mirrors/tcpdump
0
0
Fork 0
mirror of https://github.com/the-tcpdump-group/tcpdump.git synced 2024-11-24 10:33:28 +08:00
Code Issues Packages Projects Releases Wiki Activity
7d2bc7fcb5
tcpdump/print-udp.c

698 lines
19 KiB
C
Raw Normal View History

Initial revision
1999-10-08 07:47:09 +08:00
/*
* Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997
* The Regents of the University of California. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that: (1) source code distributions
* retain the above copyright notice and this paragraph in its entirety, (2)
* distributions including binary code include the above copyright notice and
* this paragraph in its entirety in the documentation or other materials
* provided with the distribution, and (3) all advertising materials mentioning
* features or use of this software display the following acknowledgement:
* ``This product includes software developed by the University of California,
* Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
* the University nor the names of its contributors may be used to endorse
* or promote products derived from this software without specific prior
* written permission.
* THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
* WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
*/
Move the printer summaries from INSTALL.txt to each printer with the tag '\summary:' for greping. Remark: Currently some printers have no summary line. Moreover: Summarize all printers with a single line in INSTALL.txt
2016-08-14 21:42:19 +08:00
/* \summary: UDP printer */
Switch to config.h instead of passing defines in DEFS.
1999-11-21 17:36:43 +08:00
#ifdef HAVE_CONFIG_H
Always include <config.h> rather than "config.h". This can prevent bizarre failures if, for example, you've done a configuration in the top-level source directory, leaving behind one config.h file, and then do an out-of-tree build in another directory, with different configuration options. This way, we always pick up the same config.h, in the build directory.
2018-01-22 04:27:08 +08:00
#include <config.h>
Initial revision
1999-10-08 07:47:09 +08:00
#endif
Use quoted include netdissect-stdinc.h instead of angle-bracketed one
2018-01-20 22:59:49 +08:00
#include "netdissect-stdinc.h"
Initial revision
1999-10-08 07:47:09 +08:00
Printers must include 'netdissect.h', not 'interface.h'
2015-09-06 05:35:58 +08:00
#include "netdissect.h"
Initial revision
1999-10-08 07:47:09 +08:00
#include "addrtoname.h"
The "__attribute__((packed))" tag on structures causes some files not to compile with Sun C, as "interface.h" isn't being included before the structures are being declared. Furthermore, in the files that Sun C *can* compile, it doesn't cause Sun C to generate code that's safe with unaligned accesses, as "__attribute__" is defined as a do-nothing macro with compilers that don't support it. Therefore, we get rid of that tag on the structures to which it was added, and instead use "EXTRACT_16BIT()" and "EXTRACT_32BIT()" to fetch 16-bit and 32-bit big-endian quantities from packets. We also fix some other references to multi-byte quantities to get rid of code that tries to do unaligned loads on platforms that don't support them. We also throw in a hack that makes those macros use "__attribute__((packed))" on structures containing only one 16-bit or 32-bit integer to get the compiler to generate unaligned-safe code rather than doing it by hand. (GCC on SPARC produces the same code that doing it by hand does; I don't know if GCC on any other big-endian strict-alignment processor generates better code for that case. On little-endian processors, as "ntohs()" and "ntohl()" might be functions, that might actually produce worse code.) Fix some places to use "%u" rather than "%d" to print unsigned quantities.
2002-12-11 15:13:49 +08:00
#include "extract.h"
Initial revision
1999-10-08 07:47:09 +08:00
#include "appletalk.h"
Add "tcp.h" and "udp.h" headers, to declare the TCP and UDP stuff needed by dissectors, and have dissectors include them rather than <netinet/udp.h>, <netinet/udp_var.h>, or <netinet/tcp.h>, if they actually need that stuff. Remove all unnecessary includes of <netinet/udp*.h> or <netinet/tcp*.h> files.
2000-09-23 16:26:30 +08:00
#include "udp.h"
Add an "ip.h" header, to declare the IP stuff needed by dissectors, and have dissectors include them rather than <netinet/ip.h> or <netinet/ip_var.h>, if they actually need that stuff. Put the declarations of the ICMP stuff directly into "print-icmp.c". Remove all unnecessary includes of <netinet/ip*.h> files. Copy the byte-order stuff from "nameser.h" into "tcp.h".
2000-09-23 16:54:24 +08:00
#include "ip.h"
put stripped-down version of ip6.h and icmp6.h into tcpdump tree. ip6.h is almost normal RFC2292 header. icmp6.h has couple of extensions (not covered by RFC2292), like MLD, ICMPv6 nodeinfo, and router renumber. XXX how to synchronize with future kame changes?
2000-10-07 13:53:09 +08:00
#include "ip6.h"
Add a new "ipproto.h" header file, with definitions of IP protocol type values. Use that rather than private definitions in various files. Add "gmpls.h" to the list of files in FILES, and add it and "ipfc.h" to the list of files in INSTALL.
2003-06-07 19:57:51 +08:00
#include "ipproto.h"
Have our own headers to declare the format of ONC (Sun) RPC messages on the wire; the definitions in many systems use u_long, which is 64 bits long on many platforms - that's OK for in-memory structures, but it doesn't match what's on the wire. Use headers based on the Sun ones, but use u_int32_t for fields, and otherwise make the structures match what's on the wire, and change some names to avoid collision with <rpc/rpc.h>, which print-sunrpc.c includes to declare "getrpcbynumber()" and the structure it returns. Record whether "getrpcbynumber()" is found, and use it only if it's found, rather than basing the decisison on whether we're building for Win32 or not.
2004-12-27 08:41:29 +08:00
#include "rpc_auth.h"
#include "rpc_msg.h"
Add an "ip.h" header, to declare the IP stuff needed by dissectors, and have dissectors include them rather than <netinet/ip.h> or <netinet/ip_var.h>, if they actually need that stuff. Put the declarations of the ICMP stuff directly into "print-icmp.c". Remove all unnecessary includes of <netinet/ip*.h> files. Copy the byte-order stuff from "nameser.h" into "tcp.h".
2000-09-23 16:54:24 +08:00
fix compilation. - print-udp.c: rename of nfsv2.h -> nfs.h - print-{null,sl}.c: ipv6_print -> ip6_print
1999-11-21 20:38:24 +08:00
#include "nfs.h"
Initial revision
1999-10-08 07:47:09 +08:00
CVE-2016-7934,7935,7937/RTP: Fix two segmentation faults Add two test files for these fixes. Add more bounds checks in VAT, RTP and RTCP printers. Moreover: Add and use *_tstr[] strings. Update the output of a test accordingly. Remove spaces before tabs.
2015-11-18 00:12:22 +08:00
Initial revision
1999-10-08 07:47:09 +08:00
struct rtcphdr {
More nd_ification of structures. We don't need to use & to get a pointer to an nd_uintN_t/nd_intN_t type, as they're arrays.
