mirrors/tcpdump
0
0
Fork 0
mirror of https://github.com/the-tcpdump-group/tcpdump.git synced 2024-11-24 10:33:28 +08:00
Code Issues Packages Projects Releases Wiki Activity
4ac279241d
tcpdump/print-udp.c

708 lines
20 KiB
C
Raw Normal View History

Initial revision
1999-10-08 07:47:09 +08:00
/*
* Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997
* The Regents of the University of California. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that: (1) source code distributions
* retain the above copyright notice and this paragraph in its entirety, (2)
* distributions including binary code include the above copyright notice and
* this paragraph in its entirety in the documentation or other materials
* provided with the distribution, and (3) all advertising materials mentioning
* features or use of this software display the following acknowledgement:
* ``This product includes software developed by the University of California,
* Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
* the University nor the names of its contributors may be used to endorse
* or promote products derived from this software without specific prior
* written permission.
* THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
* WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
*/
Switch to config.h instead of passing defines in DEFS.
1999-11-21 17:36:43 +08:00
#ifdef HAVE_CONFIG_H
#include "config.h"
Initial revision
1999-10-08 07:47:09 +08:00
#endif
Added support for Win32, based on WinPcap.
2002-08-01 16:52:55 +08:00
#include <tcpdump-stdinc.h>
Initial revision
1999-10-08 07:47:09 +08:00
#include "interface.h"
#include "addrtoname.h"
The "__attribute__((packed))" tag on structures causes some files not to compile with Sun C, as "interface.h" isn't being included before the structures are being declared. Furthermore, in the files that Sun C *can* compile, it doesn't cause Sun C to generate code that's safe with unaligned accesses, as "__attribute__" is defined as a do-nothing macro with compilers that don't support it. Therefore, we get rid of that tag on the structures to which it was added, and instead use "EXTRACT_16BIT()" and "EXTRACT_32BIT()" to fetch 16-bit and 32-bit big-endian quantities from packets. We also fix some other references to multi-byte quantities to get rid of code that tries to do unaligned loads on platforms that don't support them. We also throw in a hack that makes those macros use "__attribute__((packed))" on structures containing only one 16-bit or 32-bit integer to get the compiler to generate unaligned-safe code rather than doing it by hand. (GCC on SPARC produces the same code that doing it by hand does; I don't know if GCC on any other big-endian strict-alignment processor generates better code for that case. On little-endian processors, as "ntohs()" and "ntohl()" might be functions, that might actually produce worse code.) Fix some places to use "%u" rather than "%d" to print unsigned quantities.
2002-12-11 15:13:49 +08:00
#include "extract.h"
Initial revision
1999-10-08 07:47:09 +08:00
#include "appletalk.h"
Add "tcp.h" and "udp.h" headers, to declare the TCP and UDP stuff needed by dissectors, and have dissectors include them rather than <netinet/udp.h>, <netinet/udp_var.h>, or <netinet/tcp.h>, if they actually need that stuff. Remove all unnecessary includes of <netinet/udp*.h> or <netinet/tcp*.h> files.
2000-09-23 16:26:30 +08:00
#include "udp.h"
Add an "ip.h" header, to declare the IP stuff needed by dissectors, and have dissectors include them rather than <netinet/ip.h> or <netinet/ip_var.h>, if they actually need that stuff. Put the declarations of the ICMP stuff directly into "print-icmp.c". Remove all unnecessary includes of <netinet/ip*.h> files. Copy the byte-order stuff from "nameser.h" into "tcp.h".
2000-09-23 16:54:24 +08:00
#include "ip.h"
put stripped-down version of ip6.h and icmp6.h into tcpdump tree. ip6.h is almost normal RFC2292 header. icmp6.h has couple of extensions (not covered by RFC2292), like MLD, ICMPv6 nodeinfo, and router renumber. XXX how to synchronize with future kame changes?
2000-10-07 13:53:09 +08:00
#ifdef INET6
#include "ip6.h"
#endif
Add a new "ipproto.h" header file, with definitions of IP protocol type values. Use that rather than private definitions in various files. Add "gmpls.h" to the list of files in FILES, and add it and "ipfc.h" to the list of files in INSTALL.
2003-06-07 19:57:51 +08:00
#include "ipproto.h"
Have our own headers to declare the format of ONC (Sun) RPC messages on the wire; the definitions in many systems use u_long, which is 64 bits long on many platforms - that's OK for in-memory structures, but it doesn't match what's on the wire. Use headers based on the Sun ones, but use u_int32_t for fields, and otherwise make the structures match what's on the wire, and change some names to avoid collision with <rpc/rpc.h>, which print-sunrpc.c includes to declare "getrpcbynumber()" and the structure it returns. Record whether "getrpcbynumber()" is found, and use it only if it's found, rather than basing the decisison on whether we're building for Win32 or not.
2004-12-27 08:41:29 +08:00
#include "rpc_auth.h"
#include "rpc_msg.h"
Add an "ip.h" header, to declare the IP stuff needed by dissectors, and have dissectors include them rather than <netinet/ip.h> or <netinet/ip_var.h>, if they actually need that stuff. Put the declarations of the ICMP stuff directly into "print-icmp.c". Remove all unnecessary includes of <netinet/ip*.h> files. Copy the byte-order stuff from "nameser.h" into "tcp.h".
2000-09-23 16:54:24 +08:00
Include our own "nameser.h", rather than the system's <arpa/nameser.h>, to get NAMESERVER_PORT defined. <arpa/nameser.h> defines T_UNSPEC; that causes collisions on Solaris (and probably at least some other OSes) with stuff included by <rpc/rpc.h>, generating noise when compiling. Move the include of "nameser.h" near the includes of other protocol-defining header files in tcpdump; this also moves it below the include of <rpc/rpc.h>, so we can then move the #undefs of NOERROR and T_UNSPEC below most includes and still have it before the include of "nameser.h", squelching the compiler complaints.
2000-07-14 10:49:00 +08:00
#include "nameser.h"
fix compilation. - print-udp.c: rename of nfsv2.h -> nfs.h - print-{null,sl}.c: ipv6_print -> ip6_print
1999-11-21 20:38:24 +08:00
#include "nfs.h"
Initial revision
1999-10-08 07:47:09 +08:00
struct rtcphdr {
u_intN_t is dead, long live uintN_t. And, as we require at least autoconf 2.61, and as autoconf 2.61 and later have AC_TYPE_UINTn_T and AC_TYPE_INTn_T macros, we use them to define the uintN_t and intN_t macros if the system doesn't define them for us. This lets us get rid of bitypes.h as well.
2014-04-23 15:20:40 +08:00
uint16_t rh_flags; /* T:2 P:1 CNT:5 PT:8 */
uint16_t rh_len; /* length of message (in words) */
uint32_t rh_ssrc; /* synchronization src id */
The "__attribute__((packed))" tag on structures causes some files not to compile with Sun C, as "interface.h" isn't being included before the structures are being declared. Furthermore, in the files that Sun C *can* compile, it doesn't cause Sun C to generate code that's safe with unaligned accesses, as "__attribute__" is defined as a do-nothing macro with compilers that don't support it. Therefore, we get rid of that tag on the structures to which it was added, and instead use "EXTRACT_16BIT()" and "EXTRACT_32BIT()" to fetch 16-bit and 32-bit big-endian quantities from packets. We also fix some other references to multi-byte quantities to get rid of code that tries to do unaligned loads on platforms that don't support them. We also throw in a hack that makes those macros use "__attribute__((packed))" on structures containing only one 16-bit or 32-bit integer to get the compiler to generate unaligned-safe code rather than doing it by hand. (GCC on SPARC produces the same code that doing it by hand does; I don't know if GCC on any other big-endian strict-alignment processor generates better code for that case. On little-endian processors, as "ntohs()" and "ntohl()" might be functions, that might actually produce worse code.) Fix some places to use "%u" rather than "%d" to print unsigned quantities.
2002-12-11 15:13:49 +08:00
};
Initial revision
1999-10-08 07:47:09 +08:00
typedef struct {
u_intN_t is dead, long live uintN_t. And, as we require at least autoconf 2.61, and as autoconf 2.61 and later have AC_TYPE_UINTn_T and AC_TYPE_INTn_T macros, we use them to define the uintN_t and intN_t macros if the system doesn't define them for us. This lets us get rid of bitypes.h as well.
2014-04-23 15:20:40 +08:00
uint32_t upper; /* more significant 32 bits */
uint32_t lower; /* less significant 32 bits */
The "__attribute__((packed))" tag on structures causes some files not to compile with Sun C, as "interface.h" isn't being included before the structures are being declared. Furthermore, in the files that Sun C *can* compile, it doesn't cause Sun C to generate code that's safe with unaligned accesses, as "__attribute__" is defined as a do-nothing macro with compilers that don't support it. Therefore, we get rid of that tag on the structures to which it was added, and instead use "EXTRACT_16BIT()" and "EXTRACT_32BIT()" to fetch 16-bit and 32-bit big-endian quantities from packets. We also fix some other references to multi-byte quantities to get rid of code that tries to do unaligned loads on platforms that don't support them. We also throw in a hack that makes those macros use "__attribute__((packed))" on structures containing only one 16-bit or 32-bit integer to get the compiler to generate unaligned-safe code rather than doing it by hand. (GCC on SPARC produces the same code that doing it by hand does; I don't know if GCC on any other big-endian strict-alignment processor generates better code for that case. On little-endian processors, as "ntohs()" and "ntohl()" might be functions, that might actually produce worse code.) Fix some places to use "%u" rather than "%d" to print unsigned quantities.
2002-12-11 15:13:49 +08:00
} ntp64;
Initial revision
1999-10-08 07:47:09 +08:00
/*
* Sender report.
*/
struct rtcp_sr {
ntp64 sr_ntp; /* 64-bit ntp timestamp */
u_intN_t is dead, long live uintN_t. And, as we require at least autoconf 2.61, and as autoconf 2.61 and later have AC_TYPE_UINTn_T and AC_TYPE_INTn_T macros, we use them to define the uintN_t and intN_t macros if the system doesn't define them for us. This lets us get rid of bitypes.h as well.
2014-04-23 15:20:40 +08:00
uint32_t sr_ts; /* reference media timestamp */
uint32_t sr_np; /* no. packets sent */
uint32_t sr_nb; /* no. bytes sent */
The "__attribute__((packed))" tag on structures causes some files not to compile with Sun C, as "interface.h" isn't being included before the structures are being declared. Furthermore, in the files that Sun C *can* compile, it doesn't cause Sun C to generate code that's safe with unaligned accesses, as "__attribute__" is defined as a do-nothing macro with compilers that don't support it. Therefore, we get rid of that tag on the structures to which it was added, and instead use "EXTRACT_16BIT()" and "EXTRACT_32BIT()" to fetch 16-bit and 32-bit big-endian quantities from packets. We also fix some other references to multi-byte quantities to get rid of code that tries to do unaligned loads on platforms that don't support them. We also throw in a hack that makes those macros use "__attribute__((packed))" on structures containing only one 16-bit or 32-bit integer to get the compiler to generate unaligned-safe code rather than doing it by hand. (GCC on SPARC produces the same code that doing it by hand does; I don't know if GCC on any other big-endian strict-alignment processor generates better code for that case. On little-endian processors, as "ntohs()" and "ntohl()" might be functions, that might actually produce worse code.) Fix some places to use "%u" rather than "%d" to print unsigned quantities.
2002-12-11 15:13:49 +08:00
};
Initial revision
1999-10-08 07:47:09 +08:00
/*
* Receiver report.
* Time stamps are middle 32-bits of ntp timestamp.
*/
struct rtcp_rr {
u_intN_t is dead, long live uintN_t. And, as we require at least autoconf 2.61, and as autoconf 2.61 and later have AC_TYPE_UINTn_T and AC_TYPE_INTn_T macros, we use them to define the uintN_t and intN_t macros if the system doesn't define them for us. This lets us get rid of bitypes.h as well.
