void ipx_sap_print(__capability const u_short *ipx, u_int length) { int command, i; PACKET_HAS_ONE_OR_TRUNC(ipx); command = EXTRACT_16BITS(ipx); ipx++; length -= 2; switch (command) { case 1: case 3: if (command == 1) (void)printf("ipx-sap-req"); else (void)printf("ipx-sap-nearest-req"); PACKET_HAS_ONE_OR_TRUNC(ipx); (void)printf(" %s", ipxsap_string(htons(EXTRACT_16BITS(&ipx[0])))); break; case 2: case 4: if (command == 2) (void)printf("ipx-sap-resp"); else (void)printf("ipx-sap-nearest-resp"); for (i = 0; i < 8 && length > 0; i++) { PACKET_HAS_ONE_OR_TRUNC(ipx); (void)printf(" %s '", ipxsap_string(htons(EXTRACT_16BITS(&ipx[0])))); if (fn_printzp((packetbody_t)&ipx[1], 48, snapend)) { printf("'"); goto trunc; } PACKET_HAS_SPACE_OR_TRUNC(ipx, (2 * 25) + 10); printf("' addr %s", ipxaddr_string(EXTRACT_32BITS(&ipx[25]), (packetbody_t)&ipx[27])); ipx += 32; length -= 64; } break; default: (void)printf("ipx-sap-?%x", command); break; } return; trunc: printf("[|ipx %d]", length); }
void carp_print(packetbody_t bp, register u_int len, int ttl) { int version, type; const char *type_s; PACKET_HAS_ONE_OR_TRUNC(bp); version = (bp[0] & 0xf0) >> 4; type = bp[0] & 0x0f; if (type == 1) type_s = "advertise"; else type_s = "unknown"; printf("CARPv%d-%s %d: ", version, type_s, len); if (ttl != 255) printf("[ttl=%d!] ", ttl); if (version != 2 || type != 1) return; PACKET_HAS_SPACE_OR_TRUNC(bp, 6); printf("vhid=%d advbase=%d advskew=%d authlen=%d ", bp[1], bp[5], bp[2], bp[3]); if (vflag) { struct cksum_vec vec[1]; vec[0].ptr = (packetbody_t)bp; vec[0].len = len; if (PACKET_HAS_SPACE(bp, len) && in_cksum(vec, 1)) printf(" (bad carp cksum %x!)", EXTRACT_16BITS(&bp[6])); } printf("counter=%" PRIu64, EXTRACT_64BITS(&bp[8])); return; trunc: printf("[|carp]"); }
int ah_print(packetbody_t bp) { __capability const struct ah *ah; int sumlen; u_int32_t spi; ah = (__capability const struct ah *)bp; PACKET_HAS_ONE_OR_TRUNC(ah); sumlen = ah->ah_len << 2; spi = EXTRACT_32BITS(&ah->ah_spi); printf("AH(spi=0x%08x", spi); if (vflag) printf(",sumlen=%d", sumlen); printf(",seq=0x%x", EXTRACT_32BITS(ah + 1)); /* XXX-BD: previous code allowed 1-byte short packets */ if (!PACKET_HAS_SPACE(bp, sizeof(struct ah) + sumlen)) fputs("[truncated]", stdout); fputs("): ", stdout); return sizeof(struct ah) + sumlen; trunc: fputs("[|AH]", stdout); return -1; }
static void radius_attrs_print(packetbody_t attr, u_int length) { __capability const struct radius_attr *rad_attr = (__capability struct radius_attr *)attr; const char *attr_string; while (length > 0) { if (length < 2) goto trunc; PACKET_HAS_ONE_OR_TRUNC(rad_attr); if (rad_attr->type > 0 && rad_attr->type < TAM_SIZE(attr_type)) attr_string = attr_type[rad_attr->type].name; else attr_string = "Unknown"; if (rad_attr->len < 2) { printf("\n\t %s Attribute (%u), length: %u (bogus, must be >= 2)", attr_string, rad_attr->type, rad_attr->len); return; } if (rad_attr->len > length) { printf("\n\t %s Attribute (%u), length: %u (bogus, goes past end of packet)", attr_string, rad_attr->type, rad_attr->len); return; } printf("\n\t %s Attribute (%u), length: %u, Value: ", attr_string, rad_attr->type, rad_attr->len); if (rad_attr->type < TAM_SIZE(attr_type)) { if (rad_attr->len > 2) { if ( attr_type[rad_attr->type].print_func ) (*attr_type[rad_attr->type].print_func)( ((packetbody_t)(rad_attr+1)), rad_attr->len - 2, rad_attr->type); } } /* do we also want to see a hex dump ? */ if (vflag> 1) print_unknown_data((packetbody_t)rad_attr+2,"\n\t ",(rad_attr->len)-2); length-=(rad_attr->len); rad_attr = (__capability struct radius_attr *)( ((packetbody_t)(rad_attr))+rad_attr->len); } return; trunc: printf(" [|radius]"); }