2017-12-11 16:17:47 +08:00
nd_uint16_t rh_flags; /* T:2 P:1 CNT:5 PT:8 */
nd_uint16_t rh_len; /* length of message (in words) */
nd_uint32_t rh_ssrc; /* synchronization src id */
The "__attribute__((packed))" tag on structures causes some files not to compile with Sun C, as "interface.h" isn't being included before the structures are being declared. Furthermore, in the files that Sun C *can* compile, it doesn't cause Sun C to generate code that's safe with unaligned accesses, as "__attribute__" is defined as a do-nothing macro with compilers that don't support it. Therefore, we get rid of that tag on the structures to which it was added, and instead use "EXTRACT_16BIT()" and "EXTRACT_32BIT()" to fetch 16-bit and 32-bit big-endian quantities from packets. We also fix some other references to multi-byte quantities to get rid of code that tries to do unaligned loads on platforms that don't support them. We also throw in a hack that makes those macros use "__attribute__((packed))" on structures containing only one 16-bit or 32-bit integer to get the compiler to generate unaligned-safe code rather than doing it by hand. (GCC on SPARC produces the same code that doing it by hand does; I don't know if GCC on any other big-endian strict-alignment processor generates better code for that case. On little-endian processors, as "ntohs()" and "ntohl()" might be functions, that might actually produce worse code.) Fix some places to use "%u" rather than "%d" to print unsigned quantities.
2002-12-11 15:13:49 +08:00
};
Initial revision
1999-10-08 07:47:09 +08:00
typedef struct {
More nd_ification of structures. We don't need to use & to get a pointer to an nd_uintN_t/nd_intN_t type, as they're arrays.
2017-12-11 16:17:47 +08:00
nd_uint32_t upper; /* more significant 32 bits */
nd_uint32_t lower; /* less significant 32 bits */
The "__attribute__((packed))" tag on structures causes some files not to compile with Sun C, as "interface.h" isn't being included before the structures are being declared. Furthermore, in the files that Sun C *can* compile, it doesn't cause Sun C to generate code that's safe with unaligned accesses, as "__attribute__" is defined as a do-nothing macro with compilers that don't support it. Therefore, we get rid of that tag on the structures to which it was added, and instead use "EXTRACT_16BIT()" and "EXTRACT_32BIT()" to fetch 16-bit and 32-bit big-endian quantities from packets. We also fix some other references to multi-byte quantities to get rid of code that tries to do unaligned loads on platforms that don't support them. We also throw in a hack that makes those macros use "__attribute__((packed))" on structures containing only one 16-bit or 32-bit integer to get the compiler to generate unaligned-safe code rather than doing it by hand. (GCC on SPARC produces the same code that doing it by hand does; I don't know if GCC on any other big-endian strict-alignment processor generates better code for that case. On little-endian processors, as "ntohs()" and "ntohl()" might be functions, that might actually produce worse code.) Fix some places to use "%u" rather than "%d" to print unsigned quantities.
2002-12-11 15:13:49 +08:00
} ntp64;
Initial revision
1999-10-08 07:47:09 +08:00
/*
* Sender report.
*/
struct rtcp_sr {
Clean up white space.
2017-12-12 02:11:16 +08:00
ntp64 sr_ntp; /* 64-bit ntp timestamp */
More nd_ification of structures. We don't need to use & to get a pointer to an nd_uintN_t/nd_intN_t type, as they're arrays.
2017-12-11 16:17:47 +08:00
nd_uint32_t sr_ts; /* reference media timestamp */
nd_uint32_t sr_np; /* no. packets sent */
nd_uint32_t sr_nb; /* no. bytes sent */
The "__attribute__((packed))" tag on structures causes some files not to compile with Sun C, as "interface.h" isn't being included before the structures are being declared. Furthermore, in the files that Sun C *can* compile, it doesn't cause Sun C to generate code that's safe with unaligned accesses, as "__attribute__" is defined as a do-nothing macro with compilers that don't support it. Therefore, we get rid of that tag on the structures to which it was added, and instead use "EXTRACT_16BIT()" and "EXTRACT_32BIT()" to fetch 16-bit and 32-bit big-endian quantities from packets. We also fix some other references to multi-byte quantities to get rid of code that tries to do unaligned loads on platforms that don't support them. We also throw in a hack that makes those macros use "__attribute__((packed))" on structures containing only one 16-bit or 32-bit integer to get the compiler to generate unaligned-safe code rather than doing it by hand. (GCC on SPARC produces the same code that doing it by hand does; I don't know if GCC on any other big-endian strict-alignment processor generates better code for that case. On little-endian processors, as "ntohs()" and "ntohl()" might be functions, that might actually produce worse code.) Fix some places to use "%u" rather than "%d" to print unsigned quantities.
2002-12-11 15:13:49 +08:00
};
Initial revision
1999-10-08 07:47:09 +08:00
/*
* Receiver report.
* Time stamps are middle 32-bits of ntp timestamp.
*/
struct rtcp_rr {
More nd_ification of structures. We don't need to use & to get a pointer to an nd_uintN_t/nd_intN_t type, as they're arrays.
2017-12-11 16:17:47 +08:00
nd_uint32_t rr_srcid; /* sender being reported */
nd_uint32_t rr_nl; /* no. packets lost */
nd_uint32_t rr_ls; /* extended last seq number received */
nd_uint32_t rr_dv; /* jitter (delay variance) */
nd_uint32_t rr_lsr; /* orig. ts from last rr from this src */
nd_uint32_t rr_dlsr; /* time from recpt of last rr to xmit time */
The "__attribute__((packed))" tag on structures causes some files not to compile with Sun C, as "interface.h" isn't being included before the structures are being declared. Furthermore, in the files that Sun C *can* compile, it doesn't cause Sun C to generate code that's safe with unaligned accesses, as "__attribute__" is defined as a do-nothing macro with compilers that don't support it. Therefore, we get rid of that tag on the structures to which it was added, and instead use "EXTRACT_16BIT()" and "EXTRACT_32BIT()" to fetch 16-bit and 32-bit big-endian quantities from packets. We also fix some other references to multi-byte quantities to get rid of code that tries to do unaligned loads on platforms that don't support them. We also throw in a hack that makes those macros use "__attribute__((packed))" on structures containing only one 16-bit or 32-bit integer to get the compiler to generate unaligned-safe code rather than doing it by hand. (GCC on SPARC produces the same code that doing it by hand does; I don't know if GCC on any other big-endian strict-alignment processor generates better code for that case. On little-endian processors, as "ntohs()" and "ntohl()" might be functions, that might actually produce worse code.) Fix some places to use "%u" rather than "%d" to print unsigned quantities.