2014-04-23 15:20:40 +08:00
uint32_t rr_srcid; /* sender being reported */
uint32_t rr_nl; /* no. packets lost */
uint32_t rr_ls; /* extended last seq number received */
uint32_t rr_dv; /* jitter (delay variance) */
uint32_t rr_lsr; /* orig. ts from last rr from this src */
uint32_t rr_dlsr; /* time from recpt of last rr to xmit time */
The "__attribute__((packed))" tag on structures causes some files not to compile with Sun C, as "interface.h" isn't being included before the structures are being declared. Furthermore, in the files that Sun C *can* compile, it doesn't cause Sun C to generate code that's safe with unaligned accesses, as "__attribute__" is defined as a do-nothing macro with compilers that don't support it. Therefore, we get rid of that tag on the structures to which it was added, and instead use "EXTRACT_16BIT()" and "EXTRACT_32BIT()" to fetch 16-bit and 32-bit big-endian quantities from packets. We also fix some other references to multi-byte quantities to get rid of code that tries to do unaligned loads on platforms that don't support them. We also throw in a hack that makes those macros use "__attribute__((packed))" on structures containing only one 16-bit or 32-bit integer to get the compiler to generate unaligned-safe code rather than doing it by hand. (GCC on SPARC produces the same code that doing it by hand does; I don't know if GCC on any other big-endian strict-alignment processor generates better code for that case. On little-endian processors, as "ntohs()" and "ntohl()" might be functions, that might actually produce worse code.) Fix some places to use "%u" rather than "%d" to print unsigned quantities.
2002-12-11 15:13:49 +08:00
};
Initial revision
1999-10-08 07:47:09 +08:00
/*XXX*/
#define RTCP_PT_SR 200
#define RTCP_PT_RR 201
#define RTCP_PT_SDES 202
#define RTCP_SDES_CNAME 1
#define RTCP_SDES_NAME 2
#define RTCP_SDES_EMAIL 3
#define RTCP_SDES_PHONE 4
#define RTCP_SDES_LOC 5
#define RTCP_SDES_TOOL 6
#define RTCP_SDES_NOTE 7
#define RTCP_SDES_PRIV 8
#define RTCP_PT_BYE 203
#define RTCP_PT_APP 204
static void
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
vat_print(netdissect_options *ndo, const void *hdr, register const struct udphdr *up)
Initial revision
1999-10-08 07:47:09 +08:00
{
/* vat/vt audio */
Fix heuristic not to be byte-order-dependent. I'm *guessing* that the item being fetched is big-endian; the "vt" protocol might be old enough that they developed it on (non-Sun386i) Sun workstations, assuming they didn't just say "this is an Internet protocol, hence fields are big-endian"). That also prevents problems on platforms that don't support unaligned accesses.
2015-04-27 08:09:16 +08:00
u_int ts = EXTRACT_16BITS(hdr);
Initial revision
1999-10-08 07:47:09 +08:00
if ((ts & 0xf060) != 0) {
/* probably vt */
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
ND_PRINT((ndo, "udp/vt %u %d / %d",
u_intN_t is dead, long live uintN_t. And, as we require at least autoconf 2.61, and as autoconf 2.61 and later have AC_TYPE_UINTn_T and AC_TYPE_INTn_T macros, we use them to define the uintN_t and intN_t macros if the system doesn't define them for us. This lets us get rid of bitypes.h as well.
2014-04-23 15:20:40 +08:00
(uint32_t)(EXTRACT_16BITS(&up->uh_ulen) - sizeof(*up)),
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
ts & 0x3ff, ts >> 10));
Initial revision
1999-10-08 07:47:09 +08:00
} else {
/* probably vat */
u_intN_t is dead, long live uintN_t. And, as we require at least autoconf 2.61, and as autoconf 2.61 and later have AC_TYPE_UINTn_T and AC_TYPE_INTn_T macros, we use them to define the uintN_t and intN_t macros if the system doesn't define them for us. This lets us get rid of bitypes.h as well.
2014-04-23 15:20:40 +08:00
uint32_t i0 = EXTRACT_32BITS(&((u_int *)hdr)[0]);
uint32_t i1 = EXTRACT_32BITS(&((u_int *)hdr)[1]);
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
ND_PRINT((ndo, "udp/vat %u c%d %u%s",
u_intN_t is dead, long live uintN_t. And, as we require at least autoconf 2.61, and as autoconf 2.61 and later have AC_TYPE_UINTn_T and AC_TYPE_INTn_T macros, we use them to define the uintN_t and intN_t macros if the system doesn't define them for us. This lets us get rid of bitypes.h as well.
2014-04-23 15:20:40 +08:00
(uint32_t)(EXTRACT_16BITS(&up->uh_ulen) - sizeof(*up) - 8),
Initial revision
1999-10-08 07:47:09 +08:00
i0 & 0xffff,
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
i1, i0 & 0x800000? "*" : ""));
Initial revision
1999-10-08 07:47:09 +08:00
/* audio format */
if (i0 & 0x1f0000)
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
ND_PRINT((ndo, " f%d", (i0 >> 16) & 0x1f));
Initial revision
1999-10-08 07:47:09 +08:00
if (i0 & 0x3f000000)
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
ND_PRINT((ndo, " s%d", (i0 >> 24) & 0x3f));
Initial revision
1999-10-08 07:47:09 +08:00
}
}
static void
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
rtp_print(netdissect_options *ndo, const void *hdr, u_int len,
register const struct udphdr *up)
Initial revision
1999-10-08 07:47:09 +08:00
{
/* rtp v1 or v2 */
u_int *ip = (u_int *)hdr;
u_int hasopt, hasext, contype, hasmarker;
u_intN_t is dead, long live uintN_t. And, as we require at least autoconf 2.61, and as autoconf 2.61 and later have AC_TYPE_UINTn_T and AC_TYPE_INTn_T macros, we use them to define the uintN_t and intN_t macros if the system doesn't define them for us. This lets us get rid of bitypes.h as well.
2014-04-23 15:20:40 +08:00
uint32_t i0 = EXTRACT_32BITS(&((u_int *)hdr)[0]);
uint32_t i1 = EXTRACT_32BITS(&((u_int *)hdr)[1]);
The "__attribute__((packed))" tag on structures causes some files not to compile with Sun C, as "interface.h" isn't being included before the structures are being declared. Furthermore, in the files that Sun C *can* compile, it doesn't cause Sun C to generate code that's safe with unaligned accesses, as "__attribute__" is defined as a do-nothing macro with compilers that don't support it. Therefore, we get rid of that tag on the structures to which it was added, and instead use "EXTRACT_16BIT()" and "EXTRACT_32BIT()" to fetch 16-bit and 32-bit big-endian quantities from packets. We also fix some other references to multi-byte quantities to get rid of code that tries to do unaligned loads on platforms that don't support them. We also throw in a hack that makes those macros use "__attribute__((packed))" on structures containing only one 16-bit or 32-bit integer to get the compiler to generate unaligned-safe code rather than doing it by hand. (GCC on SPARC produces the same code that doing it by hand does; I don't know if GCC on any other big-endian strict-alignment processor generates better code for that case. On little-endian processors, as "ntohs()" and "ntohl()" might be functions, that might actually produce worse code.) Fix some places to use "%u" rather than "%d" to print unsigned quantities.
2002-12-11 15:13:49 +08:00
u_int dlen = EXTRACT_16BITS(&up->uh_ulen) - sizeof(*up) - 8;
Initial revision
1999-10-08 07:47:09 +08:00
const char * ptype;
ip += 2;
len >>= 2;
len -= 2;
hasopt = 0;
hasext = 0;
if ((i0 >> 30) == 1) {
/* rtp v1 */
hasopt = i0 & 0x800000;
contype = (i0 >> 16) & 0x3f;
hasmarker = i0 & 0x400000;
ptype = "rtpv1";
} else {
/* rtp v2 */
hasext = i0 & 0x10000000;
contype = (i0 >> 16) & 0x7f;
hasmarker = i0 & 0x800000;
dlen -= 4;
ptype = "rtp";
ip += 1;
len -= 1;
}
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
ND_PRINT((ndo, "udp/%s %d c%d %s%s %d %u",
Initial revision
1999-10-08 07:47:09 +08:00
ptype,
dlen,
contype,
(hasopt || hasext)? "+" : "",
hasmarker? "*" : "",
i0 & 0xffff,
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
i1));
if (ndo->ndo_vflag) {
ND_PRINT((ndo, " %u", EXTRACT_32BITS(&((u_int *)hdr)[2])));
Initial revision
1999-10-08 07:47:09 +08:00
if (hasopt) {
u_int i2, optlen;
do {
i2 = ip[0];
optlen = (i2 >> 16) & 0xff;
if (optlen == 0 || optlen > len) {
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
ND_PRINT((ndo, " !opt"));
Initial revision
1999-10-08 07:47:09 +08:00
return;
}
ip += optlen;
len -= optlen;
} while ((int)i2 >= 0);
}
if (hasext) {
u_int i2, extlen;
i2 = ip[0];
extlen = (i2 & 0xffff) + 1;
if (extlen > len) {
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
ND_PRINT((ndo, " !ext"));
Initial revision
1999-10-08 07:47:09 +08:00
return;
}
ip += extlen;
}
if (contype == 0x1f) /*XXX H.261 */
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
ND_PRINT((ndo, " 0x%04x", ip[0] >> 16));
Initial revision
1999-10-08 07:47:09 +08:00
}
}
static const u_char *
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
rtcp_print(netdissect_options *ndo, const u_char *hdr, const u_char *ep)
Initial revision
1999-10-08 07:47:09 +08:00
{
/* rtp v2 control (rtcp) */
struct rtcp_rr *rr = 0;
struct rtcp_sr *sr;
struct rtcphdr *rh = (struct rtcphdr *)hdr;
u_int len;
u_intN_t is dead, long live uintN_t. And, as we require at least autoconf 2.61, and as autoconf 2.61 and later have AC_TYPE_UINTn_T and AC_TYPE_INTn_T macros, we use them to define the uintN_t and intN_t macros if the system doesn't define them for us. This lets us get rid of bitypes.h as well.
2014-04-23 15:20:40 +08:00
uint16_t flags;
Initial revision
1999-10-08 07:47:09 +08:00
int cnt;
double ts, dts;
if ((u_char *)(rh + 1) > ep) {
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
ND_PRINT((ndo, " [|rtcp]"));
Initial revision
1999-10-08 07:47:09 +08:00
return (ep);
}
The "__attribute__((packed))" tag on structures causes some files not to compile with Sun C, as "interface.h" isn't being included before the structures are being declared. Furthermore, in the files that Sun C *can* compile, it doesn't cause Sun C to generate code that's safe with unaligned accesses, as "__attribute__" is defined as a do-nothing macro with compilers that don't support it. Therefore, we get rid of that tag on the structures to which it was added, and instead use "EXTRACT_16BIT()" and "EXTRACT_32BIT()" to fetch 16-bit and 32-bit big-endian quantities from packets. We also fix some other references to multi-byte quantities to get rid of code that tries to do unaligned loads on platforms that don't support them. We also throw in a hack that makes those macros use "__attribute__((packed))" on structures containing only one 16-bit or 32-bit integer to get the compiler to generate unaligned-safe code rather than doing it by hand. (GCC on SPARC produces the same code that doing it by hand does; I don't know if GCC on any other big-endian strict-alignment processor generates better code for that case. On little-endian processors, as "ntohs()" and "ntohl()" might be functions, that might actually produce worse code.) Fix some places to use "%u" rather than "%d" to print unsigned quantities.
