2; 388 #ifdef INET6 389 if (ip->ip_v == 6) 390 ip6 = (struct ip6_hdr *)bp2; 391 else 392 ip6 = NULL; 393 #endif /*INET6*/ 394 cp = (u_char *)(up + 1); 395 if (cp > snapend) { 396 printf("[|udp]"); 397 return; 398 } 399 if (length < sizeof(struct udphdr)) { 400 (void)printf(" truncated-udp %d", length); 401 return; 402 } 403 length -= sizeof(struct udphdr); 404 405 sport = ntohs(up->uh_sport); 406 dport = ntohs(up->uh_dport); 407 ulen = ntohs(up->uh_ulen); 408 if (packettype) { 409 register struct rpc_msg *rp; 410 enum msg_type direction; 411 412 switch (packettype) { 413 414 case PT_VAT: 415 (void)printf("%s.%s > %s.%s:", 416 ipaddr_string(&ip->ip_src), 417 udpport_string(sport), 418 ipaddr_string(&ip->ip_dst), 419 udpport_string(dport)); 420 vat_print((void *)(up + 1), length, up); 421 break; 422 423 case PT_WB: 424 (void)printf("%s.%s > %s.%s:", 425 ipaddr_string(&ip->ip_src), 426 udpport_string(sport), 427 ipaddr_string(&ip->ip_dst), 428 udpport_string(dport)); 429 wb_print((void *)(up + 1), length); 430 break; 431 432 case PT_RPC: 433 (void)printf("%s.%s > %s.%s: ", 434 ipaddr_string(&ip->ip_src), 435 udpport_string(sport), 436 ipaddr_string(&ip->ip_dst), 437 udpport_string(dport)); 438 rp = (struct rpc_msg *)(up + 1); 439 direction = (enum msg_type)ntohl(rp->rm_direction); 440 if (direction == CALL) 441 sunrpcrequest_print((u_char *)rp, length, 442 (u_char *)ip); 443 else 444 nfsreply_print((u_char *)rp, length, 445 (u_char *)ip); /*XXX*/ 446 break; 447 448 case PT_RTP: 449 (void)printf("%s.%s > %s.%s:", 450 ipaddr_string(&ip->ip_src), 451 udpport_string(sport), 452 ipaddr_string(&ip->ip_dst), 453 udpport_string(dport)); 454 rtp_print((void *)(up + 1), length, up); 455 break; 456 457 case PT_RTCP: 458 (void)printf("%s.%s > %s.%s:", 459 ipaddr_string(&ip->ip_src), 460 udpport_string(sport), 461 ipaddr_string(&ip->ip_dst), 462 udpport_string(dport)); 463 while (cp < ep) 464 cp = rtcp_print(cp, ep); 465 break; 466 case PT_CNFP: 467 cnfp_print(cp, length, (u_char *)ip); 468 break; 469 } 470 return; 471 } 472 473 if (!qflag) { 474 register struct rpc_msg *rp; 475 enum msg_type direction; 476 477 rp = (struct rpc_msg *)(up + 1); 478 if (TTEST(rp->rm_direction)) { 479 direction = (enum msg_type)ntohl(rp->rm_direction); 480 if (dport == NFS_PORT && direction == CALL) { 481 (void)printf("%s.%s > %s.%s: ", 482 ipaddr_string(&ip->ip_src), 483 udpport_string(sport), 484 ipaddr_string(&ip->ip_dst), 485 udpport_string(dport)); 486 nfsreq_print((u_char *)rp, length, 487 (u_char *)ip); 488 return; 489 } 490 if (sport == NFS_PORT && direction == REPLY) { 491 (void)printf("%s.%s > %s.%s: ", 492 ipaddr_string(&ip->ip_src), 493 udpport_string(sport), 494 ipaddr_string(&ip->ip_dst), 495 udpport_string(dport)); 496 nfsreply_print((u_char *)rp, length, 497 (u_char *)ip); 498 return; 499 } 500 #ifdef notdef 501 if (dport == SUNRPC_PORT && direction == CALL) { 502 (void)printf("%s.%s > %s.%s: ", 503 ipaddr_string(&ip->ip_src), 504 udpport_string(sport), 505 ipaddr_string(&ip->ip_dst), 506 udpport_string(dport)); 507 sunrpcrequest_print((u_char *)rp, length, (u_char *)ip); 508 return; 509 } 510 #endif 511 } 512 if (TTEST(((struct LAP *)cp)->type) && 513 ((struct LAP *)cp)->type == lapDDP && 514 (atalk_port(sport) || atalk_port(dport))) { 515 if (vflag) 516 fputs("kip ", stdout); 517 atalk_print_llap(cp, length); 518 return; 519 } 520 } 521 #if 0 522 (void)printf("%s.%s > %s.%s:", 523 ipaddr_string(&ip->ip_src), udpport_string(sport), 524 ipaddr_string(&ip->ip_dst), udpport_string(dport)); 525 #else 526 #ifdef INET6 527 if (ip6) { 528 if (ip6->ip6_nxt == IPPROTO_UDP) { 529 (void)printf("%s.