2002-12-11 15:13:49 +08:00
};
Initial revision
1999-10-08 07:47:09 +08:00
/*XXX*/
#define RTCP_PT_SR 200
#define RTCP_PT_RR 201
#define RTCP_PT_SDES 202
#define RTCP_SDES_CNAME 1
#define RTCP_SDES_NAME 2
#define RTCP_SDES_EMAIL 3
#define RTCP_SDES_PHONE 4
#define RTCP_SDES_LOC 5
#define RTCP_SDES_TOOL 6
#define RTCP_SDES_NOTE 7
#define RTCP_SDES_PRIV 8
#define RTCP_PT_BYE 203
#define RTCP_PT_APP 204
static void
UDP: Harmonize some function calls Some calls use '(const u_char *)(up + 1)' or '(const void *)(up + 1)'. Other calls use 'cp' (same value). Update the calls to only use 'cp'. Moreover: Update some other casted 'up + 1' uses to 'cp'. Update some pointers to packet bytes from 'void *' to 'u_char *'.
2020-06-09 17:57:22 +08:00
vat_print(netdissect_options *ndo, const u_char *hdr, u_int length)
Initial revision
1999-10-08 07:47:09 +08:00
{
/* vat/vt audio */
CVE-2016-7934,7935,7937/RTP: Fix two segmentation faults Add two test files for these fixes. Add more bounds checks in VAT, RTP and RTCP printers. Moreover: Add and use *_tstr[] strings. Update the output of a test accordingly. Remove spaces before tabs.
2015-11-18 00:12:22 +08:00
u_int ts;
Print truncations with nd_print_trunc() instead of tstr[] strings Remove the tstr[] strings. Update the output of some tests accordingly. Moreover: Add or update some ndo_protocol fields.
2018-05-02 23:15:04 +08:00
ndo->ndo_protocol = "vat";
Clean up signed vs. unsigned, add more length checks.
2018-01-12 02:58:54 +08:00
if (length < 2) {
ND_PRINT("udp/va/vat, length %u < 2", length);
return;
}
Use the new GET_ macros instead of the EXTRACT_ ones The exceptions are currently: Some EXTRACT_ in print-juniper.c, not used on packet buffer pointer. An EXTRACT_BE_U_3 in addrtoname.c, not always used on packet buffer pointer.
2018-06-16 23:23:21 +08:00
ts = GET_BE_U_2(hdr);
Initial revision
1999-10-08 07:47:09 +08:00
if ((ts & 0xf060) != 0) {
/* probably vt */
Clean up signed vs. unsigned, add more length checks.
2018-01-12 02:58:54 +08:00
ND_PRINT("udp/vt %u %u / %u",
length,
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ts & 0x3ff, ts >> 10);
Initial revision
1999-10-08 07:47:09 +08:00
} else {
/* probably vat */
CVE-2016-7934,7935,7937/RTP: Fix two segmentation faults Add two test files for these fixes. Add more bounds checks in VAT, RTP and RTCP printers. Moreover: Add and use *_tstr[] strings. Update the output of a test accordingly. Remove spaces before tabs.
2015-11-18 00:12:22 +08:00
uint32_t i0, i1;
Clean up signed vs. unsigned, add more length checks.
2018-01-12 02:58:54 +08:00
if (length < 8) {
ND_PRINT("udp/vat, length %u < 8", length);
return;
}
Use the new GET_ macros instead of the EXTRACT_ ones The exceptions are currently: Some EXTRACT_ in print-juniper.c, not used on packet buffer pointer. An EXTRACT_BE_U_3 in addrtoname.c, not always used on packet buffer pointer.
2018-06-16 23:23:21 +08:00
i0 = GET_BE_U_4(&((const u_int *)hdr)[0]);
i1 = GET_BE_U_4(&((const u_int *)hdr)[1]);
Clean up signed vs. unsigned, add more length checks.
2018-01-12 02:58:54 +08:00
ND_PRINT("udp/vat %u c%u %u%s",
length - 8,
Initial revision
1999-10-08 07:47:09 +08:00
i0 & 0xffff,
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
i1, i0 & 0x800000? "*" : "");
Initial revision
1999-10-08 07:47:09 +08:00
/* audio format */
if (i0 & 0x1f0000)
Clean up signed vs. unsigned, add more length checks.
2018-01-12 02:58:54 +08:00
ND_PRINT(" f%u", (i0 >> 16) & 0x1f);
Initial revision
1999-10-08 07:47:09 +08:00
if (i0 & 0x3f000000)
Clean up signed vs. unsigned, add more length checks.
2018-01-12 02:58:54 +08:00
ND_PRINT(" s%u", (i0 >> 24) & 0x3f);
Initial revision
1999-10-08 07:47:09 +08:00
}
}
static void
UDP: Harmonize some function calls Some calls use '(const u_char *)(up + 1)' or '(const void *)(up + 1)'. Other calls use 'cp' (same value). Update the calls to only use 'cp'. Moreover: Update some other casted 'up + 1' uses to 'cp'. Update some pointers to packet bytes from 'void *' to 'u_char *'.
2020-06-09 17:57:22 +08:00
rtp_print(netdissect_options *ndo, const u_char *hdr, u_int len)
Initial revision
1999-10-08 07:47:09 +08:00
{
/* rtp v1 or v2 */
Fix a bunch of de-constifications.
2015-04-27 08:24:42 +08:00
const u_int *ip = (const u_int *)hdr;
CVE-2016-7934,7935,7937/RTP: Fix two segmentation faults Add two test files for these fixes. Add more bounds checks in VAT, RTP and RTCP printers. Moreover: Add and use *_tstr[] strings. Update the output of a test accordingly. Remove spaces before tabs.
2015-11-18 00:12:22 +08:00
u_int hasopt, hasext, contype, hasmarker, dlen;
uint32_t i0, i1;
Initial revision
1999-10-08 07:47:09 +08:00
const char * ptype;
Print truncations with nd_print_trunc() instead of tstr[] strings Remove the tstr[] strings. Update the output of some tests accordingly. Moreover: Add or update some ndo_protocol fields.
2018-05-02 23:15:04 +08:00
ndo->ndo_protocol = "rtp";
Clean up signed vs. unsigned, add more length checks.
2018-01-12 02:58:54 +08:00
if (len < 8) {
ND_PRINT("udp/rtp, length %u < 8", len);
return;
}
Use the new GET_ macros instead of the EXTRACT_ ones The exceptions are currently: Some EXTRACT_ in print-juniper.c, not used on packet buffer pointer. An EXTRACT_BE_U_3 in addrtoname.c, not always used on packet buffer pointer.
2018-06-16 23:23:21 +08:00
i0 = GET_BE_U_4(&((const u_int *)hdr)[0]);
i1 = GET_BE_U_4(&((const u_int *)hdr)[1]);
Clean up signed vs. unsigned, add more length checks.
2018-01-12 02:58:54 +08:00
dlen = len - 8;
Initial revision
1999-10-08 07:47:09 +08:00
ip += 2;
len >>= 2;
len -= 2;
hasopt = 0;
hasext = 0;
if ((i0 >> 30) == 1) {
Fetch RTP option and extension data using EXTRACT_32BITS(). Do not assume that you're on a big-endian processor that can dereference unaligned pointers - all the world's not a m68k. :-) Most of the world is little-endian these days by CPU count (especially on personal computers), and one of the popular big-endian processor families, SPARC, traps when dereferencing unaligned pointers. While we're at it, note the last I-D that described RTPv1 and the current RFC for RTPv2.