2002-12-11 15:13:49 +08:00
len = (EXTRACT_16BITS(&rh->rh_len) + 1) * 4;
flags = EXTRACT_16BITS(&rh->rh_flags);
Initial revision
1999-10-08 07:47:09 +08:00
cnt = (flags >> 8) & 0x1f;
switch (flags & 0xff) {
case RTCP_PT_SR:
sr = (struct rtcp_sr *)(rh + 1);
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
ND_PRINT((ndo, " sr"));
Initial revision
1999-10-08 07:47:09 +08:00
if (len != cnt * sizeof(*rr) + sizeof(*sr) + sizeof(*rh))
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
ND_PRINT((ndo, " [%d]", len));
if (ndo->ndo_vflag)
ND_PRINT((ndo, " %u", EXTRACT_32BITS(&rh->rh_ssrc)));
Initial revision
1999-10-08 07:47:09 +08:00
if ((u_char *)(sr + 1) > ep) {
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
ND_PRINT((ndo, " [|rtcp]"));
Initial revision
1999-10-08 07:47:09 +08:00
return (ep);
}
The "__attribute__((packed))" tag on structures causes some files not to compile with Sun C, as "interface.h" isn't being included before the structures are being declared. Furthermore, in the files that Sun C *can* compile, it doesn't cause Sun C to generate code that's safe with unaligned accesses, as "__attribute__" is defined as a do-nothing macro with compilers that don't support it. Therefore, we get rid of that tag on the structures to which it was added, and instead use "EXTRACT_16BIT()" and "EXTRACT_32BIT()" to fetch 16-bit and 32-bit big-endian quantities from packets. We also fix some other references to multi-byte quantities to get rid of code that tries to do unaligned loads on platforms that don't support them. We also throw in a hack that makes those macros use "__attribute__((packed))" on structures containing only one 16-bit or 32-bit integer to get the compiler to generate unaligned-safe code rather than doing it by hand. (GCC on SPARC produces the same code that doing it by hand does; I don't know if GCC on any other big-endian strict-alignment processor generates better code for that case. On little-endian processors, as "ntohs()" and "ntohl()" might be functions, that might actually produce worse code.) Fix some places to use "%u" rather than "%d" to print unsigned quantities.
2002-12-11 15:13:49 +08:00
ts = (double)(EXTRACT_32BITS(&sr->sr_ntp.upper)) +
((double)(EXTRACT_32BITS(&sr->sr_ntp.lower)) /
Initial revision
1999-10-08 07:47:09 +08:00
4294967296.0);
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
ND_PRINT((ndo, " @%.2f %u %up %ub", ts, EXTRACT_32BITS(&sr->sr_ts),
EXTRACT_32BITS(&sr->sr_np), EXTRACT_32BITS(&sr->sr_nb)));
Initial revision
1999-10-08 07:47:09 +08:00
rr = (struct rtcp_rr *)(sr + 1);
break;
case RTCP_PT_RR:
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
ND_PRINT((ndo, " rr"));
Initial revision
1999-10-08 07:47:09 +08:00
if (len != cnt * sizeof(*rr) + sizeof(*rh))
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
ND_PRINT((ndo, " [%d]", len));
Initial revision
1999-10-08 07:47:09 +08:00
rr = (struct rtcp_rr *)(rh + 1);
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
if (ndo->ndo_vflag)
ND_PRINT((ndo, " %u", EXTRACT_32BITS(&rh->rh_ssrc)));
Initial revision
1999-10-08 07:47:09 +08:00
break;
case RTCP_PT_SDES:
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
ND_PRINT((ndo, " sdes %d", len));
if (ndo->ndo_vflag)
ND_PRINT((ndo, " %u", EXTRACT_32BITS(&rh->rh_ssrc)));
Initial revision
1999-10-08 07:47:09 +08:00
cnt = 0;
break;
case RTCP_PT_BYE:
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
ND_PRINT((ndo, " bye %d", len));
if (ndo->ndo_vflag)
ND_PRINT((ndo, " %u", EXTRACT_32BITS(&rh->rh_ssrc)));
Initial revision
1999-10-08 07:47:09 +08:00
cnt = 0;
break;
default:
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
ND_PRINT((ndo, " type-0x%x %d", flags & 0xff, len));
Initial revision
1999-10-08 07:47:09 +08:00
cnt = 0;
break;
}
if (cnt > 1)
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
ND_PRINT((ndo, " c%d", cnt));
Initial revision
1999-10-08 07:47:09 +08:00
while (--cnt >= 0) {
if ((u_char *)(rr + 1) > ep) {
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
ND_PRINT((ndo, " [|rtcp]"));
Initial revision
1999-10-08 07:47:09 +08:00
return (ep);
}
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
if (ndo->ndo_vflag)
ND_PRINT((ndo, " %u", EXTRACT_32BITS(&rr->rr_srcid)));
The "__attribute__((packed))" tag on structures causes some files not to compile with Sun C, as "interface.h" isn't being included before the structures are being declared. Furthermore, in the files that Sun C *can* compile, it doesn't cause Sun C to generate code that's safe with unaligned accesses, as "__attribute__" is defined as a do-nothing macro with compilers that don't support it. Therefore, we get rid of that tag on the structures to which it was added, and instead use "EXTRACT_16BIT()" and "EXTRACT_32BIT()" to fetch 16-bit and 32-bit big-endian quantities from packets. We also fix some other references to multi-byte quantities to get rid of code that tries to do unaligned loads on platforms that don't support them. We also throw in a hack that makes those macros use "__attribute__((packed))" on structures containing only one 16-bit or 32-bit integer to get the compiler to generate unaligned-safe code rather than doing it by hand. (GCC on SPARC produces the same code that doing it by hand does; I don't know if GCC on any other big-endian strict-alignment processor generates better code for that case. On little-endian processors, as "ntohs()" and "ntohl()" might be functions, that might actually produce worse code.) Fix some places to use "%u" rather than "%d" to print unsigned quantities.
2002-12-11 15:13:49 +08:00
ts = (double)(EXTRACT_32BITS(&rr->rr_lsr)) / 65536.;
dts = (double)(EXTRACT_32BITS(&rr->rr_dlsr)) / 65536.;
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
ND_PRINT((ndo, " %ul %us %uj @%.2f+%.2f",
The "__attribute__((packed))" tag on structures causes some files not to compile with Sun C, as "interface.h" isn't being included before the structures are being declared. Furthermore, in the files that Sun C *can* compile, it doesn't cause Sun C to generate code that's safe with unaligned accesses, as "__attribute__" is defined as a do-nothing macro with compilers that don't support it. Therefore, we get rid of that tag on the structures to which it was added, and instead use "EXTRACT_16BIT()" and "EXTRACT_32BIT()" to fetch 16-bit and 32-bit big-endian quantities from packets. We also fix some other references to multi-byte quantities to get rid of code that tries to do unaligned loads on platforms that don't support them. We also throw in a hack that makes those macros use "__attribute__((packed))" on structures containing only one 16-bit or 32-bit integer to get the compiler to generate unaligned-safe code rather than doing it by hand. (GCC on SPARC produces the same code that doing it by hand does; I don't know if GCC on any other big-endian strict-alignment processor generates better code for that case. On little-endian processors, as "ntohs()" and "ntohl()" might be functions, that might actually produce worse code.) Fix some places to use "%u" rather than "%d" to print unsigned quantities.
2002-12-11 15:13:49 +08:00
EXTRACT_32BITS(&rr->rr_nl) & 0x00ffffff,
EXTRACT_32BITS(&rr->rr_ls),
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
EXTRACT_32BITS(&rr->rr_dv), ts, dts));
Initial revision
1999-10-08 07:47:09 +08:00
}
return (hdr + len);
}
NDOize AODV, IPv4 and SCTP decoders
2014-03-26 19:47:29 +08:00
static int udp_cksum(netdissect_options *ndo, register const struct ip *ip,
udp header checksum. from netbsd.
2000-08-02 01:36:49 +08:00
register const struct udphdr *up,
Cut off "snapend" at the length of the IPv4 or IPv6 payload, so we don't run past the end of that payload. Check that the IPv4 total length isn't less than the header length. Use "%u", not "%d", to print unsigned values. Properly update "len" in the header-processing loop for IPv6. Doing so means we can trust the length passed to the TCP and UDP dissectors when constructing the IPv6 pseudo-header; do so (but fix the length we pass to the UDP-over-IPv6 checksum routine). That length is unsigned; make the corresponding arguments to the TCP and UDP checksum routines unsigned.
2003-11-19 08:17:32 +08:00
register u_int len)
udp header checksum. from netbsd.
2000-08-02 01:36:49 +08:00
{
u_intN_t is dead, long live uintN_t. And, as we require at least autoconf 2.61, and as autoconf 2.61 and later have AC_TYPE_UINTn_T and AC_TYPE_INTn_T macros, we use them to define the uintN_t and intN_t macros if the system doesn't define them for us. This lets us get rid of bitypes.h as well.
2014-04-23 15:20:40 +08:00
return nextproto4_cksum(ndo, ip, (const uint8_t *)(void *)up, len, len,
fix partial checksum errors in DCCP decoder, IPv4 case
2014-02-15 19:32:44 +08:00
IPPROTO_UDP);
udp header checksum. from netbsd.
2000-08-02 01:36:49 +08:00
}
#ifdef INET6
static int udp6_cksum(const struct ip6_hdr *ip6, const struct udphdr *up,
Cut off "snapend" at the length of the IPv4 or IPv6 payload, so we don't run past the end of that payload. Check that the IPv4 total length isn't less than the header length. Use "%u", not "%d", to print unsigned values. Properly update "len" in the header-processing loop for IPv6. Doing so means we can trust the length passed to the TCP and UDP dissectors when constructing the IPv6 pseudo-header; do so (but fix the length we pass to the UDP-over-IPv6 checksum routine). That length is unsigned; make the corresponding arguments to the TCP and UDP checksum routines unsigned.
2003-11-19 08:17:32 +08:00
u_int len)
udp header checksum. from netbsd.
2000-08-02 01:36:49 +08:00
{
u_intN_t is dead, long live uintN_t. And, as we require at least autoconf 2.61, and as autoconf 2.61 and later have AC_TYPE_UINTn_T and AC_TYPE_INTn_T macros, we use them to define the uintN_t and intN_t macros if the system doesn't define them for us. This lets us get rid of bitypes.h as well.
2014-04-23 15:20:40 +08:00
return nextproto6_cksum(ip6, (const uint8_t *)(void *)up, len, len,
fix partial checksum errors in DCCP decoder, IPv6 case
2014-02-17 01:29:37 +08:00
IPPROTO_UDP);
udp header checksum. from netbsd.
2000-08-02 01:36:49 +08:00
}
#endif
correct address pair printing on truncated case.
2001-11-26 14:48:12 +08:00
static void
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
udpipaddr_print(netdissect_options *ndo, const struct ip *ip, int sport, int dport)
correct address pair printing on truncated case.
2001-11-26 14:48:12 +08:00
{
#ifdef INET6
const struct ip6_hdr *ip6;
if (IP_V(ip) == 6)
ip6 = (const struct ip6_hdr *)ip;
else
ip6 = NULL;
if (ip6) {
print "addr > addr" correctly again.
2001-12-03 10:06:10 +08:00
if (ip6->ip6_nxt == IPPROTO_UDP) {
Make the port arguments to udpipaddr_print() ints so that there can be an out-of-range flag value. Seperate out the truncation checks into two: are the ports available, then do all the other checks, then check to see if the full UDP header is available. This is a slightly modified version of Alexander's original patch to instead use udpipaddr_print() to print the addresses if the ports are not available. Submitted-by: Alexander Dupuy Sourceforge bug #579811
2003-08-01 07:38:20 +08:00
if (sport == -1) {
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
ND_PRINT((ndo, "%s > %s: ",
Netdissectify the to-name resolution routines. Have them take a netdissect_options * argument, and get the "no name resolution" flag from it. Move the declaration of dnaddr_string to addrtoname.h, along with the other XXX-to-string routines.
2014-04-04 15:43:46 +08:00
ip6addr_string(ndo, &ip6->ip6_src),
ip6addr_string(ndo, &ip6->ip6_dst)));
Make the port arguments to udpipaddr_print() ints so that there can be an out-of-range flag value. Seperate out the truncation checks into two: are the ports available, then do all the other checks, then check to see if the full UDP header is available. This is a slightly modified version of Alexander's original patch to instead use udpipaddr_print() to print the addresses if the ports are not available. Submitted-by: Alexander Dupuy Sourceforge bug #579811
2003-08-01 07:38:20 +08:00
} else {
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
ND_PRINT((ndo, "%s.%s > %s.%s: ",
Netdissectify the to-name resolution routines. Have them take a netdissect_options * argument, and get the "no name resolution" flag from it. Move the declaration of dnaddr_string to addrtoname.h, along with the other XXX-to-string routines.
