void krb_print(packetbody_t dat) { __capability const struct krb *kp; kp = (__capability const struct krb *)dat; if (!PACKET_HAS_ELEMENT(kp, pvno)) { fputs(tstr, stdout); return; } switch (kp->pvno) { case 1: case 2: case 3: printf(" v%d", kp->pvno); break; case 4: printf(" v%d", kp->pvno); krb4_print((packetbody_t)kp); break; case 106: case 107: fputs(" v5", stdout); /* Decode ASN.1 here "someday" */ break; } return; }
/* * Mobility Header */ int mobility_print(packetbody_t bp, packetbody_t bp2 _U_) { __capability const struct ip6_mobility *mh; int mhlen, hlen, type; mh = (__capability const struct ip6_mobility *)bp; if (!PACKET_HAS_ELEMENT(mh, ip6m_len)) { /* * There's not enough captured data to include the * mobility header length. * * Our caller expects us to return the length, however, * so return a value that will run to the end of the * captured data. * * XXX - "ip6_print()" doesn't do anything with the * returned length, however, as it breaks out of the * header-processing loop. */ mhlen = PACKET_REMAINING(bp); goto trunc; } mhlen = (int)((mh->ip6m_len + 1) << 3); /* XXX ip6m_cksum */ PACKET_HAS_ELEMENT_OR_TRUNC(mh, ip6m_type); type = mh->ip6m_type; switch (type) { case IP6M_BINDING_REQUEST: printf("mobility: BRR"); hlen = IP6M_MINLEN; break; case IP6M_HOME_TEST_INIT: case IP6M_CAREOF_TEST_INIT: printf("mobility: %soTI", type == IP6M_HOME_TEST_INIT ? "H" : "C"); hlen = IP6M_MINLEN; if (vflag) { PACKET_HAS_SPACE_OR_TRUNC(mh, hlen + 8); printf(" %s Init Cookie=%08x:%08x", type == IP6M_HOME_TEST_INIT ? "Home" : "Care-of", EXTRACT_32BITS(&bp[hlen]), EXTRACT_32BITS(&bp[hlen + 4])); } hlen += 8; break; case IP6M_HOME_TEST: case IP6M_CAREOF_TEST: printf("mobility: %soT", type == IP6M_HOME_TEST ? "H" : "C"); PACKET_HAS_ELEMENT_OR_TRUNC(mh, ip6m_data16[0]); printf(" nonce id=0x%x", EXTRACT_16BITS(&mh->ip6m_data16[0])); hlen = IP6M_MINLEN; if (vflag) { PACKET_HAS_SPACE_OR_TRUNC(mh, hlen + 8); printf(" %s Init Cookie=%08x:%08x", type == IP6M_HOME_TEST ? "Home" : "Care-of", EXTRACT_32BITS(&bp[hlen]), EXTRACT_32BITS(&bp[hlen + 4])); } hlen += 8; if (vflag) { PACKET_HAS_SPACE_OR_TRUNC(mh, hlen + 8); printf(" %s Keygen Token=%08x:%08x", type == IP6M_HOME_TEST ? "Home" : "Care-of", EXTRACT_32BITS(&bp[hlen]), EXTRACT_32BITS(&bp[hlen + 4])); } hlen += 8; break; case IP6M_BINDING_UPDATE: printf("mobility: BU"); PACKET_HAS_ELEMENT_OR_TRUNC(mh, ip6m_data16[0]); printf(" seq#=%d", EXTRACT_16BITS(&mh->ip6m_data16[0])); hlen = IP6M_MINLEN; PACKET_HAS_SPACE_OR_TRUNC(mh, hlen + 1); if (bp[hlen] & 0xf0) printf(" "); if (bp[hlen] & 0x80) printf("A"); if (bp[hlen] & 0x40) printf("H"); if (bp[hlen] & 0x20) printf("L"); if (bp[hlen] & 0x10) printf("K"); /* Reserved (4bits) */ hlen += 1; /* Reserved (8bits) */ hlen += 1; PACKET_HAS_SPACE_OR_TRUNC(mh, hlen + 2); /* units of 4 secs */ printf(" lifetime=%d", EXTRACT_16BITS(&bp[hlen]) << 2); hlen += 2; break; case IP6M_BINDING_ACK: printf("mobility: BA"); PACKET_HAS_ELEMENT_OR_TRUNC(mh, ip6m_data8[0]); printf(" status=%d", mh->ip6m_data8[0]); if (mh->ip6m_data8[1] & 0x80) printf(" K"); /* Reserved (7bits) */ hlen = IP6M_MINLEN; PACKET_HAS_SPACE_OR_TRUNC(mh, hlen + 2); printf(" seq#=%d", EXTRACT_16BITS(&bp[hlen])); hlen += 2; PACKET_HAS_SPACE_OR_TRUNC(mh, hlen + 2); /* units of 4 secs */ printf(" lifetime=%d", EXTRACT_16BITS(&bp[hlen]) << 2); hlen += 2; break; case IP6M_BINDING_ERROR: printf("mobility: BE"); PACKET_HAS_ELEMENT_OR_TRUNC(mh, ip6m_data8[0]); printf(" status=%d", mh->ip6m_data8[0]); /* Reserved */ hlen = IP6M_MINLEN; PACKET_HAS_SPACE_OR_TRUNC(mh, hlen + 16); printf(" homeaddr %s", ip6addr_string(&bp[hlen])); hlen += 16; break; default: printf("mobility: type-#%d len=%d", type, mh->ip6m_len); return(mhlen); break; } if (vflag) mobility_opt_print(&bp[hlen], mhlen - hlen); return(mhlen); trunc: fputs("[|MOBILITY]", stdout); return(mhlen); }
static void krb4_print(packetbody_t cp) { __capability const struct krb *kp; u_char type; u_short len; #define PRINT if ((cp = c_print(cp, snapend)) == NULL) goto trunc /* True if struct krb is little endian */ #define IS_LENDIAN(kp) (((kp)->type & 0x01) != 0) #define KTOHSP(kp, cp) (IS_LENDIAN(kp) ? EXTRACT_LE_16BITS(cp) : EXTRACT_16BITS(cp)) kp = (__capability const struct krb *)cp; if (!PACKET_HAS_ELEMENT(kp, type)) { fputs(tstr, stdout); return; } type = kp->type & (0xFF << 1); printf(" %s %s: ", IS_LENDIAN(kp) ? "le" : "be", tok2str(type2str, NULL, type)); switch (type) { case AUTH_MSG_KDC_REQUEST: if ((cp = krb4_print_hdr(cp)) == NULL) return; cp += 4; /* ctime */ PACKET_HAS_ONE_OR_TRUNC(cp); printf(" %dmin ", *cp++ * 5); PRINT; putchar('.'); PRINT; break; case AUTH_MSG_APPL_REQUEST: cp += 2; PACKET_HAS_ONE_OR_TRUNC(cp); printf("v%d ", *cp++); PRINT; PACKET_HAS_ONE_OR_TRUNC(cp); printf(" (%d)", *cp++); PACKET_HAS_ONE_OR_TRUNC(cp); printf(" (%d)", *cp); break; case AUTH_MSG_KDC_REPLY: if ((cp = krb4_print_hdr(cp)) == NULL) return; cp += 10; /* timestamp + n + exp + kvno */ PACKET_HAS_SPACE_OR_TRUNC(cp, sizeof(short)); len = KTOHSP(kp, cp); printf(" (%d)", len); break; case AUTH_MSG_ERR_REPLY: if ((cp = krb4_print_hdr(cp)) == NULL) return; cp += 4; /* timestamp */ PACKET_HAS_SPACE_OR_TRUNC(cp, sizeof(short)); printf(" %s ", tok2str(kerr2str, NULL, KTOHSP(kp, cp))); cp += 4; PRINT; break; default: fputs("(unknown)", stdout); break; } return; trunc: fputs(tstr, stdout); }
void tcp_print(packetbody_t bp, register u_int length, packetbody_t bp2, int fragmented) { __capability const struct tcphdr *tp; __capability const struct ip *ip; register u_char flags; register u_int hlen; register char ch; u_int16_t sport, dport, win, urp; u_int32_t seq, ack, thseq, thack; u_int utoval; int threv; #ifdef INET6 __capability const struct ip6_hdr *ip6; #endif tp = (__capability const struct tcphdr *)bp; ip = (__capability const struct ip *)bp2; #ifdef INET6 if (IP_V(ip) == 6) ip6 = (__capability const struct ip6_hdr *)bp2; else ip6 = NULL; #endif /*INET6*/ ch = '\0'; if (!PACKET_HAS_ELEMENT(tp, th_dport)) { (void)printf("%s > %s: [|tcp]", ipaddr_string(&ip->ip_src), ipaddr_string(&ip->ip_dst)); return; } sport = EXTRACT_16BITS(&tp->th_sport); dport = EXTRACT_16BITS(&tp->th_dport); hlen = TH_OFF(tp) * 4; /* * If data present, header length valid, and NFS port