2017-01-15 04:05:33 +08:00
/* rtp v1 - draft-ietf-avt-rtp-04 */
Initial revision
1999-10-08 07:47:09 +08:00
hasopt = i0 & 0x800000;
contype = (i0 >> 16) & 0x3f;
hasmarker = i0 & 0x400000;
ptype = "rtpv1";
} else {
Fetch RTP option and extension data using EXTRACT_32BITS(). Do not assume that you're on a big-endian processor that can dereference unaligned pointers - all the world's not a m68k. :-) Most of the world is little-endian these days by CPU count (especially on personal computers), and one of the popular big-endian processor families, SPARC, traps when dereferencing unaligned pointers. While we're at it, note the last I-D that described RTPv1 and the current RFC for RTPv2.
2017-01-15 04:05:33 +08:00
/* rtp v2 - RFC 3550 */
Clean up signed vs. unsigned, add more length checks.
2018-01-12 02:58:54 +08:00
if (dlen < 4) {
ND_PRINT("udp/rtp, length %u < 12", dlen + 8);
return;
}
Initial revision
1999-10-08 07:47:09 +08:00
hasext = i0 & 0x10000000;
contype = (i0 >> 16) & 0x7f;
hasmarker = i0 & 0x800000;
dlen -= 4;
ptype = "rtp";
ip += 1;
len -= 1;
}
Clean up signed vs. unsigned, add more length checks.
2018-01-12 02:58:54 +08:00
ND_PRINT("udp/%s %u c%u %s%s %u %u",
Initial revision
1999-10-08 07:47:09 +08:00
ptype,
dlen,
contype,
(hasopt || hasext)? "+" : "",
hasmarker? "*" : "",
i0 & 0xffff,
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
i1);
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
if (ndo->ndo_vflag) {
Use the new GET_ macros instead of the EXTRACT_ ones The exceptions are currently: Some EXTRACT_ in print-juniper.c, not used on packet buffer pointer. An EXTRACT_BE_U_3 in addrtoname.c, not always used on packet buffer pointer.
2018-06-16 23:23:21 +08:00
ND_PRINT(" %u", GET_BE_U_4(&((const u_int *)hdr)[2]));
Initial revision
1999-10-08 07:47:09 +08:00
if (hasopt) {
u_int i2, optlen;
do {
Use the new GET_ macros instead of the EXTRACT_ ones The exceptions are currently: Some EXTRACT_ in print-juniper.c, not used on packet buffer pointer. An EXTRACT_BE_U_3 in addrtoname.c, not always used on packet buffer pointer.
2018-06-16 23:23:21 +08:00
i2 = GET_BE_U_4(ip);
Initial revision
1999-10-08 07:47:09 +08:00
optlen = (i2 >> 16) & 0xff;
if (optlen == 0 || optlen > len) {
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ND_PRINT(" !opt");
Initial revision
1999-10-08 07:47:09 +08:00
return;
}
ip += optlen;
len -= optlen;
} while ((int)i2 >= 0);
}
if (hasext) {
u_int i2, extlen;
Use the new GET_ macros instead of the EXTRACT_ ones The exceptions are currently: Some EXTRACT_ in print-juniper.c, not used on packet buffer pointer. An EXTRACT_BE_U_3 in addrtoname.c, not always used on packet buffer pointer.
2018-06-16 23:23:21 +08:00
i2 = GET_BE_U_4(ip);
Initial revision
1999-10-08 07:47:09 +08:00
extlen = (i2 & 0xffff) + 1;
if (extlen > len) {
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ND_PRINT(" !ext");
Initial revision
1999-10-08 07:47:09 +08:00
return;
}
ip += extlen;
}
if (contype == 0x1f) /*XXX H.261 */
Use the new GET_ macros instead of the EXTRACT_ ones The exceptions are currently: Some EXTRACT_ in print-juniper.c, not used on packet buffer pointer. An EXTRACT_BE_U_3 in addrtoname.c, not always used on packet buffer pointer.
2018-06-16 23:23:21 +08:00
ND_PRINT(" 0x%04x", GET_BE_U_4(ip) >> 16);
Initial revision
1999-10-08 07:47:09 +08:00
}
}
static const u_char *
UDP: Modernize packet parsing style. Remove all ND_TCHECK_*() instances as redundant. Remove or convert a few improvised snapshot end guards. Reduce arity of rtcp_print(). Test the AppleTalk LAP type after testing the UDP port numbers, not before.
2021-01-12 23:52:23 +08:00
rtcp_print(netdissect_options *ndo, const u_char *hdr)
Initial revision
1999-10-08 07:47:09 +08:00
{
/* rtp v2 control (rtcp) */
Fix a bunch of de-constifications.
2015-04-27 08:24:42 +08:00
const struct rtcp_rr *rr = 0;
const struct rtcp_sr *sr;
const struct rtcphdr *rh = (const struct rtcphdr *)hdr;
Initial revision
1999-10-08 07:47:09 +08:00
u_int len;
u_intN_t is dead, long live uintN_t. And, as we require at least autoconf 2.61, and as autoconf 2.61 and later have AC_TYPE_UINTn_T and AC_TYPE_INTn_T macros, we use them to define the uintN_t and intN_t macros if the system doesn't define them for us. This lets us get rid of bitypes.h as well.
2014-04-23 15:20:40 +08:00
uint16_t flags;
UDP: Modernize packet parsing style. Remove all ND_TCHECK_*() instances as redundant. Remove or convert a few improvised snapshot end guards. Reduce arity of rtcp_print(). Test the AppleTalk LAP type after testing the UDP port numbers, not before.
2021-01-12 23:52:23 +08:00
uint32_t ssrc;
Clean up signed vs. unsigned, add more length checks.
2018-01-12 02:58:54 +08:00
u_int cnt;
Initial revision
1999-10-08 07:47:09 +08:00
double ts, dts;
Print truncations with nd_print_trunc() instead of tstr[] strings Remove the tstr[] strings. Update the output of some tests accordingly. Moreover: Add or update some ndo_protocol fields.
2018-05-02 23:15:04 +08:00
ndo->ndo_protocol = "rtcp";
Use the new GET_ macros instead of the EXTRACT_ ones The exceptions are currently: Some EXTRACT_ in print-juniper.c, not used on packet buffer pointer. An EXTRACT_BE_U_3 in addrtoname.c, not always used on packet buffer pointer.
2018-06-16 23:23:21 +08:00
len = (GET_BE_U_2(rh->rh_len) + 1) * 4;
flags = GET_BE_U_2(rh->rh_flags);
Initial revision
1999-10-08 07:47:09 +08:00
cnt = (flags >> 8) & 0x1f;
UDP: Modernize packet parsing style. Remove all ND_TCHECK_*() instances as redundant. Remove or convert a few improvised snapshot end guards. Reduce arity of rtcp_print(). Test the AppleTalk LAP type after testing the UDP port numbers, not before.