2014-04-04 15:43:46 +08:00
ip6addr_string(ndo, &ip6->ip6_src),
Make the port arguments to udpipaddr_print() ints so that there can be an out-of-range flag value. Seperate out the truncation checks into two: are the ports available, then do all the other checks, then check to see if the full UDP header is available. This is a slightly modified version of Alexander's original patch to instead use udpipaddr_print() to print the addresses if the ports are not available. Submitted-by: Alexander Dupuy Sourceforge bug #579811
2003-08-01 07:38:20 +08:00
udpport_string(sport),
Netdissectify the to-name resolution routines. Have them take a netdissect_options * argument, and get the "no name resolution" flag from it. Move the declaration of dnaddr_string to addrtoname.h, along with the other XXX-to-string routines.
2014-04-04 15:43:46 +08:00
ip6addr_string(ndo, &ip6->ip6_dst),
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
udpport_string(dport)));
Make the port arguments to udpipaddr_print() ints so that there can be an out-of-range flag value. Seperate out the truncation checks into two: are the ports available, then do all the other checks, then check to see if the full UDP header is available. This is a slightly modified version of Alexander's original patch to instead use udpipaddr_print() to print the addresses if the ports are not available. Submitted-by: Alexander Dupuy Sourceforge bug #579811
2003-08-01 07:38:20 +08:00
}
correct address pair printing on truncated case.
2001-11-26 14:48:12 +08:00
} else {
Make the port arguments to udpipaddr_print() ints so that there can be an out-of-range flag value. Seperate out the truncation checks into two: are the ports available, then do all the other checks, then check to see if the full UDP header is available. This is a slightly modified version of Alexander's original patch to instead use udpipaddr_print() to print the addresses if the ports are not available. Submitted-by: Alexander Dupuy Sourceforge bug #579811
2003-08-01 07:38:20 +08:00
if (sport != -1) {
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
ND_PRINT((ndo, "%s > %s: ",
Make the port arguments to udpipaddr_print() ints so that there can be an out-of-range flag value. Seperate out the truncation checks into two: are the ports available, then do all the other checks, then check to see if the full UDP header is available. This is a slightly modified version of Alexander's original patch to instead use udpipaddr_print() to print the addresses if the ports are not available. Submitted-by: Alexander Dupuy Sourceforge bug #579811
2003-08-01 07:38:20 +08:00
udpport_string(sport),
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
udpport_string(dport)));
Make the port arguments to udpipaddr_print() ints so that there can be an out-of-range flag value. Seperate out the truncation checks into two: are the ports available, then do all the other checks, then check to see if the full UDP header is available. This is a slightly modified version of Alexander's original patch to instead use udpipaddr_print() to print the addresses if the ports are not available. Submitted-by: Alexander Dupuy Sourceforge bug #579811
2003-08-01 07:38:20 +08:00
}
correct address pair printing on truncated case.
2001-11-26 14:48:12 +08:00
}
} else
#endif /*INET6*/
{
print "addr > addr" correctly again.
2001-12-03 10:06:10 +08:00
if (ip->ip_p == IPPROTO_UDP) {
Make the port arguments to udpipaddr_print() ints so that there can be an out-of-range flag value. Seperate out the truncation checks into two: are the ports available, then do all the other checks, then check to see if the full UDP header is available. This is a slightly modified version of Alexander's original patch to instead use udpipaddr_print() to print the addresses if the ports are not available. Submitted-by: Alexander Dupuy Sourceforge bug #579811
2003-08-01 07:38:20 +08:00
if (sport == -1) {
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
ND_PRINT((ndo, "%s > %s: ",
Netdissectify the to-name resolution routines. Have them take a netdissect_options * argument, and get the "no name resolution" flag from it. Move the declaration of dnaddr_string to addrtoname.h, along with the other XXX-to-string routines.
2014-04-04 15:43:46 +08:00
ipaddr_string(ndo, &ip->ip_src),
ipaddr_string(ndo, &ip->ip_dst)));
Make the port arguments to udpipaddr_print() ints so that there can be an out-of-range flag value. Seperate out the truncation checks into two: are the ports available, then do all the other checks, then check to see if the full UDP header is available. This is a slightly modified version of Alexander's original patch to instead use udpipaddr_print() to print the addresses if the ports are not available. Submitted-by: Alexander Dupuy Sourceforge bug #579811
2003-08-01 07:38:20 +08:00
} else {
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
ND_PRINT((ndo, "%s.%s > %s.%s: ",
Netdissectify the to-name resolution routines. Have them take a netdissect_options * argument, and get the "no name resolution" flag from it. Move the declaration of dnaddr_string to addrtoname.h, along with the other XXX-to-string routines.
2014-04-04 15:43:46 +08:00
ipaddr_string(ndo, &ip->ip_src),
Make the port arguments to udpipaddr_print() ints so that there can be an out-of-range flag value. Seperate out the truncation checks into two: are the ports available, then do all the other checks, then check to see if the full UDP header is available. This is a slightly modified version of Alexander's original patch to instead use udpipaddr_print() to print the addresses if the ports are not available. Submitted-by: Alexander Dupuy Sourceforge bug #579811
2003-08-01 07:38:20 +08:00
udpport_string(sport),
Netdissectify the to-name resolution routines. Have them take a netdissect_options * argument, and get the "no name resolution" flag from it. Move the declaration of dnaddr_string to addrtoname.h, along with the other XXX-to-string routines.
2014-04-04 15:43:46 +08:00
ipaddr_string(ndo, &ip->ip_dst),
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
udpport_string(dport)));
Make the port arguments to udpipaddr_print() ints so that there can be an out-of-range flag value. Seperate out the truncation checks into two: are the ports available, then do all the other checks, then check to see if the full UDP header is available. This is a slightly modified version of Alexander's original patch to instead use udpipaddr_print() to print the addresses if the ports are not available. Submitted-by: Alexander Dupuy Sourceforge bug #579811
2003-08-01 07:38:20 +08:00
}
correct address pair printing on truncated case.
2001-11-26 14:48:12 +08:00
} else {
Make the port arguments to udpipaddr_print() ints so that there can be an out-of-range flag value. Seperate out the truncation checks into two: are the ports available, then do all the other checks, then check to see if the full UDP header is available. This is a slightly modified version of Alexander's original patch to instead use udpipaddr_print() to print the addresses if the ports are not available. Submitted-by: Alexander Dupuy Sourceforge bug #579811
2003-08-01 07:38:20 +08:00
if (sport != -1) {
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
ND_PRINT((ndo, "%s > %s: ",
Make the port arguments to udpipaddr_print() ints so that there can be an out-of-range flag value. Seperate out the truncation checks into two: are the ports available, then do all the other checks, then check to see if the full UDP header is available. This is a slightly modified version of Alexander's original patch to instead use udpipaddr_print() to print the addresses if the ports are not available. Submitted-by: Alexander Dupuy Sourceforge bug #579811
2003-08-01 07:38:20 +08:00
udpport_string(sport),
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
udpport_string(dport)));
Make the port arguments to udpipaddr_print() ints so that there can be an out-of-range flag value. Seperate out the truncation checks into two: are the ports available, then do all the other checks, then check to see if the full UDP header is available. This is a slightly modified version of Alexander's original patch to instead use udpipaddr_print() to print the addresses if the ports are not available. Submitted-by: Alexander Dupuy Sourceforge bug #579811
2003-08-01 07:38:20 +08:00
}
correct address pair printing on truncated case.
2001-11-26 14:48:12 +08:00
}
}
}
Initial revision
1999-10-08 07:47:09 +08:00
void
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
udp_print(netdissect_options *ndo, register const u_char *bp, u_int length,
do not try to compute tcp/udp checksum for fragmented datagram. from: jinmei@kame.net
2000-11-18 03:08:14 +08:00
register const u_char *bp2, int fragmented)
Initial revision
1999-10-08 07:47:09 +08:00
{
register const struct udphdr *up;
register const struct ip *ip;
register const u_char *cp;
register const u_char *ep = bp + length;
u_intN_t is dead, long live uintN_t. And, as we require at least autoconf 2.61, and as autoconf 2.61 and later have AC_TYPE_UINTn_T and AC_TYPE_INTn_T macros, we use them to define the uintN_t and intN_t macros if the system doesn't define them for us. This lets us get rid of bitypes.h as well.
2014-04-23 15:20:40 +08:00
uint16_t sport, dport, ulen;
Bring in KAME IPv6 tcpdump. replaces esp/ah/isakmp decoder. Hope I did not break anything. Portability on IPv4-only node needs checking, I'll do this very soon. (sorry for rather jumbo commit) XXx what is _FAVOR_BSD?
1999-10-30 13:11:06 +08:00
#ifdef INET6
register const struct ip6_hdr *ip6;
#endif
Initial revision
1999-10-08 07:47:09 +08:00
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
if (ep > ndo->ndo_snapend)
ep = ndo->ndo_snapend;
Initial revision
1999-10-08 07:47:09 +08:00
up = (struct udphdr *)bp;
ip = (struct ip *)bp2;
Bring in KAME IPv6 tcpdump. replaces esp/ah/isakmp decoder. Hope I did not break anything. Portability on IPv4-only node needs checking, I'll do this very soon. (sorry for rather jumbo commit) XXx what is _FAVOR_BSD?
1999-10-30 13:11:06 +08:00
#ifdef INET6
always use u_intXX_t for protocol format declaration. char/short/int may not come with exact size. while at it, correct signedness of ip/udp header field. nuke most of the use of bitfield. TODO: bitfield in namser.h
2000-10-03 10:54:54 +08:00
if (IP_V(ip) == 6)
Bring in KAME IPv6 tcpdump. replaces esp/ah/isakmp decoder. Hope I did not break anything. Portability on IPv4-only node needs checking, I'll do this very soon. (sorry for rather jumbo commit) XXx what is _FAVOR_BSD?
1999-10-30 13:11:06 +08:00
ip6 = (struct ip6_hdr *)bp2;
else
ip6 = NULL;
#endif /*INET6*/
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
if (!ND_TTEST(up->uh_dport)) {
udpipaddr_print(ndo, ip, -1, -1);
ND_PRINT((ndo, "[|udp]"));
Initial revision
1999-10-08 07:47:09 +08:00
return;
}
Make the port arguments to udpipaddr_print() ints so that there can be an out-of-range flag value. Seperate out the truncation checks into two: are the ports available, then do all the other checks, then check to see if the full UDP header is available. This is a slightly modified version of Alexander's original patch to instead use udpipaddr_print() to print the addresses if the ports are not available. Submitted-by: Alexander Dupuy Sourceforge bug #579811
2003-08-01 07:38:20 +08:00
sport = EXTRACT_16BITS(&up->uh_sport);
dport = EXTRACT_16BITS(&up->uh_dport);
Initial revision
1999-10-08 07:47:09 +08:00
if (length < sizeof(struct udphdr)) {
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
udpipaddr_print(ndo, ip, sport, dport);
ND_PRINT((ndo, "truncated-udp %d", length));
Initial revision
1999-10-08 07:47:09 +08:00
return;
}
Use the length field in the UDP header. If it's less than the length of the IP payload, use it as the size of the UDP packet. If it's greater than the length of the IP payload, and we're not dissecting the payload, report the length as bad.
2014-10-20 04:42:00 +08:00
ulen = EXTRACT_16BITS(&up->uh_ulen);
if (ulen < sizeof(struct udphdr)) {
udpipaddr_print(ndo, ip, sport, dport);
ND_PRINT((ndo, "truncated-udplength %d", ulen));
return;
}
ulen -= sizeof(struct udphdr);
Initial revision
1999-10-08 07:47:09 +08:00
length -= sizeof(struct udphdr);
Use the length field in the UDP header. If it's less than the length of the IP payload, use it as the size of the UDP packet. If it's greater than the length of the IP payload, and we're not dissecting the payload, report the length as bad.