%s > %s.%s:", 530 ip6addr_string(&ip6->ip6_src), 531 udpport_string(sport), 532 ip6addr_string(&ip6->ip6_dst), 533 udpport_string(dport)); 534 } else { 535 (void)printf("%s > %s: ", 536 udpport_string(sport), udpport_string(dport)); 537 } 538 } else 539 #endif /*INET6*/ 540 { 541 if (ip->ip_p == IPPROTO_UDP) { 542 (void)printf("%s.%s > %s.%s:", 543 ipaddr_string(&ip->ip_src), 544 udpport_string(sport), 545 ipaddr_string(&ip->ip_dst), 546 udpport_string(dport)); 547 } else { 548 (void)printf("%s > %s:", 549 udpport_string(sport), udpport_string(dport)); 550 } 551 } 552 #endif 553 554 if (ip->ip_v == 4 && vflag) { 555 int sum = up->uh_sum; 556 if (sum == 0) { 557 (void)printf(" [no cksum]"); 558 } else if (TTEST2(cp[0], length)) { 559 sum = udp_cksum(ip, up, length); 560 if (sum != 0) 561 (void)printf(" [bad udp cksum %x!]", sum); 562 else 563 (void)printf(" [udp sum ok]"); 564 } 565 } 566 567 if (!qflag) { 568 #define ISPORT(p) (dport == (p) || sport == (p)) 569 if (ISPORT(NAMESERVER_PORT)) 570 ns_print((const u_char *)(up + 1), length, 0); 571 else if (ISPORT(MULTICASTDNS_PORT)) 572 ns_print((const u_char *)(up + 1), length, 1); 573 else if (ISPORT(LWRES_PORT)) 574 lwres_print((const u_char *)(up + 1), length); 575 else if (ISPORT(TIMED_PORT)) 576 timed_print((const u_char *)(up + 1), length); 577 else if (ISPORT(TFTP_PORT)) 578 tftp_print((const u_char *)(up + 1), length); 579 else if (ISPORT(IPPORT_BOOTPC) || ISPORT(IPPORT_BOOTPS)) 580 bootp_print((const u_char *)(up + 1), length, 581 sport, dport); 582 else if (ISPORT(RIP_PORT)) 583 rip_print((const u_char *)(up + 1), length); 584 else if (ISPORT(SNMP_PORT) || ISPORT(SNMPTRAP_PORT)) 585 snmp_print((const u_char *)(up + 1), length); 586 else if (ISPORT(NTP_PORT)) 587 ntp_print((const u_char *)(up + 1), length); 588 else if (ISPORT(KERBEROS_PORT) || ISPORT(KERBEROS_SEC_PORT)) 589 krb_print((const void *)(up + 1), length); 590 else if (ISPORT(L2TP_PORT)) 591 l2tp_print((const u_char *)(up + 1), length); 592 else if (ISPORT(UDPENCAP_PORT)) 593 udpencap_print((const u_char *)(up + 1), length, bp2); 594 else if (ISPORT(ISAKMP_PORT)) 595 ike_print((const u_char *)(up + 1), length); 596 #if 0 597 else if (ISPORT(NETBIOS_NS_PORT)) 598 nbt_udp137_print((const u_char *)(up + 1), length); 599 else if (ISPORT(NETBIOS_DGRAM_PORT)) 600 nbt_udp138_print((const u_char *)(up + 1), length); 601 #endif 602 else if (ISPORT(OLD_RADIUS_AUTH_PORT) || 603 ISPORT(OLD_RADIUS_ACCT_PORT) || 604 ISPORT(RADIUS_AUTH_PORT) || 605 ISPORT(RADIUS_ACCT_PORT)) 606 radius_print((const u_char *)(up + 1), length); 607 else if (dport == 3456) 608 vat_print((const void *)(up + 1), length, up); 609 else if (ISPORT(IAPP_PORT) || ISPORT(IAPP_OLD_PORT)) 610 iapp_print((const u_char *)(up + 1), length); 611 else if (ISPORT(VQP_PORT)) 612 vqp_print((const u_char *)(up + 1), length); 613 #ifdef INET6 614 else if (ISPORT(RIPNG_PORT)) 615 ripng_print((const u_char *)(up + 1), length); 616 else if (ISPORT(DHCP6_PORT1) || ISPORT(DHCP6_PORT2)) { 617 dhcp6_print((const u_char *)(up + 1), length, 618 sport, dport); 619 } 620 #endif /*INET6*/ 621 else if (ISPORT(GTP_C_PORT) || ISPORT(GTP_U_PORT) || 622 ISPORT(GTP_PRIME_PORT)) 623 gtp_print((const u_char *)(up + 1), length, 624 sport, dport); 625 /* 626 * Kludge in test for whiteboard packets. 627 */ 628 else if (dport == 4567) 629 wb_print((const void *)(up + 1), length); 630 else if (dport == HSRP_PORT) 631 hsrp_print((const u_char *)(up + 1), length); 632 else 633 (void)printf(" udp %u", 634 (u_int32_t)(ulen - sizeof(*up))); 635 #undef ISPORT 636 } else 637 (void)printf(" udp %u", (u_int32_t)(ulen - sizeof(*up))); 638 } 639