2021-01-12 23:52:23 +08:00
ssrc = GET_BE_U_4(rh->rh_ssrc);
Initial revision
1999-10-08 07:47:09 +08:00
switch (flags & 0xff) {
case RTCP_PT_SR:
Fix a bunch of de-constifications.
2015-04-27 08:24:42 +08:00
sr = (const struct rtcp_sr *)(rh + 1);
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ND_PRINT(" sr");
Initial revision
1999-10-08 07:47:09 +08:00
if (len != cnt * sizeof(*rr) + sizeof(*sr) + sizeof(*rh))
Clean up signed vs. unsigned, add more length checks.
2018-01-12 02:58:54 +08:00
ND_PRINT(" [%u]", len);
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
if (ndo->ndo_vflag)
UDP: Modernize packet parsing style. Remove all ND_TCHECK_*() instances as redundant. Remove or convert a few improvised snapshot end guards. Reduce arity of rtcp_print(). Test the AppleTalk LAP type after testing the UDP port numbers, not before.
2021-01-12 23:52:23 +08:00
ND_PRINT(" %u", ssrc);
Use the new GET_ macros instead of the EXTRACT_ ones The exceptions are currently: Some EXTRACT_ in print-juniper.c, not used on packet buffer pointer. An EXTRACT_BE_U_3 in addrtoname.c, not always used on packet buffer pointer.
2018-06-16 23:23:21 +08:00
ts = (double)(GET_BE_U_4(sr->sr_ntp.upper)) +
((double)(GET_BE_U_4(sr->sr_ntp.lower)) /
Define FMAXINT only once and use it properly. [skip ci]
2020-07-28 23:02:07 +08:00
FMAXINT);
Use the new GET_ macros instead of the EXTRACT_ ones The exceptions are currently: Some EXTRACT_ in print-juniper.c, not used on packet buffer pointer. An EXTRACT_BE_U_3 in addrtoname.c, not always used on packet buffer pointer.
2018-06-16 23:23:21 +08:00
ND_PRINT(" @%.2f %u %up %ub", ts, GET_BE_U_4(sr->sr_ts),
GET_BE_U_4(sr->sr_np), GET_BE_U_4(sr->sr_nb));
Fix a bunch of de-constifications.
2015-04-27 08:24:42 +08:00
rr = (const struct rtcp_rr *)(sr + 1);
Initial revision
1999-10-08 07:47:09 +08:00
break;
case RTCP_PT_RR:
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ND_PRINT(" rr");
Initial revision
1999-10-08 07:47:09 +08:00
if (len != cnt * sizeof(*rr) + sizeof(*rh))
Clean up signed vs. unsigned, add more length checks.
2018-01-12 02:58:54 +08:00
ND_PRINT(" [%u]", len);
Fix a bunch of de-constifications.
2015-04-27 08:24:42 +08:00
rr = (const struct rtcp_rr *)(rh + 1);
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
if (ndo->ndo_vflag)
UDP: Modernize packet parsing style. Remove all ND_TCHECK_*() instances as redundant. Remove or convert a few improvised snapshot end guards. Reduce arity of rtcp_print(). Test the AppleTalk LAP type after testing the UDP port numbers, not before.
2021-01-12 23:52:23 +08:00
ND_PRINT(" %u", ssrc);
Initial revision
1999-10-08 07:47:09 +08:00
break;
case RTCP_PT_SDES:
Clean up signed vs. unsigned, add more length checks.
2018-01-12 02:58:54 +08:00
ND_PRINT(" sdes %u", len);
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
if (ndo->ndo_vflag)
UDP: Modernize packet parsing style. Remove all ND_TCHECK_*() instances as redundant. Remove or convert a few improvised snapshot end guards. Reduce arity of rtcp_print(). Test the AppleTalk LAP type after testing the UDP port numbers, not before.
2021-01-12 23:52:23 +08:00
ND_PRINT(" %u", ssrc);
Initial revision
1999-10-08 07:47:09 +08:00
cnt = 0;
break;
case RTCP_PT_BYE:
Clean up signed vs. unsigned, add more length checks.
2018-01-12 02:58:54 +08:00
ND_PRINT(" bye %u", len);
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
if (ndo->ndo_vflag)
UDP: Modernize packet parsing style. Remove all ND_TCHECK_*() instances as redundant. Remove or convert a few improvised snapshot end guards. Reduce arity of rtcp_print(). Test the AppleTalk LAP type after testing the UDP port numbers, not before.
2021-01-12 23:52:23 +08:00
ND_PRINT(" %u", ssrc);
Initial revision
1999-10-08 07:47:09 +08:00
cnt = 0;
break;
default:
Clean up signed vs. unsigned, add more length checks.
2018-01-12 02:58:54 +08:00
ND_PRINT(" type-0x%x %u", flags & 0xff, len);
Initial revision
1999-10-08 07:47:09 +08:00
cnt = 0;
break;
}
if (cnt > 1)
Clean up signed vs. unsigned, add more length checks.
2018-01-12 02:58:54 +08:00
ND_PRINT(" c%u", cnt);
while (cnt != 0) {
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
if (ndo->ndo_vflag)
Use the new GET_ macros instead of the EXTRACT_ ones The exceptions are currently: Some EXTRACT_ in print-juniper.c, not used on packet buffer pointer. An EXTRACT_BE_U_3 in addrtoname.c, not always used on packet buffer pointer.
2018-06-16 23:23:21 +08:00
ND_PRINT(" %u", GET_BE_U_4(rr->rr_srcid));
ts = (double)(GET_BE_U_4(rr->rr_lsr)) / 65536.;
dts = (double)(GET_BE_U_4(rr->rr_dlsr)) / 65536.;
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ND_PRINT(" %ul %us %uj @%.2f+%.2f",
Use the new GET_ macros instead of the EXTRACT_ ones The exceptions are currently: Some EXTRACT_ in print-juniper.c, not used on packet buffer pointer. An EXTRACT_BE_U_3 in addrtoname.c, not always used on packet buffer pointer.
2018-06-16 23:23:21 +08:00
GET_BE_U_4(rr->rr_nl) & 0x00ffffff,
GET_BE_U_4(rr->rr_ls),
GET_BE_U_4(rr->rr_dv), ts, dts);
Clean up signed vs. unsigned, add more length checks.
2018-01-12 02:58:54 +08:00
cnt--;
Initial revision
1999-10-08 07:47:09 +08:00
}
return (hdr + len);
}
Have all Internet-checksum computing routines return a uint16_t. Those checksums are 16-bit; change the return types of those routines appropriately.
2018-12-11 16:50:15 +08:00
static uint16_t udp_cksum(netdissect_options *ndo, const struct ip *ip,
Remove all storage class specifier 'register' Let the compiler do the optimizations (or not) based on build options. Avoid 'value has been optimized out' messages in gdb using '-O0'.