2014-10-20 04:42:00 +08:00
if (ulen < length)
length = ulen;
Initial revision
1999-10-08 07:47:09 +08:00
Use the length field in the UDP header. If it's less than the length of the IP payload, use it as the size of the UDP packet. If it's greater than the length of the IP payload, and we're not dissecting the payload, report the length as bad.
2014-10-20 04:42:00 +08:00
cp = (u_char *)(up + 1);
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
if (cp > ndo->ndo_snapend) {
udpipaddr_print(ndo, ip, sport, dport);
ND_PRINT((ndo, "[|udp]"));
Make the port arguments to udpipaddr_print() ints so that there can be an out-of-range flag value. Seperate out the truncation checks into two: are the ports available, then do all the other checks, then check to see if the full UDP header is available. This is a slightly modified version of Alexander's original patch to instead use udpipaddr_print() to print the addresses if the ports are not available. Submitted-by: Alexander Dupuy Sourceforge bug #579811
2003-08-01 07:38:20 +08:00
return;
}
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
if (ndo->ndo_packettype) {
Have our own headers to declare the format of ONC (Sun) RPC messages on the wire; the definitions in many systems use u_long, which is 64 bits long on many platforms - that's OK for in-memory structures, but it doesn't match what's on the wire. Use headers based on the Sun ones, but use u_int32_t for fields, and otherwise make the structures match what's on the wire, and change some names to avoid collision with <rpc/rpc.h>, which print-sunrpc.c includes to declare "getrpcbynumber()" and the structure it returns. Record whether "getrpcbynumber()" is found, and use it only if it's found, rather than basing the decisison on whether we're building for Win32 or not.
2004-12-27 08:41:29 +08:00
register struct sunrpc_msg *rp;
enum sunrpc_msg_type direction;
Initial revision
1999-10-08 07:47:09 +08:00
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
switch (ndo->ndo_packettype) {
Initial revision
1999-10-08 07:47:09 +08:00
case PT_VAT:
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
udpipaddr_print(ndo, ip, sport, dport);
vat_print(ndo, (void *)(up + 1), up);
Initial revision
1999-10-08 07:47:09 +08:00
break;
case PT_WB:
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
udpipaddr_print(ndo, ip, sport, dport);
NDOize ATM, MPTCP, NTP, VTP & Whiteboard decoders
2014-03-20 18:39:44 +08:00
wb_print(ndo, (void *)(up + 1), length);
Initial revision
1999-10-08 07:47:09 +08:00
break;
case PT_RPC:
Have our own headers to declare the format of ONC (Sun) RPC messages on the wire; the definitions in many systems use u_long, which is 64 bits long on many platforms - that's OK for in-memory structures, but it doesn't match what's on the wire. Use headers based on the Sun ones, but use u_int32_t for fields, and otherwise make the structures match what's on the wire, and change some names to avoid collision with <rpc/rpc.h>, which print-sunrpc.c includes to declare "getrpcbynumber()" and the structure it returns. Record whether "getrpcbynumber()" is found, and use it only if it's found, rather than basing the decisison on whether we're building for Win32 or not.
2004-12-27 08:41:29 +08:00
rp = (struct sunrpc_msg *)(up + 1);
direction = (enum sunrpc_msg_type)EXTRACT_32BITS(&rp->rm_direction);
if (direction == SUNRPC_CALL)
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
sunrpcrequest_print(ndo, (u_char *)rp, length,
Initial revision
1999-10-08 07:47:09 +08:00
(u_char *)ip);
else
NDOize NFS decoder
2014-04-01 20:05:33 +08:00
nfsreply_print(ndo, (u_char *)rp, length,
Initial revision
1999-10-08 07:47:09 +08:00
(u_char *)ip); /*XXX*/
break;
case PT_RTP:
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
udpipaddr_print(ndo, ip, sport, dport);
rtp_print(ndo, (void *)(up + 1), length, up);
Initial revision
1999-10-08 07:47:09 +08:00
break;
case PT_RTCP:
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
udpipaddr_print(ndo, ip, sport, dport);
Initial revision
1999-10-08 07:47:09 +08:00
while (cp < ep)
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
cp = rtcp_print(ndo, cp, ep);
Initial revision
1999-10-08 07:47:09 +08:00
break;
patches to help build on Linux 2.2
1999-10-18 05:37:10 +08:00
case PT_SNMP:
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
udpipaddr_print(ndo, ip, sport, dport);
NDOize SNMP decoder
2014-03-29 19:39:31 +08:00
snmp_print(ndo, (const u_char *)(up + 1), length);
patches to help build on Linux 2.2
1999-10-18 05:37:10 +08:00
break;
add cisco NetFlow support from OpenBSD.
2000-04-27 18:05:30 +08:00
case PT_CNFP:
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
udpipaddr_print(ndo, ip, sport, dport);
Use ND_TCHECK() to do bounds checking. While we're at it, just use the record count to when iterating over records; the ND_TCHECK()s will make sure we don't run past the end of the captured data. Also get rid of an unused argument to cnfp_print().
2014-11-10 15:24:53 +08:00
cnfp_print(ndo, cp);
add cisco NetFlow support from OpenBSD.
2000-04-27 18:05:30 +08:00
break;
From Motonori Shindo: allow "-T" to take "tftp" as an argument to force decoding as TFTP.
2003-05-11 14:01:16 +08:00
case PT_TFTP:
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
udpipaddr_print(ndo, ip, sport, dport);
NDOize 7 more small decoders This change converts DVMRP, DLT_ENC, EGP, GeoNet, NetFlow, SLIP and TFTP decoders.
2014-03-21 20:48:24 +08:00
tftp_print(ndo, cp, length);
From Motonori Shindo: allow "-T" to take "tftp" as an argument to force decoding as TFTP.
2003-05-11 14:01:16 +08:00
break;
From Bruce M. Simpson <bms@spc.org>: RFC 3561 AODV support.
2003-08-06 14:49:38 +08:00
case PT_AODV:
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
udpipaddr_print(ndo, ip, sport, dport);
NDOize AODV, IPv4 and SCTP decoders
2014-03-26 19:47:29 +08:00
aodv_print(ndo, (const u_char *)(up + 1), length,
From Bruce M. Simpson <bms@spc.org>: RFC 3561 AODV support.
2003-08-06 14:49:38 +08:00
#ifdef INET6
Updates from Bruce Simpson: Fix numerous bugs in my AODV submission, red faces all round, mainly due to misunderstanding of EXTRACT_STRING() macro arguments (because these are macros, type checking didn't happen). AODV HELLO extensions are now correctly printed. The code is closer to FreeBSD's style guidelines. Don't use "u_char" and "u_long", use "u_int8_t" and "u_int32_t". "u_long" is definitely wrong as it's 64 bits on some platforms; "u_char" is safe, but the official tcpdump style uses "u_int8_t". At least according to the (long-since-expired) draft-perkins-aodv6-01, the V6 AODV messages have different message type values from the V4 ones in draft-ietf-manet-aodv-13. However, draft-ietf-manet-aodv-13 says that the only differences are in the addresses; we support both. Clean up the way we tell the AODV6 dissector that we're running atop IPv6 a bit. Use "udpipaddr_print()" if we're printing AODV packets as a result of saying "anything that matches this filter is AODV", rather than doing it ourselves under the assumption that it's running over IPv4.
2003-09-13 06:05:56 +08:00
ip6 != NULL);
From Bruce M. Simpson <bms@spc.org>: RFC 3561 AODV support.
2003-08-06 14:49:38 +08:00
#else
FALSE isn't necessarily defined.
2004-12-27 09:13:44 +08:00
0);
From Bruce M. Simpson <bms@spc.org>: RFC 3561 AODV support.
2003-08-06 14:49:38 +08:00
#endif
break;
Add "radius" as an option for -T. This allows tcpdump to handle RADIUS running on non-standard ports. Submitted-By: ssb@sourceforge.net Man page also updated by me.
2012-07-01 06:59:18 +08:00
case PT_RADIUS:
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
udpipaddr_print(ndo, ip, sport, dport);
NDOize Frame Relay, LMP and RADIUS decoders
2014-03-18 20:09:00 +08:00
radius_print(ndo, cp, length);
Add "radius" as an option for -T. This allows tcpdump to handle RADIUS running on non-standard ports. Submitted-By: ssb@sourceforge.net Man page also updated by me.
2012-07-01 06:59:18 +08:00
break;
- Add support for OTV (draft-hasmit-otv-04). - Use the packettype infrastructure (-T vxlan) for VXLAN parsing (waiting for a well known dest port)
2013-02-26 20:44:11 +08:00
case PT_VXLAN:
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
udpipaddr_print(ndo, ip, sport, dport);
vxlan_print(ndo, (const u_char *)(up + 1), length);
- Add support for OTV (draft-hasmit-otv-04). - Use the packettype infrastructure (-T vxlan) for VXLAN parsing (waiting for a well known dest port)
2013-02-26 20:44:11 +08:00
break;
use existing PGM decoder for UDP-encapsulated PGM The original PGM uses its own IP protocol number. "EPGM" or "PGM/UDP" stands for UDP-encapsulated PGM, which has no assigned UDP port number and can be decoded only by means of -T option, which now accepts "pgm" protocol type for this purpose. There is also a sample capture of EPGM now (similar to the one of native PGM, but produced using the "epgm://" protocol schema) and a respective test case.
2013-03-15 01:17:53 +08:00
case PT_PGM:
improve ZeroMQ support (ZMTP/1.0 inside PGM/EPGM) This change adds new code to decode ZeroMQ datagrams, couples it with the PGM decoder and extends the -T option to make all this work. There are two new test cases based on existing captures of ZMTP/1.0 inside [E]PGM to decode the ZMTP/1.0 part of these. This functionality enables decoding of the traffic zeromq library produces for "pgm://" and "epgm://" protocol schemas.
2013-03-15 01:59:38 +08:00
case PT_PGM_ZMTP1:
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
udpipaddr_print(ndo, ip, sport, dport);
NDOize 7 bigger decoders This change converts IGMP, IPv6 mobility options, LDP, Lightweight Access Point, PGM, PPTP and RIP decoders.
2014-03-19 17:57:56 +08:00
pgm_print(ndo, cp, length, bp2);
use existing PGM decoder for UDP-encapsulated PGM The original PGM uses its own IP protocol number. "EPGM" or "PGM/UDP" stands for UDP-encapsulated PGM, which has no assigned UDP port number and can be decoded only by means of -T option, which now accepts "pgm" protocol type for this purpose. There is also a sample capture of EPGM now (similar to the one of native PGM, but produced using the "epgm://" protocol schema) and a respective test case.
2013-03-15 01:17:53 +08:00
break;
LMP: add -T override and fix version 1 test(s) The Link Management Protocol version 1 sample capture added to the tests directory in commit 212eef2 was produced using non-standard UDP port 49998. Later assignment of port 701 reflected in commit 960aee5 made it impossible to decode the capture. This change adds a -T override for LMP, uses it to replace the broken test with two working tests and dismisses the custom test script, lmp.sh.
2013-09-07 16:22:37 +08:00
case PT_LMP:
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
udpipaddr_print(ndo, ip, sport, dport);
NDOize Frame Relay, LMP and RADIUS decoders
2014-03-18 20:09:00 +08:00
lmp_print(ndo, cp, length);
LMP: add -T override and fix version 1 test(s) The Link Management Protocol version 1 sample capture added to the tests directory in commit 212eef2 was produced using non-standard UDP port 49998. Later assignment of port 701 reflected in commit 960aee5 made it impossible to decode the capture. This change adds a -T override for LMP, uses it to replace the broken test with two working tests and dismisses the custom test script, lmp.sh.
2013-09-07 16:22:37 +08:00
break;
Initial revision
1999-10-08 07:47:09 +08:00
}
return;
}
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
udpipaddr_print(ndo, ip, sport, dport);
if (!ndo->ndo_qflag) {
Have our own headers to declare the format of ONC (Sun) RPC messages on the wire; the definitions in many systems use u_long, which is 64 bits long on many platforms - that's OK for in-memory structures, but it doesn't match what's on the wire. Use headers based on the Sun ones, but use u_int32_t for fields, and otherwise make the structures match what's on the wire, and change some names to avoid collision with <rpc/rpc.h>, which print-sunrpc.c includes to declare "getrpcbynumber()" and the structure it returns. Record whether "getrpcbynumber()" is found, and use it only if it's found, rather than basing the decisison on whether we're building for Win32 or not.