used, * assume NFS. * Pass offset of data plus 4 bytes for RPC TCP msg length * to NFS print routines. */ if (!qflag && hlen >= sizeof(*tp) && hlen <= length && (length - hlen) >= 4) { packetbody_t fraglenp; u_int32_t fraglen; __capability const struct sunrpc_msg *rp; enum sunrpc_msg_type direction; fraglenp = (packetbody_t)tp + hlen; if (PACKET_HAS_SPACE(fraglenp, 4)) { fraglen = EXTRACT_32BITS(fraglenp) & 0x7FFFFFFF; if (fraglen > (length - hlen) - 4) fraglen = (length - hlen) - 4; rp = (__capability const struct sunrpc_msg *)(fraglenp + 4); if (PACKET_HAS_ELEMENT(rp, rm_direction)) { direction = (enum sunrpc_msg_type)EXTRACT_32BITS(&rp->rm_direction); if (dport == NFS_PORT && direction == SUNRPC_CALL) { nfsreq_print((packetbody_t)rp, fraglen, (packetbody_t)ip); return; } if (sport == NFS_PORT && direction == SUNRPC_REPLY) { nfsreply_print((packetbody_t)rp, fraglen, (packetbody_t)ip); return; } } } } #ifdef INET6 if (ip6) { if (ip6->ip6_nxt == IPPROTO_TCP) { (void)printf("%s.%s > %s.%s: ", ip6addr_string(&ip6->ip6_src), tcpport_string(sport), ip6addr_string(&ip6->ip6_dst), tcpport_string(dport)); } else { (void)printf("%s > %s: ", tcpport_string(sport), tcpport_string(dport)); } } else #endif /*INET6*/ { if (ip->ip_p == IPPROTO_TCP) { (void)printf("%s.%s > %s.%s: ", ipaddr_string(&ip->ip_src), tcpport_string(sport), ipaddr_string(&ip->ip_dst), tcpport_string(dport)); } else { (void)printf("%s > %s: ", tcpport_string(sport), tcpport_string(dport)); } } if (hlen < sizeof(*tp)) { (void)printf(" tcp %d [bad hdr length %u - too short, < %lu]", length - hlen, hlen, (unsigned long)sizeof(*tp)); return; } PACKET_HAS_ONE_OR_TRUNC(tp); seq = EXTRACT_32BITS(&tp->th_seq); ack = EXTRACT_32BITS(&tp->th_ack); win = EXTRACT_16BITS(&tp->th_win); urp = EXTRACT_16BITS(&tp->th_urp); if (qflag) { (void)printf("tcp %d", length - hlen); if (hlen > length) { (void)printf(" [bad hdr length %u - too long, > %u]", hlen, length); } return; } flags = tp->th_flags; printf("Flags [%s]", bittok2str_nosep(tcp_flag_values, "none", flags)); if (!Sflag && (flags & TH_ACK)) { struct tcp_seq_hash *th; packetbody_t src, dst; register int rev; struct tha tha; /* * Find (or record) the initial sequence numbers for * this conversation. (we pick an arbitrary * collating order so there's only one entry for * both directions). */ #ifdef INET6 rev = 0; if (ip6) { src = (packetbody_t)&ip6->ip6_src; dst = (packetbody_t)&ip6->ip6_dst; if (sport > dport) rev = 1; else if (sport == dport) { if (p_memcmp(src, dst, sizeof ip6->ip6_dst) > 0) rev = 1; } if (rev) { p_memcpy_from_packet(&tha.src, dst, sizeof ip6->ip6_dst); p_memcpy_from_packet(&tha.dst, src, sizeof ip6->ip6_src); tha.port = dport << 16 | sport; } else { p_memcpy_from_packet(&tha.dst, dst, sizeof ip6->ip6_dst); p_memcpy_from_packet(&tha.src, src, sizeof ip6->ip6_src); tha.port = sport << 16 | dport; } } else { /* * Zero out the tha structure; the src and dst * fields are big enough to hold an IPv6 * address, but we only have IPv4 addresses * and thus must clear out the remaining 124 * bits. * * XXX - should we just clear those bytes after * copying the