2017-12-14 02:17:47 +08:00
const struct udphdr *up,
u_int len)
udp header checksum. from netbsd.
2000-08-02 01:36:49 +08:00
{
Fix a bunch of de-constifications.
2015-04-27 08:24:42 +08:00
return nextproto4_cksum(ndo, ip, (const uint8_t *)(const void *)up, len, len,
fix partial checksum errors in DCCP decoder, IPv4 case
2014-02-15 19:32:44 +08:00
IPPROTO_UDP);
udp header checksum. from netbsd.
2000-08-02 01:36:49 +08:00
}
Have all Internet-checksum computing routines return a uint16_t. Those checksums are 16-bit; change the return types of those routines appropriately.
2018-12-11 16:50:15 +08:00
static uint16_t udp6_cksum(netdissect_options *ndo, const struct ip6_hdr *ip6,
Don't overwrite the destination IPv6 address for routing headers. If we have a routing header, instead of overwriting the packet's IPv6 destination address in the packet with the final destination, so that the next protocol's checksum routine can use it, we do as we do for IPv4, and, in the "next protocol checksum" routine, scan the headers looking for a routing header and, if we find one, copy the final destination from it. While we're at it, clean up a few things.
2016-02-13 12:26:39 +08:00
const struct udphdr *up, u_int len)
udp header checksum. from netbsd.
2000-08-02 01:36:49 +08:00
{
Don't overwrite the destination IPv6 address for routing headers. If we have a routing header, instead of overwriting the packet's IPv6 destination address in the packet with the final destination, so that the next protocol's checksum routine can use it, we do as we do for IPv4, and, in the "next protocol checksum" routine, scan the headers looking for a routing header and, if we find one, copy the final destination from it. While we're at it, clean up a few things.
2016-02-13 12:26:39 +08:00
return nextproto6_cksum(ndo, ip6, (const uint8_t *)(const void *)up, len, len,
IPPROTO_UDP);
udp header checksum. from netbsd.
2000-08-02 01:36:49 +08:00
}
correct address pair printing on truncated case.
2001-11-26 14:48:12 +08:00
static void
UDP: Clean up address and port printing. udp_print() always knows whether UDP port numbers are available or not, so split udpipaddr_print() into two functions to lose some arity, much branching and all type casting. In the new functions test for IPv4 explicitly. In udp_print() convert duplicate code into a conditional call to udpipaddr_print().
2021-01-12 21:37:50 +08:00
udpipaddr_print(netdissect_options *ndo,
const struct ip *ip, const uint16_t sport, const uint16_t dport)
correct address pair printing on truncated case.
2001-11-26 14:48:12 +08:00
{
UDP: Clean up address and port printing. udp_print() always knows whether UDP port numbers are available or not, so split udpipaddr_print() into two functions to lose some arity, much branching and all type casting. In the new functions test for IPv4 explicitly. In udp_print() convert duplicate code into a conditional call to udpipaddr_print().
2021-01-12 21:37:50 +08:00
const struct ip6_hdr *ip6 = (const struct ip6_hdr *)ip;
if (IP_V(ip) == 4 && GET_U_1(ip->ip_p) == IPPROTO_UDP) {
ND_PRINT("%s.%s > %s.%s: ",
GET_IPADDR_STRING(ip->ip_src),
udpport_string(ndo, sport),
GET_IPADDR_STRING(ip->ip_dst),
udpport_string(ndo, dport));
} else if (IP_V(ip) == 6 && GET_U_1(ip6->ip6_nxt) == IPPROTO_UDP) {
ND_PRINT("%s.%s > %s.%s: ",
GET_IP6ADDR_STRING(ip6->ip6_src),
udpport_string(ndo, sport),
GET_IP6ADDR_STRING(ip6->ip6_dst),
udpport_string(ndo, dport));
} else
ND_PRINT("%s > %s: ",
udpport_string(ndo, sport), udpport_string(ndo, dport));
}
correct address pair printing on truncated case.
2001-11-26 14:48:12 +08:00
UDP: Clean up address and port printing. udp_print() always knows whether UDP port numbers are available or not, so split udpipaddr_print() into two functions to lose some arity, much branching and all type casting. In the new functions test for IPv4 explicitly. In udp_print() convert duplicate code into a conditional call to udpipaddr_print().
2021-01-12 21:37:50 +08:00
static void
udpipaddr_noport_print(netdissect_options *ndo, const struct ip *ip)
{
const struct ip6_hdr *ip6 = (const struct ip6_hdr *)ip;
if (IP_V(ip) == 4 && GET_U_1(ip->ip_p) == IPPROTO_UDP) {
ND_PRINT("%s > %s: ",
GET_IPADDR_STRING(ip->ip_src),
GET_IPADDR_STRING(ip->ip_dst));
} else if (IP_V(ip) == 6 && GET_U_1(ip6->ip6_nxt) == IPPROTO_UDP) {
ND_PRINT("%s > %s: ",
GET_IP6ADDR_STRING(ip6->ip6_src),
GET_IP6ADDR_STRING(ip6->ip6_dst));
correct address pair printing on truncated case.
2001-11-26 14:48:12 +08:00
}
}
Initial revision
1999-10-08 07:47:09 +08:00
void
Remove all storage class specifier 'register' Let the compiler do the optimizations (or not) based on build options. Avoid 'value has been optimized out' messages in gdb using '-O0'.
2017-12-14 02:17:47 +08:00
udp_print(netdissect_options *ndo, const u_char *bp, u_int length,
Put IPv4/IPv6 protocol demultiplexing into a common routine. That means less duplication of functionality - and less chance that XXX-over-IPv4 will be handled but XXX-over-IPv6 won't be handled, or *vice versa*. (CARP and VRRP were being handled over IPv4 but not over IPv6; this fixes that.)
2019-03-28 10:58:26 +08:00
const u_char *bp2, int fragmented, u_int ttl_hl)
Initial revision
1999-10-08 07:47:09 +08:00
{
Remove all storage class specifier 'register' Let the compiler do the optimizations (or not) based on build options. Avoid 'value has been optimized out' messages in gdb using '-O0'.
2017-12-14 02:17:47 +08:00
const struct udphdr *up;
const struct ip *ip;
const u_char *cp;
UDP: Fix the uses of the pointer to the end of current packet Must be based on packet header caplen.
2018-03-01 21:04:56 +08:00
const u_char *ep = ndo->ndo_snapend;
Handle the IPv6 Jumbo Payload option. If we see one when processing the hop-by-hop extension header, use it to set the payload length. In UDP, if we have a zero length field in the UDP header, and the length of the data handed to us is > 65535, treat that as a Jumbo Payload packet.
2019-05-03 11:01:08 +08:00
uint16_t sport, dport;
u_int ulen;
UDP: Modernize packet parsing style. Remove all ND_TCHECK_*() instances as redundant. Remove or convert a few improvised snapshot end guards. Reduce arity of rtcp_print(). Test the AppleTalk LAP type after testing the UDP port numbers, not before.