2004-12-27 08:41:29 +08:00
register struct sunrpc_msg *rp;
enum sunrpc_msg_type direction;
Initial revision
1999-10-08 07:47:09 +08:00
Have our own headers to declare the format of ONC (Sun) RPC messages on the wire; the definitions in many systems use u_long, which is 64 bits long on many platforms - that's OK for in-memory structures, but it doesn't match what's on the wire. Use headers based on the Sun ones, but use u_int32_t for fields, and otherwise make the structures match what's on the wire, and change some names to avoid collision with <rpc/rpc.h>, which print-sunrpc.c includes to declare "getrpcbynumber()" and the structure it returns. Record whether "getrpcbynumber()" is found, and use it only if it's found, rather than basing the decisison on whether we're building for Win32 or not.
2004-12-27 08:41:29 +08:00
rp = (struct sunrpc_msg *)(up + 1);
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
if (ND_TTEST(rp->rm_direction)) {
Have our own headers to declare the format of ONC (Sun) RPC messages on the wire; the definitions in many systems use u_long, which is 64 bits long on many platforms - that's OK for in-memory structures, but it doesn't match what's on the wire. Use headers based on the Sun ones, but use u_int32_t for fields, and otherwise make the structures match what's on the wire, and change some names to avoid collision with <rpc/rpc.h>, which print-sunrpc.c includes to declare "getrpcbynumber()" and the structure it returns. Record whether "getrpcbynumber()" is found, and use it only if it's found, rather than basing the decisison on whether we're building for Win32 or not.
2004-12-27 08:41:29 +08:00
direction = (enum sunrpc_msg_type)EXTRACT_32BITS(&rp->rm_direction);
if (dport == NFS_PORT && direction == SUNRPC_CALL) {
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
ND_PRINT((ndo, "NFS request xid %u ", EXTRACT_32BITS(&rp->rm_xid)));
NDOize NFS decoder
2014-04-01 20:05:33 +08:00
nfsreq_print_noaddr(ndo, (u_char *)rp, length,
Initial revision
1999-10-08 07:47:09 +08:00
(u_char *)ip);
return;
}
Have our own headers to declare the format of ONC (Sun) RPC messages on the wire; the definitions in many systems use u_long, which is 64 bits long on many platforms - that's OK for in-memory structures, but it doesn't match what's on the wire. Use headers based on the Sun ones, but use u_int32_t for fields, and otherwise make the structures match what's on the wire, and change some names to avoid collision with <rpc/rpc.h>, which print-sunrpc.c includes to declare "getrpcbynumber()" and the structure it returns. Record whether "getrpcbynumber()" is found, and use it only if it's found, rather than basing the decisison on whether we're building for Win32 or not.
2004-12-27 08:41:29 +08:00
if (sport == NFS_PORT && direction == SUNRPC_REPLY) {
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
ND_PRINT((ndo, "NFS reply xid %u ", EXTRACT_32BITS(&rp->rm_xid)));
NDOize NFS decoder
2014-04-01 20:05:33 +08:00
nfsreply_print_noaddr(ndo, (u_char *)rp, length,
Initial revision
1999-10-08 07:47:09 +08:00
(u_char *)ip);
return;
}
#ifdef notdef
Have our own headers to declare the format of ONC (Sun) RPC messages on the wire; the definitions in many systems use u_long, which is 64 bits long on many platforms - that's OK for in-memory structures, but it doesn't match what's on the wire. Use headers based on the Sun ones, but use u_int32_t for fields, and otherwise make the structures match what's on the wire, and change some names to avoid collision with <rpc/rpc.h>, which print-sunrpc.c includes to declare "getrpcbynumber()" and the structure it returns. Record whether "getrpcbynumber()" is found, and use it only if it's found, rather than basing the decisison on whether we're building for Win32 or not.
2004-12-27 08:41:29 +08:00
if (dport == SUNRPC_PORT && direction == SUNRPC_CALL) {
Initial revision
1999-10-08 07:47:09 +08:00
sunrpcrequest_print((u_char *)rp, length, (u_char *)ip);
return;
}
#endif
}
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
if (ND_TTEST(((struct LAP *)cp)->type) &&
Initial revision
1999-10-08 07:47:09 +08:00
((struct LAP *)cp)->type == lapDDP &&
(atalk_port(sport) || atalk_port(dport))) {
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
if (ndo->ndo_vflag)
ND_PRINT((ndo, "kip "));
NDOize AppleTalk, CDP and Kerberos decoders
2014-03-28 18:43:43 +08:00
llap_print(ndo, cp, length);
Initial revision
1999-10-08 07:47:09 +08:00
return;
}
}
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
if (ndo->ndo_vflag && !ndo->ndo_Kflag && !fragmented) {
Handle UDP checksums more like TCP checksums. Instead of printing the result of udp_cksum() if it's non-zero, print the checksum field value and the value it should have had. That means that what we print is the same regardless of whether we're running on a big-endian or little-endian machine. Also, just as we did with TCP: Check -v and -K, and the fragmented flag, up front; then check the IP version etc.. Don't check for IPv6 if we already know it's IPv4. Fetch the checksum field only once. Update some test files for the new output format.
2011-06-17 13:10:36 +08:00
/* Check the checksum, if possible. */
u_intN_t is dead, long live uintN_t. And, as we require at least autoconf 2.61, and as autoconf 2.61 and later have AC_TYPE_UINTn_T and AC_TYPE_INTn_T macros, we use them to define the uintN_t and intN_t macros if the system doesn't define them for us. This lets us get rid of bitypes.h as well.
2014-04-23 15:20:40 +08:00
uint16_t sum, udp_sum;
Handle UDP checksums more like TCP checksums. Instead of printing the result of udp_cksum() if it's non-zero, print the checksum field value and the value it should have had. That means that what we print is the same regardless of whether we're running on a big-endian or little-endian machine. Also, just as we did with TCP: Check -v and -K, and the fragmented flag, up front; then check the IP version etc.. Don't check for IPv6 if we already know it's IPv4. Fetch the checksum field only once. Update some test files for the new output format.
2011-06-17 13:10:36 +08:00
/*
* XXX - do this even if vflag == 1?
* TCP does, and we do so for UDP-over-IPv6.
*/
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
if (IP_V(ip) == 4 && (ndo->ndo_vflag > 1)) {
Handle UDP checksums more like TCP checksums. Instead of printing the result of udp_cksum() if it's non-zero, print the checksum field value and the value it should have had. That means that what we print is the same regardless of whether we're running on a big-endian or little-endian machine. Also, just as we did with TCP: Check -v and -K, and the fragmented flag, up front; then check the IP version etc.. Don't check for IPv6 if we already know it's IPv4. Fetch the checksum field only once. Update some test files for the new output format.
2011-06-17 13:10:36 +08:00
udp_sum = EXTRACT_16BITS(&up->uh_sum);
if (udp_sum == 0) {
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
ND_PRINT((ndo, "[no cksum] "));
} else if (ND_TTEST2(cp[0], length)) {
NDOize AODV, IPv4 and SCTP decoders
2014-03-26 19:47:29 +08:00
sum = udp_cksum(ndo, ip, up, length + sizeof(struct udphdr));
Handle UDP checksums more like TCP checksums. Instead of printing the result of udp_cksum() if it's non-zero, print the checksum field value and the value it should have had. That means that what we print is the same regardless of whether we're running on a big-endian or little-endian machine. Also, just as we did with TCP: Check -v and -K, and the fragmented flag, up front; then check the IP version etc.. Don't check for IPv6 if we already know it's IPv4. Fetch the checksum field only once. Update some test files for the new output format.
2011-06-17 13:10:36 +08:00
if (sum != 0) {
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
ND_PRINT((ndo, "[bad udp cksum 0x%04x -> 0x%04x!] ",
Handle UDP checksums more like TCP checksums. Instead of printing the result of udp_cksum() if it's non-zero, print the checksum field value and the value it should have had. That means that what we print is the same regardless of whether we're running on a big-endian or little-endian machine. Also, just as we did with TCP: Check -v and -K, and the fragmented flag, up front; then check the IP version etc.. Don't check for IPv6 if we already know it's IPv4. Fetch the checksum field only once. Update some test files for the new output format.
2011-06-17 13:10:36 +08:00
udp_sum,
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
in_cksum_shouldbe(udp_sum, sum)));
Handle UDP checksums more like TCP checksums. Instead of printing the result of udp_cksum() if it's non-zero, print the checksum field value and the value it should have had. That means that what we print is the same regardless of whether we're running on a big-endian or little-endian machine. Also, just as we did with TCP: Check -v and -K, and the fragmented flag, up front; then check the IP version etc.. Don't check for IPv6 if we already know it's IPv4. Fetch the checksum field only once. Update some test files for the new output format.
2011-06-17 13:10:36 +08:00
} else
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
ND_PRINT((ndo, "[udp sum ok] "));
Handle UDP checksums more like TCP checksums. Instead of printing the result of udp_cksum() if it's non-zero, print the checksum field value and the value it should have had. That means that what we print is the same regardless of whether we're running on a big-endian or little-endian machine. Also, just as we did with TCP: Check -v and -K, and the fragmented flag, up front; then check the IP version etc.. Don't check for IPv6 if we already know it's IPv4. Fetch the checksum field only once. Update some test files for the new output format.
2011-06-17 13:10:36 +08:00
}
udp header checksum. from netbsd.
2000-08-02 01:36:49 +08:00
}
#ifdef INET6
Handle UDP checksums more like TCP checksums. Instead of printing the result of udp_cksum() if it's non-zero, print the checksum field value and the value it should have had. That means that what we print is the same regardless of whether we're running on a big-endian or little-endian machine. Also, just as we did with TCP: Check -v and -K, and the fragmented flag, up front; then check the IP version etc.. Don't check for IPv6 if we already know it's IPv4. Fetch the checksum field only once. Update some test files for the new output format.
2011-06-17 13:10:36 +08:00
else if (IP_V(ip) == 6 && ip6->ip6_plen) {
/* for IPv6, UDP checksum is mandatory */
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
if (ND_TTEST2(cp[0], length)) {
Handle UDP checksums more like TCP checksums. Instead of printing the result of udp_cksum() if it's non-zero, print the checksum field value and the value it should have had. That means that what we print is the same regardless of whether we're running on a big-endian or little-endian machine. Also, just as we did with TCP: Check -v and -K, and the fragmented flag, up front; then check the IP version etc.. Don't check for IPv6 if we already know it's IPv4. Fetch the checksum field only once. Update some test files for the new output format.
2011-06-17 13:10:36 +08:00
sum = udp6_cksum(ip6, up, length + sizeof(struct udphdr));
udp_sum = EXTRACT_16BITS(&up->uh_sum);
if (sum != 0) {
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
ND_PRINT((ndo, "[bad udp cksum 0x%04x -> 0x%04x!] ",
Handle UDP checksums more like TCP checksums. Instead of printing the result of udp_cksum() if it's non-zero, print the checksum field value and the value it should have had. That means that what we print is the same regardless of whether we're running on a big-endian or little-endian machine. Also, just as we did with TCP: Check -v and -K, and the fragmented flag, up front; then check the IP version etc.. Don't check for IPv6 if we already know it's IPv4. Fetch the checksum field only once. Update some test files for the new output format.
2011-06-17 13:10:36 +08:00
udp_sum,
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
in_cksum_shouldbe(udp_sum, sum)));
Handle UDP checksums more like TCP checksums. Instead of printing the result of udp_cksum() if it's non-zero, print the checksum field value and the value it should have had. That means that what we print is the same regardless of whether we're running on a big-endian or little-endian machine. Also, just as we did with TCP: Check -v and -K, and the fragmented flag, up front; then check the IP version etc.. Don't check for IPv6 if we already know it's IPv4. Fetch the checksum field only once. Update some test files for the new output format.