void ipx_rip_print(__capability const u_short *ipx, u_int length) { int command, i; PACKET_HAS_ONE_OR_TRUNC(ipx); command = EXTRACT_16BITS(ipx); ipx++; length -= 2; switch (command) { case 1: (void)printf("ipx-rip-req"); if (length > 0) { PACKET_HAS_SPACE_OR_TRUNC(ipx, 8); (void)printf(" %08x/%d.%d", EXTRACT_32BITS(&ipx[0]), EXTRACT_16BITS(&ipx[2]), EXTRACT_16BITS(&ipx[3])); } break; case 2: (void)printf("ipx-rip-resp"); for (i = 0; i < 50 && length > 0; i++) { PACKET_HAS_SPACE_OR_TRUNC(ipx, 8); (void)printf(" %08x/%d.%d", EXTRACT_32BITS(&ipx[0]), EXTRACT_16BITS(&ipx[2]), EXTRACT_16BITS(&ipx[3])); ipx += 4; length -= 8; } break; default: (void)printf("ipx-rip-?%x", command); break; } return; trunc: printf("[|ipx %d]", length); }
static void krb4_print(packetbody_t cp) { __capability const struct krb *kp; u_char type; u_short len; #define PRINT if ((cp = c_print(cp, snapend)) == NULL) goto trunc /* True if struct krb is little endian */ #define IS_LENDIAN(kp) (((kp)->type & 0x01) != 0) #define KTOHSP(kp, cp) (IS_LENDIAN(kp) ? EXTRACT_LE_16BITS(cp) : EXTRACT_16BITS(cp)) kp = (__capability const struct krb *)cp; if (!PACKET_HAS_ELEMENT(kp, type)) { fputs(tstr, stdout); return; } type = kp->type & (0xFF << 1); printf(" %s %s: ", IS_LENDIAN(kp) ? "le" : "be", tok2str(type2str, NULL, type)); switch (type) { case AUTH_MSG_KDC_REQUEST: if ((cp = krb4_print_hdr(cp)) == NULL) return; cp += 4; /* ctime */ PACKET_HAS_ONE_OR_TRUNC(cp); printf(" %dmin ", *cp++ * 5); PRINT; putchar('.'); PRINT; break; case AUTH_MSG_APPL_REQUEST: cp += 2; PACKET_HAS_ONE_OR_TRUNC(cp); printf("v%d ", *cp++); PRINT; PACKET_HAS_ONE_OR_TRUNC(cp); printf(" (%d)", *cp++); PACKET_HAS_ONE_OR_TRUNC(cp); printf(" (%d)", *cp); break; case AUTH_MSG_KDC_REPLY: if ((cp = krb4_print_hdr(cp)) == NULL) return; cp += 10; /* timestamp + n + exp + kvno */ PACKET_HAS_SPACE_OR_TRUNC(cp, sizeof(short)); len = KTOHSP(kp, cp); printf(" (%d)", len); break; case AUTH_MSG_ERR_REPLY: if ((cp = krb4_print_hdr(cp)) == NULL) return; cp += 4; /* timestamp */ PACKET_HAS_SPACE_OR_TRUNC(cp, sizeof(short)); printf(" %s ", tok2str(kerr2str, NULL, KTOHSP(kp, cp))); cp += 4; PRINT; break; default: fputs("(unknown)", stdout); break; } return; trunc: fputs(tstr, stdout); }
void tcp_print(packetbody_t bp, register u_int length, packetbody_t bp2, int fragmented) { __capability const struct tcphdr *tp; __capability const struct ip *ip; register u_char flags; register u_int hlen; register char ch; u_int16_t sport, dport, win, urp; u_int32_t seq, ack, thseq, thack; u_int utoval; int threv; #ifdef INET6 __capability const struct ip6_hdr *ip6; #endif tp = (__capability const struct tcphdr *)bp; ip = (__capability const struct ip *)bp2; #ifdef INET6 if (IP_V(ip) == 6) ip6 = (__capability const struct ip6_hdr *)bp2; else