2021-01-12 23:52:23 +08:00
uint16_t udp_sum;
Remove all storage class specifier 'register' Let the compiler do the optimizations (or not) based on build options. Avoid 'value has been optimized out' messages in gdb using '-O0'.
2017-12-14 02:17:47 +08:00
const struct ip6_hdr *ip6;
Initial revision
1999-10-08 07:47:09 +08:00
Add the ndo_protocol field in the netdissect_options structure Update this field in printer entry functions. It will be used for some printings.
2018-03-14 23:54:17 +08:00
ndo->ndo_protocol = "udp";
Fix a bunch of de-constifications.
2015-04-27 08:24:42 +08:00
up = (const struct udphdr *)bp;
ip = (const struct ip *)bp2;
always use u_intXX_t for protocol format declaration. char/short/int may not come with exact size. while at it, correct signedness of ip/udp header field. nuke most of the use of bitfield. TODO: bitfield in namser.h
2000-10-03 10:54:54 +08:00
if (IP_V(ip) == 6)
Fix a bunch of de-constifications.
2015-04-27 08:24:42 +08:00
ip6 = (const struct ip6_hdr *)bp2;
Bring in KAME IPv6 tcpdump. replaces esp/ah/isakmp decoder. Hope I did not break anything. Portability on IPv4-only node needs checking, I'll do this very soon. (sorry for rather jumbo commit) XXx what is _FAVOR_BSD?
1999-10-30 13:11:06 +08:00
else
ip6 = NULL;
Use more ND_TCHECK_n()/ND_TTEST_n() macros
2018-01-13 05:00:45 +08:00
if (!ND_TTEST_2(up->uh_dport)) {
UDP: Clean up address and port printing. udp_print() always knows whether UDP port numbers are available or not, so split udpipaddr_print() into two functions to lose some arity, much branching and all type casting. In the new functions test for IPv4 explicitly. In udp_print() convert duplicate code into a conditional call to udpipaddr_print().
2021-01-12 21:37:50 +08:00
udpipaddr_noport_print(ndo, ip);
UDP: Modernize packet parsing style. Remove all ND_TCHECK_*() instances as redundant. Remove or convert a few improvised snapshot end guards. Reduce arity of rtcp_print(). Test the AppleTalk LAP type after testing the UDP port numbers, not before.
2021-01-12 23:52:23 +08:00
nd_trunc_longjmp(ndo);
Initial revision
1999-10-08 07:47:09 +08:00
}
Make the port arguments to udpipaddr_print() ints so that there can be an out-of-range flag value. Seperate out the truncation checks into two: are the ports available, then do all the other checks, then check to see if the full UDP header is available. This is a slightly modified version of Alexander's original patch to instead use udpipaddr_print() to print the addresses if the ports are not available. Submitted-by: Alexander Dupuy Sourceforge bug #579811
2003-08-01 07:38:20 +08:00
Use the new GET_ macros instead of the EXTRACT_ ones The exceptions are currently: Some EXTRACT_ in print-juniper.c, not used on packet buffer pointer. An EXTRACT_BE_U_3 in addrtoname.c, not always used on packet buffer pointer.
2018-06-16 23:23:21 +08:00
sport = GET_BE_U_2(up->uh_sport);
dport = GET_BE_U_2(up->uh_dport);
UDP: Clean up address and port printing. udp_print() always knows whether UDP port numbers are available or not, so split udpipaddr_print() into two functions to lose some arity, much branching and all type casting. In the new functions test for IPv4 explicitly. In udp_print() convert duplicate code into a conditional call to udpipaddr_print().
2021-01-12 21:37:50 +08:00
if (ndo->ndo_packettype != PT_RPC)
udpipaddr_print(ndo, ip, sport, dport);
Make the port arguments to udpipaddr_print() ints so that there can be an out-of-range flag value. Seperate out the truncation checks into two: are the ports available, then do all the other checks, then check to see if the full UDP header is available. This is a slightly modified version of Alexander's original patch to instead use udpipaddr_print() to print the addresses if the ports are not available. Submitted-by: Alexander Dupuy Sourceforge bug #579811
2003-08-01 07:38:20 +08:00
Update the ND_LCHECK*() macros to ND_ICHECK*() macros ICHECK like Invalid-Check. Reminder: If the checked expression is true an error message is printed and a 'goto invalid' is executed. This change adds the parameter 'operator'. Before this change, '<' comparison was hard coded. We can do now: ND_ICHECK_U(length, <, HEADER_LEN); ND_ICHECK_U(length, ==, 24); ND_ICHECK_U(length, !=, 8); ND_ICHECK_ZU(length, <, sizeof(struct my_struct)); ND_ICHECKMSG_U("message length", msg_tlen, <, 4); ... (Any comparison operator) Remark: The change of names from ND_LCHECK*() to ND_ICHECK*() is because something else than a length(L) can be checked. Moreover: Place the 'message' parameter at the beginning of ND_ICHECKMSG_U() and ND_ICHECKMSG_ZU() paramaters lists.
2021-12-29 21:38:08 +08:00
ND_ICHECKMSG_ZU("undersized-udp", length, <, sizeof(struct udphdr));
Use the new GET_ macros instead of the EXTRACT_ ones The exceptions are currently: Some EXTRACT_ in print-juniper.c, not used on packet buffer pointer. An EXTRACT_BE_U_3 in addrtoname.c, not always used on packet buffer pointer.
2018-06-16 23:23:21 +08:00
ulen = GET_BE_U_2(up->uh_ulen);
UDP: Modernize packet parsing style. Remove all ND_TCHECK_*() instances as redundant. Remove or convert a few improvised snapshot end guards. Reduce arity of rtcp_print(). Test the AppleTalk LAP type after testing the UDP port numbers, not before.
2021-01-12 23:52:23 +08:00
udp_sum = GET_BE_U_2(up->uh_sum);
Handle the IPv6 Jumbo Payload option. If we see one when processing the hop-by-hop extension header, use it to set the payload length. In UDP, if we have a zero length field in the UDP header, and the length of the data handed to us is > 65535, treat that as a Jumbo Payload packet.
2019-05-03 11:01:08 +08:00
/*
* IPv6 Jumbo Datagrams; see RFC 2675.
* If the length is zero, and the length provided to us is
* > 65535, use the provided length as the length.
*/
if (ulen == 0 && length > 65535)
ulen = length;
Update the ND_LCHECK*() macros to ND_ICHECK*() macros ICHECK like Invalid-Check. Reminder: If the checked expression is true an error message is printed and a 'goto invalid' is executed. This change adds the parameter 'operator'. Before this change, '<' comparison was hard coded. We can do now: ND_ICHECK_U(length, <, HEADER_LEN); ND_ICHECK_U(length, ==, 24); ND_ICHECK_U(length, !=, 8); ND_ICHECK_ZU(length, <, sizeof(struct my_struct)); ND_ICHECKMSG_U("message length", msg_tlen, <, 4); ... (Any comparison operator) Remark: The change of names from ND_LCHECK*() to ND_ICHECK*() is because something else than a length(L) can be checked. Moreover: Place the 'message' parameter at the beginning of ND_ICHECKMSG_U() and ND_ICHECKMSG_ZU() paramaters lists.