2011-06-17 13:10:36 +08:00
} else
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
ND_PRINT((ndo, "[udp sum ok] "));
Handle UDP checksums more like TCP checksums. Instead of printing the result of udp_cksum() if it's non-zero, print the checksum field value and the value it should have had. That means that what we print is the same regardless of whether we're running on a big-endian or little-endian machine. Also, just as we did with TCP: Check -v and -K, and the fragmented flag, up front; then check the IP version etc.. Don't check for IPv6 if we already know it's IPv4. Fetch the checksum field only once. Update some test files for the new output format.
2011-06-17 13:10:36 +08:00
}
udp header checksum. from netbsd.
2000-08-02 01:36:49 +08:00
}
#endif
Handle UDP checksums more like TCP checksums. Instead of printing the result of udp_cksum() if it's non-zero, print the checksum field value and the value it should have had. That means that what we print is the same regardless of whether we're running on a big-endian or little-endian machine. Also, just as we did with TCP: Check -v and -K, and the fragmented flag, up front; then check the IP version etc.. Don't check for IPv6 if we already know it's IPv4. Fetch the checksum field only once. Update some test files for the new output format.
2011-06-17 13:10:36 +08:00
}
udp header checksum. from netbsd.
2000-08-02 01:36:49 +08:00
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
if (!ndo->ndo_qflag) {
Initial revision
1999-10-08 07:47:09 +08:00
#define ISPORT(p) (dport == (p) || sport == (p))
In mDNS, report IN-class records with the "cache flush" bit set as such, rather than as "Class 32769".
2003-11-05 14:02:58 +08:00
if (ISPORT(NAMESERVER_PORT))
NDOize BOOTP, DHCPv6, DNS, PIM and sFlow decoders Also add/remove tabs in a few involved functions to justify indentation.
2014-03-25 19:05:59 +08:00
ns_print(ndo, (const u_char *)(up + 1), length, 0);
In mDNS, report IN-class records with the "cache flush" bit set as such, rather than as "Class 32769".
2003-11-05 14:02:58 +08:00
else if (ISPORT(MULTICASTDNS_PORT))
NDOize BOOTP, DHCPv6, DNS, PIM and sFlow decoders Also add/remove tabs in a few involved functions to justify indentation.
2014-03-25 19:05:59 +08:00
ns_print(ndo, (const u_char *)(up + 1), length, 1);
"timed" dissector, from Ben Smithurst.
2000-10-06 13:35:36 +08:00
else if (ISPORT(TIMED_PORT))
NDOize timed decoder
2014-04-03 19:37:46 +08:00
timed_print(ndo, (const u_char *)(up + 1));
Initial revision
1999-10-08 07:47:09 +08:00
else if (ISPORT(TFTP_PORT))
NDOize 7 more small decoders This change converts DVMRP, DLT_ENC, EGP, GeoNet, NetFlow, SLIP and TFTP decoders.
2014-03-21 20:48:24 +08:00
tftp_print(ndo, (const u_char *)(up + 1), length);
merge bootp.h into print-bootp.c
2014-08-14 02:06:25 +08:00
else if (ISPORT(BOOTPC_PORT) || ISPORT(BOOTPS_PORT))
NDOize BOOTP, DHCPv6, DNS, PIM and sFlow decoders Also add/remove tabs in a few involved functions to justify indentation.
2014-03-25 19:05:59 +08:00
bootp_print(ndo, (const u_char *)(up + 1), length);
Initial revision
1999-10-08 07:47:09 +08:00
else if (ISPORT(RIP_PORT))
NDOize 7 bigger decoders This change converts IGMP, IPv6 mobility options, LDP, Lightweight Access Point, PGM, PPTP and RIP decoders.
2014-03-19 17:57:56 +08:00
rip_print(ndo, (const u_char *)(up + 1), length);
From Bruce M. Simpson <bms@spc.org>: RFC 3561 AODV support.
2003-08-06 14:49:38 +08:00
else if (ISPORT(AODV_PORT))
NDOize AODV, IPv4 and SCTP decoders
2014-03-26 19:47:29 +08:00
aodv_print(ndo, (const u_char *)(up + 1), length,
From Bruce M. Simpson <bms@spc.org>: RFC 3561 AODV support.
2003-08-06 14:49:38 +08:00
#ifdef INET6
Updates from Bruce Simpson: Fix numerous bugs in my AODV submission, red faces all round, mainly due to misunderstanding of EXTRACT_STRING() macro arguments (because these are macros, type checking didn't happen). AODV HELLO extensions are now correctly printed. The code is closer to FreeBSD's style guidelines. Don't use "u_char" and "u_long", use "u_int8_t" and "u_int32_t". "u_long" is definitely wrong as it's 64 bits on some platforms; "u_char" is safe, but the official tcpdump style uses "u_int8_t". At least according to the (long-since-expired) draft-perkins-aodv6-01, the V6 AODV messages have different message type values from the V4 ones in draft-ietf-manet-aodv-13. However, draft-ietf-manet-aodv-13 says that the only differences are in the addresses; we support both. Clean up the way we tell the AODV6 dissector that we're running atop IPv6 a bit. Use "udpipaddr_print()" if we're printing AODV packets as a result of saying "anything that matches this filter is AODV", rather than doing it ourselves under the assumption that it's running over IPv4.
2003-09-13 06:05:56 +08:00
ip6 != NULL);
From Bruce M. Simpson <bms@spc.org>: RFC 3561 AODV support.
2003-08-06 14:49:38 +08:00
#else
FALSE isn't necessarily defined.
2004-12-27 09:13:44 +08:00
0);
From Bruce M. Simpson <bms@spc.org>: RFC 3561 AODV support.
2003-08-06 14:49:38 +08:00
#endif
use new ip_print_demux() routine in ISAKMP UDP-ESP encap printer.
2005-04-07 08:28:17 +08:00
else if (ISPORT(ISAKMP_PORT))
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
isakmp_print(ndo, (const u_char *)(up + 1), length, bp2);
use new ip_print_demux() routine in ISAKMP UDP-ESP encap printer.
2005-04-07 08:28:17 +08:00
else if (ISPORT(ISAKMP_PORT_NATT))
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
isakmp_rfc3948_print(ndo, (const u_char *)(up + 1), length, bp2);
Bring in KAME IPv6 tcpdump. replaces esp/ah/isakmp decoder. Hope I did not break anything. Portability on IPv4-only node needs checking, I'll do this very soon. (sorry for rather jumbo commit) XXx what is _FAVOR_BSD?
1999-10-30 13:11:06 +08:00
#if 1 /*???*/
added ESP-in-UDP printer from RFC3948.
2005-04-07 05:33:27 +08:00
else if (ISPORT(ISAKMP_PORT_USER1) || ISPORT(ISAKMP_PORT_USER2))
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
isakmp_print(ndo, (const u_char *)(up + 1), length, bp2);
Bring in KAME IPv6 tcpdump. replaces esp/ah/isakmp decoder. Hope I did not break anything. Portability on IPv4-only node needs checking, I'll do this very soon. (sorry for rather jumbo commit) XXx what is _FAVOR_BSD?
1999-10-30 13:11:06 +08:00
#endif
Initial revision
1999-10-08 07:47:09 +08:00
else if (ISPORT(SNMP_PORT) || ISPORT(SNMPTRAP_PORT))
NDOize SNMP decoder
2014-03-29 19:39:31 +08:00
snmp_print(ndo, (const u_char *)(up + 1), length);
Initial revision
1999-10-08 07:47:09 +08:00
else if (ISPORT(NTP_PORT))
NDOize ATM, MPTCP, NTP, VTP & Whiteboard decoders
2014-03-20 18:39:44 +08:00
ntp_print(ndo, (const u_char *)(up + 1), length);
Initial revision
1999-10-08 07:47:09 +08:00
else if (ISPORT(KERBEROS_PORT) || ISPORT(KERBEROS_SEC_PORT))
NDOize AppleTalk, CDP and Kerberos decoders
2014-03-28 18:43:43 +08:00
krb_print(ndo, (const void *)(up + 1));
Bring in KAME IPv6 tcpdump. replaces esp/ah/isakmp decoder. Hope I did not break anything. Portability on IPv4-only node needs checking, I'll do this very soon. (sorry for rather jumbo commit) XXx what is _FAVOR_BSD?
1999-10-30 13:11:06 +08:00
else if (ISPORT(L2TP_PORT))
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
l2tp_print(ndo, (const u_char *)(up + 1), length);
Add --enable-smb to make it easier to re-enable the SMB printer.
2001-10-09 05:25:15 +08:00
#ifdef TCPDUMP_DO_SMB
whitespace cleanup
2002-06-12 01:08:37 +08:00
else if (ISPORT(NETBIOS_NS_PORT))
NDOize SMB decoder
2014-04-02 12:14:19 +08:00
nbt_udp137_print(ndo, (const u_char *)(up + 1), length);
whitespace cleanup
2002-06-12 01:08:37 +08:00
else if (ISPORT(NETBIOS_DGRAM_PORT))
NDOize SMB decoder
2014-04-02 12:14:19 +08:00
nbt_udp138_print(ndo, (const u_char *)(up + 1), length);
disable smb printing until we have boundary checks in *smb*.c (there's almost no boundary check).
2001-10-04 17:18:45 +08:00
#endif
use macros for VAT and WB port numbers
2013-04-03 19:08:17 +08:00
else if (dport == VAT_PORT)
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
vat_print(ndo, (const void *)(up + 1), up);
Zephyr support, from Nickolai Zeldovich <kolya@MIT.EDU>.
2001-09-10 03:30:22 +08:00
else if (ISPORT(ZEPHYR_SRV_PORT) || ISPORT(ZEPHYR_CLT_PORT))
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
zephyr_print(ndo, (const void *)(up + 1), length);
whitespace cleanup
2002-06-12 01:08:37 +08:00
/*
* Since there are 10 possible ports to check, I think
* a <> test would be more efficient
*/
else if ((sport >= RX_PORT_LOW && sport <= RX_PORT_HIGH) ||
(dport >= RX_PORT_LOW && dport <= RX_PORT_HIGH))
NDOize RX decoder
2014-03-30 23:16:23 +08:00
rx_print(ndo, (const void *)(up + 1), length, sport, dport,
whitespace cleanup
2002-06-12 01:08:37 +08:00
(u_char *) ip);
Bring in KAME IPv6 tcpdump. replaces esp/ah/isakmp decoder. Hope I did not break anything. Portability on IPv4-only node needs checking, I'll do this very soon. (sorry for rather jumbo commit) XXx what is _FAVOR_BSD?
1999-10-30 13:11:06 +08:00
#ifdef INET6
else if (ISPORT(RIPNG_PORT))
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
ripng_print(ndo, (const u_char *)(up + 1), length);
Add printer for the Babel routing protocol (RFC 6126). This version includes a couple of fixes from Wireshark.
2011-04-24 08:53:08 +08:00
else if (ISPORT(DHCP6_SERV_PORT) || ISPORT(DHCP6_CLI_PORT))
NDOize BOOTP, DHCPv6, DNS, PIM and sFlow decoders Also add/remove tabs in a few involved functions to justify indentation.
2014-03-25 19:05:59 +08:00
dhcp6_print(ndo, (const u_char *)(up + 1), length);
AHCP: add version 1 decoder Add new decoder for UDP port 5359 and a sample packet capture produced on a couple of Linux hosts (a server and a client). Besides that, an existing Babel capture contained AHCP packets and the current AHCP tests cover 0, 1 and 2 "-v" flags.
2013-11-12 21:10:33 +08:00
else if (ISPORT(AHCP_PORT))
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
ahcp_print(ndo, (const u_char *)(up + 1), length);
For Babel, recognise both UDP/6696 and UDP/6697. IANA has reallocated the Babel port; it is now 6696. This patch makes tcpdump recognise both the old and the new Babel ports.