ip6 = NULL; #endif /*INET6*/ ch = '\0'; if (!PACKET_HAS_ELEMENT(tp, th_dport)) { (void)printf("%s > %s: [|tcp]", ipaddr_string(&ip->ip_src), ipaddr_string(&ip->ip_dst)); return; } sport = EXTRACT_16BITS(&tp->th_sport); dport = EXTRACT_16BITS(&tp->th_dport); hlen = TH_OFF(tp) * 4; /* * If data present, header length valid, and NFS port used, * assume NFS. * Pass offset of data plus 4 bytes for RPC TCP msg length * to NFS print routines. */ if (!qflag && hlen >= sizeof(*tp) && hlen <= length && (length - hlen) >= 4) { packetbody_t fraglenp; u_int32_t fraglen; __capability const struct sunrpc_msg *rp; enum sunrpc_msg_type direction; fraglenp = (packetbody_t)tp + hlen; if (PACKET_HAS_SPACE(fraglenp, 4)) { fraglen = EXTRACT_32BITS(fraglenp) & 0x7FFFFFFF; if (fraglen > (length - hlen) - 4) fraglen = (length - hlen) - 4; rp = (__capability const struct sunrpc_msg *)(fraglenp + 4); if (PACKET_HAS_ELEMENT(rp, rm_direction)) { direction = (enum sunrpc_msg_type)EXTRACT_32BITS(&rp->rm_direction); if (dport == NFS_PORT && direction == SUNRPC_CALL) { nfsreq_print((packetbody_t)rp, fraglen, (packetbody_t)ip); return; } if (sport == NFS_PORT && direction == SUNRPC_REPLY) { nfsreply_print((packetbody_t)rp, fraglen, (packetbody_t)ip); return; } } } } #ifdef INET6 if (ip6) { if (ip6->ip6_nxt == IPPROTO_TCP) { (void)printf("%s.%s > %s.%s: ", ip6addr_string(&ip6->ip6_src), tcpport_string(sport), ip6addr_string(&ip6->ip6_dst), tcpport_string(dport)); } else { (void)printf("%s > %s: ", tcpport_string(sport), tcpport_string(dport)); } } else #endif /*INET6*/ { if (ip->ip_p == IPPROTO_TCP) { (void)printf("%s.%s > %s.%s: ", ipaddr_string(&ip->ip_src), tcpport_string(sport), ipaddr_string(&ip->ip_dst), tcpport_string(dport)); } else { (void)printf("%s > %s: ", tcpport_string(sport), tcpport_string(dport)); } } if (hlen < sizeof(*tp)) { (void)printf(" tcp %d [bad hdr length %u - too short, < %lu]", length - hlen, hlen, (unsigned long)sizeof(*tp)); return; } PACKET_HAS_ONE_OR_TRUNC(tp); seq = EXTRACT_32BITS(&tp->th_seq); ack = EXTRACT_32BITS(&tp->th_ack); win = EXTRACT_16BITS(&tp->th_win); urp = EXTRACT_16BITS(&tp->th_urp); if (qflag) { (void)printf("tcp %d", length - hlen); if (hlen > length) { (void)printf(" [bad hdr length %u - too long, > %u]", hlen, length); } return; } flags = tp->th_flags; printf("Flags [%s]", bittok2str_nosep(tcp_flag_values, "none", flags)); if (!Sflag && (flags & TH_ACK)) { struct tcp_seq_hash *th; packetbody_t src, dst; register int rev; struct tha tha; /* * Find (or record) the initial sequence numbers for * this conversation. (we pick an arbitrary * collating order so there's only one entry for * both directions). */ #ifdef INET6 rev = 0; if (ip6) { src = (packetbody_t)&ip6->ip6_src; dst = (packetbody_t)&ip6->ip6_dst; if (sport > dport) rev = 1; else if (sport == dport) { if (p_memcmp(src, dst, sizeof ip6->ip6_dst) > 0) rev = 1; } if (rev) { p_memcpy_from_packet(&tha.src, dst, sizeof ip6->ip6_dst); p_memcpy_from_packet(&tha.dst, src, sizeof ip6->ip6_src); tha.port = dport << 16 | sport; } else { p_memcpy_from_packet(&tha.dst, dst, sizeof ip6->ip6_dst); p_memcpy_from_packet(&tha.src, src, sizeof ip6->ip6_src); tha.port = sport << 16 | dport; } } else { /* * Zero out the