IPv4 addresses, rather than * zeroing out the entire structure and then * overwriting some of the zeroes? * * XXX - this could fail if we see TCP packets * with an IPv6 address with the lower 124 bits * all zero and also see TCP packes with an * IPv4 address with the same 32 bits as the * upper 32 bits of the IPv6 address in question. * Can that happen? Is it likely enough to be * an issue? */ memset(&tha, 0, sizeof(tha)); src = (packetbody_t)&ip->ip_src; dst = (packetbody_t)&ip->ip_dst; if (sport > dport) rev = 1; else if (sport == dport) { if (p_memcmp(src, dst, sizeof ip->ip_dst) > 0) rev = 1; } if (rev) { p_memcpy_from_packet(&tha.src, dst, sizeof ip->ip_dst); p_memcpy_from_packet(&tha.dst, src, sizeof ip->ip_src); tha.port = dport << 16 | sport; } else { p_memcpy_from_packet(&tha.dst, dst, sizeof ip->ip_dst); p_memcpy_from_packet(&tha.src, src, sizeof ip->ip_src); tha.port = sport << 16 | dport; } } #else rev = 0; src = &ip->ip_src; dst = &ip->ip_dst; if (sport > dport) rev = 1; else if (sport == dport) { if (p_memcmp(src, dst, sizeof ip->ip_dst) > 0) rev = 1; } if (rev) { memcpy(&tha.src, dst, sizeof ip->ip_dst); memcpy(&tha.dst, src, sizeof ip->ip_src); tha.port = dport << 16 | sport; } else { memcpy(&tha.dst, dst, sizeof ip->ip_dst); memcpy(&tha.src, src, sizeof ip->ip_src); tha.port = sport << 16 | dport; } #endif threv = rev; for (th = &tcp_seq_hash[tha.port % TSEQ_HASHSIZE]; th->nxt; th = th->nxt) if (memcmp((char *)&tha, (char *)&th->addr, sizeof(th->addr)) == 0) break; if (!th->nxt || (flags & TH_SYN)) { /* didn't find it or new conversation */ if (th->nxt == NULL) { th->nxt = (struct tcp_seq_hash *) calloc(1, sizeof(*th)); if (th->nxt == NULL) error("tcp_print: calloc"); } th->addr = tha; if (rev) th->ack = seq, th->seq = ack - 1; else th->seq = seq, th->ack = ack - 1; } else { if (rev) seq -= th->ack, ack -= th->seq; else seq -= th->seq, ack -= th->ack; } thseq = th->seq; thack = th->ack; } else { /*fool gcc*/ thseq = thack = threv = 0; } if (hlen > length) { (void)printf(" [bad hdr length %u - too long, > %u]", hlen, length); return; } if (vflag && !Kflag && !fragmented) { /* Check the checksum, if possible. */ u_int16_t sum, tcp_sum; if (IP_V(ip) == 4) { if (PACKET_HAS_SPACE(tp, length)) { sum = tcp_cksum(ip, tp, length); tcp_sum = EXTRACT_16BITS(&tp->th_sum); (void)printf(", cksum 0x%04x", tcp_sum); if (sum != 0) (void)printf(" (incorrect -> 0x%04x)", in_cksum_shouldbe(tcp_sum, sum)); else (void)printf(" (correct)"); } } #ifdef INET6 else if (IP_V(ip) == 6 && ip6->ip6_plen) { if (PACKET_HAS_SPACE(tp, length)) { sum = nextproto6_cksum(ip6, (packetbody_t)tp, length, IPPROTO_TCP); tcp_sum = EXTRACT_16BITS(&tp->th_sum); (void)printf(", cksum 0x%04x", tcp_sum); if (sum != 0) (void)printf(" (incorrect -> 0x%04x)", in_cksum_shouldbe(tcp_sum, sum)); else (void)printf(" (correct)"); } } #endif } length -= hlen; if (vflag > 1 || length > 0 || flags & (TH_SYN | TH_FIN | TH_RST)) { (void)printf(", seq %u", seq); if (length > 0) { (void)printf(":%u", seq + length); } } if (flags & TH_ACK) { (void)printf(", ack %u", ack); } (void)printf(", win %d", win); if (flags & TH_URG) (void)printf(", urg %d", urp); /* * Handle any options. */ if (hlen > sizeof(*tp)) { packetbody_t cp; register u_int i, opt, datalen; register u_int len; hlen -= sizeof(*tp); cp = (packetbody_t)tp + sizeof(*tp); printf(", options ["); while (hlen > 0) { if (ch != '\0') putchar(ch); PACKET_HAS_ONE_OR_TRUNC(cp); opt = *cp++; if (ZEROLENOPT(opt)) len = 1; else { PACKET_HAS_ONE_OR_TRUNC(cp); len = *cp++; /* total including type, len */ if (len < 2 || len > hlen) goto bad; --hlen; /* account for length byte */ } --hlen; /* account for type byte */ datalen = 0; /* Bail if "l" bytes of data are not left or were not captured */ #define LENCHECK(l) { if ((l) > hlen) goto bad; PACKET_HAS_SPACE_OR_TRUNC(cp, l); } printf("%s", tok2str(tcp_option_values, "Unknown Option %u", opt)); switch (opt) { case TCPOPT_MAXSEG: datalen = 2; LENCHECK(datalen); (void)printf(" %u", EXTRACT_16BITS(cp)); break; case TCPOPT_WSCALE: datalen = 1; LENCHECK(datalen); (void)printf(" %u", *cp); break; case TCPOPT_SACK: datalen = len - 2; if (datalen % 8 != 0) { (void)printf("malformed sack"); } else { u_int32_t s, e; (void)printf(" %d ", datalen / 8); for (i = 0; i < datalen; i += 8) { LENCHECK(i + 4); s = EXTRACT_32BITS(cp + i); LENCHECK(i + 8); e = EXTRACT_32BITS(cp + i + 4); if (threv) { s -= thseq; e -= thseq; } else { s -= thack; e -= thack; } (void)printf("{%u:%u}", s, e); } } break; case TCPOPT_CC: case TCPOPT_CCNEW: case TCPOPT_CCECHO: case TCPOPT_ECHO: case TCPOPT_ECHOREPLY: /* * those options share their semantics. * fall through */ datalen = 4; LENCHECK(datalen); (void)printf(" %u", EXTRACT_32BITS(cp)); break; case TCPOPT_TIMESTAMP: datalen = 8; LENCHECK(datalen); (void)printf(" val %u ecr %u", EXTRACT_32BITS(cp), EXTRACT_32BITS(cp + 4)); break; case TCPOPT_SIGNATURE: datalen = TCP_SIGLEN; LENCHECK(datalen); #ifdef HAVE_LIBCRYPTO switch (tcp_verify_signature(ip, tp, bp + TH_OFF(tp) * 4, length, cp)) { case SIGNATURE_VALID: (void)printf("valid"); break; case SIGNATURE_INVALID: (void)printf("invalid"); break; case CANT_CHECK_SIGNATURE: (void)printf("can't check - "); for (i = 0; i < TCP_SIGLEN; ++i) (void)printf("%02x", cp[i]); break; } #else for (i = 0; i < TCP_SIGLEN; ++i) (void)printf("%02x", cp[i]); #endif break; case TCPOPT_AUTH: (void)printf("keyid %d", *cp++); datalen = len - 3; for (i = 0; i < datalen; ++i) { LENCHECK(i); (void)printf("%02x", cp[i]); } break; case TCPOPT_EOL: case TCPOPT_NOP: case TCPOPT_SACKOK: /* * Nothing interesting. * fall through */ break; case TCPOPT_UTO: datalen = 2; LENCHECK(datalen); utoval = EXTRACT_16BITS(cp); (void)printf("0x%x", utoval); if (utoval & 0x0001) utoval = (utoval >> 1) * 60; else utoval >>= 1; (void)printf(" %u", utoval); break; default: datalen = len - 2; for (i = 0; i < datalen; ++i) { LENCHECK(i); (void)printf("%02x", cp[i]); } break; } /* Account for data printed */ cp += datalen; hlen -= datalen; /* Check specification against observed length */ ++datalen; /* option octet */ if (!ZEROLENOPT(opt)) ++datalen; /* size octet */ if (datalen != len) (void)printf("[len %d]", len); ch = ','; if (opt == TCPOPT_EOL) break; }