2011-08-27 22:36:10 +08:00
else if (ISPORT(BABEL_PORT) || ISPORT(BABEL_PORT_OLD))
NDOize Babel decoder
2014-04-03 16:33:53 +08:00
babel_print(ndo, (const u_char *)(up + 1), length);
Bring in KAME IPv6 tcpdump. replaces esp/ah/isakmp decoder. Hope I did not break anything. Portability on IPv4-only node needs checking, I'll do this very soon. (sorry for rather jumbo commit) XXx what is _FAVOR_BSD?
1999-10-30 13:11:06 +08:00
#endif /*INET6*/
Initial revision
1999-10-08 07:47:09 +08:00
/*
* Kludge in test for whiteboard packets.
*/
use macros for VAT and WB port numbers
2013-04-03 19:08:17 +08:00
else if (dport == WB_PORT)
NDOize ATM, MPTCP, NTP, VTP & Whiteboard decoders
2014-03-20 18:39:44 +08:00
wb_print(ndo, (const void *)(up + 1), length);
Enhanced PIMv1 support. Cisco Auto-RP support.
1999-11-22 15:25:26 +08:00
else if (ISPORT(CISCO_AUTORP_PORT))
NDOize BOOTP, DHCPv6, DNS, PIM and sFlow decoders Also add/remove tabs in a few involved functions to justify indentation.
2014-03-25 19:05:59 +08:00
cisco_autorp_print(ndo, (const void *)(up + 1), length);
RADIUS support, from Alfredo Andres Omella (aandres@mfom.es).
2000-10-06 14:49:20 +08:00
else if (ISPORT(RADIUS_PORT) ||
BIND9 lwres dissector.
2001-01-29 17:18:46 +08:00
ISPORT(RADIUS_NEW_PORT) ||
whitespace cleanup
2002-06-12 01:08:37 +08:00
ISPORT(RADIUS_ACCOUNTING_PORT) ||
Added support for RADIUS Change of Authorization messages Defined in RFC 5176
2014-10-06 20:06:18 +08:00
ISPORT(RADIUS_NEW_ACCOUNTING_PORT) ||
ISPORT(RADIUS_COA_PORT) )
NDOize Frame Relay, LMP and RADIUS decoders
2014-03-18 20:09:00 +08:00
radius_print(ndo, (const u_char *)(up+1), length);
HSRP dissector, from Julian Cowley <julian@lava.net>.
2001-09-17 14:22:31 +08:00
else if (dport == HSRP_PORT)
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
hsrp_print(ndo, (const u_char *)(up + 1), length);
BIND9 lwres dissector.
2001-01-29 17:18:46 +08:00
else if (ISPORT(LWRES_PORT))
NDOize EAP, IEEE CFM, lwres, SIP & Syslog decoders
2014-04-01 23:42:33 +08:00
lwres_print(ndo, (const u_char *)(up + 1), length);
print-olsr: Add basic IPv6 support. Unfortunately OLSR uses the same IDs for IPv4 and IPv6 packets, even though the size of "messages" differ. The version of the internet protocol is therefore handed to the "olsr_print" function. The code isn't very nice, due to a high density of #ifdef INET6'es. If IPv6-support really should be optional, I'm afraid this is inevitable. Both, compilation with and without IPv6 support has been tested. The patch addresses fixes other issues, too. The length given in the packet was used for pointer arithmetic without checking if the value was in a reasonable range first in several places. It should now be possible to decode more than one "namespace message" within a single packet. Other changes remove trailing whitespace or fix lines indented with tabs (the majority of the file is indented using spaces). Signed-off-by: Florian Forster <octo@leeloo.lan.home.verplant.org>
2009-05-17 06:05:30 +08:00
else if (ISPORT(LDP_PORT))
NDOize 7 bigger decoders This change converts IGMP, IPv6 mobility options, LDP, Lightweight Access Point, PGM, PPTP and RIP decoders.
2014-03-19 17:57:56 +08:00
ldp_print(ndo, (const u_char *)(up + 1), length);
print-olsr: Add basic IPv6 support. Unfortunately OLSR uses the same IDs for IPv4 and IPv6 packets, even though the size of "messages" differ. The version of the internet protocol is therefore handed to the "olsr_print" function. The code isn't very nice, due to a high density of #ifdef INET6'es. If IPv6-support really should be optional, I'm afraid this is inevitable. Both, compilation with and without IPv6 support has been tested. The patch addresses fixes other issues, too. The length given in the packet was used for pointer arithmetic without checking if the value was in a reasonable range first in several places. It should now be possible to decode more than one "namespace message" within a single packet. Other changes remove trailing whitespace or fix lines indented with tabs (the majority of the file is indented using spaces). Signed-off-by: Florian Forster <octo@leeloo.lan.home.verplant.org>
2009-05-17 06:05:30 +08:00
else if (ISPORT(OLSR_PORT))
NDOize ForCES, MPLS LSP ping and OLSR decoders
2014-03-27 18:58:23 +08:00
olsr_print(ndo, (const u_char *)(up + 1), length,
print-olsr: Add basic IPv6 support. Unfortunately OLSR uses the same IDs for IPv4 and IPv6 packets, even though the size of "messages" differ. The version of the internet protocol is therefore handed to the "olsr_print" function. The code isn't very nice, due to a high density of #ifdef INET6'es. If IPv6-support really should be optional, I'm afraid this is inevitable. Both, compilation with and without IPv6 support has been tested. The patch addresses fixes other issues, too. The length given in the packet was used for pointer arithmetic without checking if the value was in a reasonable range first in several places. It should now be possible to decode more than one "namespace message" within a single packet. Other changes remove trailing whitespace or fix lines indented with tabs (the majority of the file is indented using spaces). Signed-off-by: Florian Forster <octo@leeloo.lan.home.verplant.org>
2009-05-17 06:05:30 +08:00
#if INET6
(IP_V(ip) == 6) ? 1 : 0);
#else
0);
#endif
else if (ISPORT(MPLS_LSP_PING_PORT))
NDOize ForCES, MPLS LSP ping and OLSR decoders
2014-03-27 18:58:23 +08:00
lspping_print(ndo, (const u_char *)(up + 1), length);
support for bi-directional fault detection (BFD) Control packets as per draft-katz-ward-bfd-01.txt
2003-10-27 18:13:44 +08:00
else if (dport == BFD_CONTROL_PORT ||
dport == BFD_ECHO_PORT )
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
bfd_print(ndo, (const u_char *)(up+1), length, dport);
add support for the Link Management Protocol (LMP) as per draft-ietf-ccamp-lmp-10
2004-04-20 05:17:13 +08:00
else if (ISPORT(LMP_PORT))
NDOize Frame Relay, LMP and RADIUS decoders
2014-03-18 20:09:00 +08:00
lmp_print(ndo, (const u_char *)(up + 1), length);
from Carles Kishimoto <Carles.Kishimoto@bsc.es>: basic support for Ciscos prop. VQP protocol
2006-03-04 06:31:16 +08:00
else if (ISPORT(VQP_PORT))
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
vqp_print(ndo, (const u_char *)(up + 1), length);
from Carles Kishimoto <carles.kishimoto@gmail.com>: add support for the SFLOW protocol
2007-08-09 01:20:58 +08:00
else if (ISPORT(SFLOW_PORT))
NDOize BOOTP, DHCPv6, DNS, PIM and sFlow decoders Also add/remove tabs in a few involved functions to justify indentation.
2014-03-25 19:05:59 +08:00
sflow_print(ndo, (const u_char *)(up + 1), length);
From Carles Kishimoto <carles.kishimoto@gmail.com>: add initial support for the Light Weight Access Point Protocol as per draft-ohara-capwap-lwapp-04
2007-07-25 00:07:29 +08:00
else if (dport == LWAPP_CONTROL_PORT)
NDOize 7 bigger decoders This change converts IGMP, IPv6 mobility options, LDP, Lightweight Access Point, PGM, PPTP and RIP decoders.
2014-03-19 17:57:56 +08:00
lwapp_control_print(ndo, (const u_char *)(up + 1), length, 1);
From Carles Kishimoto <carles.kishimoto@gmail.com>: add initial support for the Light Weight Access Point Protocol as per draft-ohara-capwap-lwapp-04
2007-07-25 00:07:29 +08:00
else if (sport == LWAPP_CONTROL_PORT)
NDOize 7 bigger decoders This change converts IGMP, IPv6 mobility options, LDP, Lightweight Access Point, PGM, PPTP and RIP decoders.
2014-03-19 17:57:56 +08:00
lwapp_control_print(ndo, (const u_char *)(up + 1), length, 0);
From Carles Kishimoto <carles.kishimoto@gmail.com>: add initial support for the Light Weight Access Point Protocol as per draft-ohara-capwap-lwapp-04
2007-07-25 00:07:29 +08:00
else if (ISPORT(LWAPP_DATA_PORT))
NDOize 7 bigger decoders This change converts IGMP, IPv6 mobility options, LDP, Lightweight Access Point, PGM, PPTP and RIP decoders.
2014-03-19 17:57:56 +08:00
lwapp_data_print(ndo, (const u_char *)(up + 1), length);
add basic support for the SIP protocol
2004-07-28 01:04:20 +08:00
else if (ISPORT(SIP_PORT))
NDOize EAP, IEEE CFM, lwres, SIP & Syslog decoders
2014-04-01 23:42:33 +08:00
sip_print(ndo, (const u_char *)(up + 1), length);
add support for syslog
2004-10-29 19:42:52 +08:00
else if (ISPORT(SYSLOG_PORT))
NDOize EAP, IEEE CFM, lwres, SIP & Syslog decoders
2014-04-01 23:42:33 +08:00
syslog_print(ndo, (const u_char *)(up + 1), length);
- Add support for OTV (draft-hasmit-otv-04). - Use the packettype infrastructure (-T vxlan) for VXLAN parsing (waiting for a well known dest port)
2013-02-26 20:44:11 +08:00
else if (ISPORT(OTV_PORT))
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
otv_print(ndo, (const u_char *)(up + 1), length);
IANA (www.iana.org/assignments/service-names-port-numbers/ service-names-port-numbers.txt) has assigned an official port for VXLAN (4789). tcpdump uses this by default but we keep the -T vxlan option as well (e.g. Linux is allowing different ports).
2013-05-10 03:04:23 +08:00
else if (ISPORT(VXLAN_PORT))
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
vxlan_print(ndo, (const u_char *)(up + 1), length);
Add support for Generic Network Virtualization Encapsulation (Geneve). Defined in http://tools.ietf.org/html/draft-gross-geneve-02
2014-11-05 10:47:24 +08:00
else if (ISPORT(GENEVE_PORT))
geneve_print(ndo, (const u_char *)(up + 1), length);
Use the length field in the UDP header. If it's less than the length of the IP payload, use it as the size of the UDP packet. If it's greater than the length of the IP payload, and we're not dissecting the payload, report the length as bad.
2014-10-20 04:42:00 +08:00
else {
if (ulen > length)
ND_PRINT((ndo, "UDP, bad length %u > %u",
ulen, length));
else
Don't subtract the UDP header size from the length twice.
2014-10-21 02:34:24 +08:00
ND_PRINT((ndo, "UDP, length %u", ulen));
Use the length field in the UDP header. If it's less than the length of the IP payload, use it as the size of the UDP packet. If it's greater than the length of the IP payload, and we're not dissecting the payload, report the length as bad.
2014-10-20 04:42:00 +08:00
}
#undef ISPORT
} else {
if (ulen > length)
ND_PRINT((ndo, "UDP, bad length %u > %u",
ulen, length));
Initial revision
1999-10-08 07:47:09 +08:00
else
Don't subtract the UDP header size from the length twice.
2014-10-21 02:34:24 +08:00
ND_PRINT((ndo, "UDP, length %u", ulen));
Use the length field in the UDP header. If it's less than the length of the IP payload, use it as the size of the UDP packet. If it's greater than the length of the IP payload, and we're not dissecting the payload, report the length as bad.
2014-10-20 04:42:00 +08:00
}
Initial revision
1999-10-08 07:47:09 +08:00
}
added ESP-in-UDP printer from RFC3948.
2005-04-07 05:33:27 +08:00
/*
* Local Variables:
* c-style: whitesmith
* c-basic-offset: 8
* End:
*/
Reference in New Issue Copy Permalink