tha structure; the src and dst * fields are big enough to hold an IPv6 * address, but we only have IPv4 addresses * and thus must clear out the remaining 124 * bits. * * XXX - should we just clear those bytes after * copying the IPv4 addresses, rather than * zeroing out the entire structure and then * overwriting some of the zeroes? * * XXX - this could fail if we see TCP packets * with an IPv6 address with the lower 124 bits * all zero and also see TCP packes with an * IPv4 address with the same 32 bits as the * upper 32 bits of the IPv6 address in question. * Can that happen? Is it likely enough to be * an issue? */ memset(&tha, 0, sizeof(tha)); src = (packetbody_t)&ip->ip_src; dst = (packetbody_t)&ip->ip_dst; if (sport > dport) rev = 1; else if (sport == dport) { if (p_memcmp(src, dst, sizeof ip->ip_dst) > 0) rev = 1; } if (rev) { p_memcpy_from_packet(&tha.src, dst, sizeof ip->ip_dst); p_memcpy_from_packet(&tha.dst, src, sizeof ip->ip_src); tha.port = dport << 16 | sport; } else { p_memcpy_from_packet(&tha.dst, dst, sizeof ip->ip_dst); p_memcpy_from_packet(&tha.src, src, sizeof ip->ip_src); tha.port = sport << 16 | dport; } } #else rev = 0; src = &ip->ip_src; dst = &ip->ip_dst; if (sport > dport) rev = 1; else if (sport == dport) { if (p_memcmp(src, dst, sizeof ip->ip_dst) > 0) rev = 1; } if (rev) { memcpy(&tha.src, dst, sizeof ip->ip_dst); memcpy(&tha.dst, src, sizeof ip->ip_src); tha.port = dport << 16 | sport; } else { memcpy(&tha.dst, dst, sizeof ip->ip_dst); memcpy(&tha.src, src, sizeof ip->ip_src); tha.port = sport << 16 | dport; } #endif threv = rev; for (th = &tcp_seq_hash[tha.port % TSEQ_HASHSIZE]; th->nxt; th = th->nxt) if (memcmp((char *)&tha, (char *)&th->addr, sizeof(th->addr)) == 0) break; if (!th->nxt || (flags & TH_SYN)) { /* didn't find it or new conversation */ if (th->nxt == NULL) { th->nxt = (struct tcp_seq_hash *) calloc(1, sizeof(*th)); if (th->nxt == NULL) error("tcp_print: calloc"); } th->addr = tha; if (rev) th->ack = seq, th->seq = ack - 1; else th->seq = seq, th->ack = ack - 1; } else { if (rev) seq -= th->ack, ack -= th->seq; else seq -= th->seq, ack -= th->ack; } thseq = th->seq; thack = th->ack; } else { /*fool gcc*/ thseq = thack = threv = 0; } if (hlen > length) { (void)printf(" [bad hdr length %u - too long, > %u]", hlen, length); return; } if (vflag && !Kflag && !fragmented) { /* Check the checksum, if possible. */ u_int16_t sum, tcp_sum; if (IP_V(ip) == 4) { if (PACKET_HAS_SPACE(tp, length)) { sum = tcp_cksum(ip, tp, length); tcp_sum = EXTRACT_16BITS(&tp->th_sum); (void)printf(", cksum 0x%04x", tcp_sum); if (sum != 0) (void)printf(" (incorrect -> 0x%04x)", in_cksum_shouldbe(tcp_sum, sum)); else (void)printf(" (correct)"); } } #ifdef INET6 else if (IP_V(ip) == 6 && ip6->ip6_plen) { if (PACKET_HAS_SPACE(tp, length)) { sum = nextproto6_cksum(ip6, (packetbody_t)tp, length, IPPROTO_TCP); tcp_sum = EXTRACT_16BITS(&tp->th_sum); (void)printf(", cksum 0x%04x", tcp_sum); if (sum != 0) (void)printf(" (incorrect -> 0x%04x)", in_cksum_shouldbe(tcp_sum, sum)); else (void)printf(" (correct)"); } } #endif } length -= hlen; if (vflag > 1 || length > 0 || flags & (TH_SYN | TH_FIN | TH_RST)) { (void)printf(", seq %u", seq); if (length > 0) { (void)printf(":%u", seq + length); } } if (flags & TH_ACK) { (void)printf(", ack %u", ack); } (void)printf(", win %d", win); if (flags & TH_URG) (void)printf(", urg %d", urp); /* * Handle any options. */ if (hlen > sizeof(*tp)) { packetbody_t cp; register u_int i, opt, datalen; register u_int len; hlen -= sizeof(*tp); cp = (packetbody_t)tp + sizeof(*tp); printf(", options ["); while (hlen > 0) { if (ch != '\0') putchar(ch); PACKET_HAS_ONE_OR_TRUNC(cp); opt = *cp++; if (ZEROLENOPT(opt)) len = 1; else { PACKET_HAS_ONE_OR_TRUNC(cp); len = *cp++; /* total including type, len */ if (len < 2 || len > hlen) goto bad; --hlen; /* account for length byte */ } --hlen; /* account for type byte */ datalen = 0; /* Bail if "l" bytes of data are not left or were not captured */ #define LENCHECK(l) { if ((l) > hlen) goto bad; PACKET_HAS_SPACE_OR_TRUNC(cp, l); } printf("%s", tok2str(tcp_option_values, "Unknown Option %u", opt)); switch (opt) { case TCPOPT_MAXSEG: datalen = 2; LENCHECK(datalen); (void)printf(" %u", EXTRACT_16BITS(cp)); break; case TCPOPT_WSCALE: datalen = 1; LENCHECK(datalen); (void)printf(" %u", *cp); break; case TCPOPT_SACK: datalen = len - 2; if (datalen % 8 != 0) { (void)printf("malformed sack"); } else { u_int32_t s, e; (void)printf(" %d ", datalen / 8); for (i = 0; i < datalen; i += 8) { LENCHECK(i + 4); s = EXTRACT_32BITS(cp + i); LENCHECK(i + 8); e = EXTRACT_32BITS(cp + i + 4); if (threv) { s -= thseq; e -= thseq; } else { s -= thack; e -= thack; } (void)printf("{%u:%u}", s, e); } } break; case TCPOPT_CC: case TCPOPT_CCNEW: case TCPOPT_CCECHO: case TCPOPT_ECHO: case TCPOPT_ECHOREPLY: /* * those options share their semantics. * fall through */ datalen = 4; LENCHECK(datalen); (void)printf(" %u", EXTRACT_32BITS(cp)); break; case TCPOPT_TIMESTAMP: datalen = 8; LENCHECK(datalen); (void)printf(" val %u ecr %u", EXTRACT_32BITS(cp), EXTRACT_32BITS(cp + 4)); break; case TCPOPT_SIGNATURE: datalen = TCP_SIGLEN; LENCHECK(datalen); #ifdef HAVE_LIBCRYPTO switch (tcp_verify_signature(ip, tp, bp + TH_OFF(tp) * 4, length, cp)) { case SIGNATURE_VALID: (void)printf("valid"); break; case SIGNATURE_INVALID: (void)printf("invalid"); break; case CANT_CHECK_SIGNATURE: (void)printf("can't check - "); for (i = 0; i < TCP_SIGLEN; ++i) (void)printf("%02x", cp[i]); break; } #else for (i = 0; i < TCP_SIGLEN; ++i) (void)printf("%02x", cp[i]); #endif break; case TCPOPT_AUTH: (void)printf("keyid %d", *cp++); datalen = len - 3; for (i = 0; i < datalen; ++i) { LENCHECK(i); (void)printf("%02x", cp[i]); } break; case TCPOPT_EOL: case TCPOPT_NOP: case TCPOPT_SACKOK: /* * Nothing interesting. * fall through */ break; case TCPOPT_UTO: datalen = 2; LENCHECK(datalen); utoval = EXTRACT_16BITS(cp); (void)printf("0x%x", utoval); if (utoval & 0x0001) utoval = (utoval >> 1) * 60; else utoval >>= 1; (void)printf(" %u", utoval); break; default: datalen = len - 2; for (i = 0; i < datalen; ++i) { LENCHECK(i); (void)printf("%02x", cp[i]); } break; } /* Account for data printed */ cp += datalen; hlen -= datalen; /* Check specification against observed length */ ++datalen; /* option octet */ if (!ZEROLENOPT(opt)) ++datalen; /* size octet */ if (datalen != len) (void)printf("[len %d]", len); ch = ','; if (opt == TCPOPT_EOL) break; }