2021-12-29 21:38:08 +08:00
ND_ICHECKMSG_ZU("undersized-udplength", ulen, <,
sizeof(struct udphdr));
Use the length field in the UDP header. If it's less than the length of the IP payload, use it as the size of the UDP packet. If it's greater than the length of the IP payload, and we're not dissecting the payload, report the length as bad.
2014-10-20 04:42:00 +08:00
ulen -= sizeof(struct udphdr);
Initial revision
1999-10-08 07:47:09 +08:00
length -= sizeof(struct udphdr);
Use the length field in the UDP header. If it's less than the length of the IP payload, use it as the size of the UDP packet. If it's greater than the length of the IP payload, and we're not dissecting the payload, report the length as bad.
2014-10-20 04:42:00 +08:00
if (ulen < length)
length = ulen;
Initial revision
1999-10-08 07:47:09 +08:00
Fix a bunch of de-constifications.
2015-04-27 08:24:42 +08:00
cp = (const u_char *)(up + 1);
Make the port arguments to udpipaddr_print() ints so that there can be an out-of-range flag value. Seperate out the truncation checks into two: are the ports available, then do all the other checks, then check to see if the full UDP header is available. This is a slightly modified version of Alexander's original patch to instead use udpipaddr_print() to print the addresses if the ports are not available. Submitted-by: Alexander Dupuy Sourceforge bug #579811
2003-08-01 07:38:20 +08:00
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
if (ndo->ndo_packettype) {
Remove all storage class specifier 'register' Let the compiler do the optimizations (or not) based on build options. Avoid 'value has been optimized out' messages in gdb using '-O0'.
2017-12-14 02:17:47 +08:00
const struct sunrpc_msg *rp;
Have our own headers to declare the format of ONC (Sun) RPC messages on the wire; the definitions in many systems use u_long, which is 64 bits long on many platforms - that's OK for in-memory structures, but it doesn't match what's on the wire. Use headers based on the Sun ones, but use u_int32_t for fields, and otherwise make the structures match what's on the wire, and change some names to avoid collision with <rpc/rpc.h>, which print-sunrpc.c includes to declare "getrpcbynumber()" and the structure it returns. Record whether "getrpcbynumber()" is found, and use it only if it's found, rather than basing the decisison on whether we're building for Win32 or not.
2004-12-27 08:41:29 +08:00
enum sunrpc_msg_type direction;
Initial revision
1999-10-08 07:47:09 +08:00
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
switch (ndo->ndo_packettype) {
Initial revision
1999-10-08 07:47:09 +08:00
case PT_VAT:
UDP: Harmonize some function calls Some calls use '(const u_char *)(up + 1)' or '(const void *)(up + 1)'. Other calls use 'cp' (same value). Update the calls to only use 'cp'. Moreover: Update some other casted 'up + 1' uses to 'cp'. Update some pointers to packet bytes from 'void *' to 'u_char *'.
2020-06-09 17:57:22 +08:00
vat_print(ndo, cp, length);
Initial revision
1999-10-08 07:47:09 +08:00
break;
case PT_WB:
UDP: Harmonize some function calls Some calls use '(const u_char *)(up + 1)' or '(const void *)(up + 1)'. Other calls use 'cp' (same value). Update the calls to only use 'cp'. Moreover: Update some other casted 'up + 1' uses to 'cp'. Update some pointers to packet bytes from 'void *' to 'u_char *'.
2020-06-09 17:57:22 +08:00
wb_print(ndo, cp, length);
Initial revision
1999-10-08 07:47:09 +08:00
break;
case PT_RPC:
UDP: Harmonize some function calls Some calls use '(const u_char *)(up + 1)' or '(const void *)(up + 1)'. Other calls use 'cp' (same value). Update the calls to only use 'cp'. Moreover: Update some other casted 'up + 1' uses to 'cp'. Update some pointers to packet bytes from 'void *' to 'u_char *'.
2020-06-09 17:57:22 +08:00
rp = (const struct sunrpc_msg *)cp;
Use the new GET_ macros instead of the EXTRACT_ ones The exceptions are currently: Some EXTRACT_ in print-juniper.c, not used on packet buffer pointer. An EXTRACT_BE_U_3 in addrtoname.c, not always used on packet buffer pointer.
2018-06-16 23:23:21 +08:00
direction = (enum sunrpc_msg_type) GET_BE_U_4(rp->rm_direction);
Have our own headers to declare the format of ONC (Sun) RPC messages on the wire; the definitions in many systems use u_long, which is 64 bits long on many platforms - that's OK for in-memory structures, but it doesn't match what's on the wire. Use headers based on the Sun ones, but use u_int32_t for fields, and otherwise make the structures match what's on the wire, and change some names to avoid collision with <rpc/rpc.h>, which print-sunrpc.c includes to declare "getrpcbynumber()" and the structure it returns. Record whether "getrpcbynumber()" is found, and use it only if it's found, rather than basing the decisison on whether we're building for Win32 or not.
2004-12-27 08:41:29 +08:00
if (direction == SUNRPC_CALL)
SUNRPC: Rename entry function Most printer entry functions are based on the file name (without print-). Do the same for SUNRPC (sunrpcrequest_print -> sunrpc_print). This change allows easier update by script.
2017-11-16 17:18:43 +08:00
sunrpc_print(ndo, (const u_char *)rp, length,
Fix a bunch of de-constifications.
2015-04-27 08:24:42 +08:00
(const u_char *)ip);
Initial revision
1999-10-08 07:47:09 +08:00
else
Fix a bunch of de-constifications.
2015-04-27 08:24:42 +08:00
nfsreply_print(ndo, (const u_char *)rp, length,
(const u_char *)ip); /*XXX*/
Initial revision
1999-10-08 07:47:09 +08:00
break;
case PT_RTP:
UDP: Harmonize some function calls Some calls use '(const u_char *)(up + 1)' or '(const void *)(up + 1)'. Other calls use 'cp' (same value). Update the calls to only use 'cp'. Moreover: Update some other casted 'up + 1' uses to 'cp'. Update some pointers to packet bytes from 'void *' to 'u_char *'.
2020-06-09 17:57:22 +08:00
rtp_print(ndo, cp, length);
Initial revision
1999-10-08 07:47:09 +08:00
break;
case PT_RTCP:
while (cp < ep)
UDP: Modernize packet parsing style. Remove all ND_TCHECK_*() instances as redundant. Remove or convert a few improvised snapshot end guards. Reduce arity of rtcp_print(). Test the AppleTalk LAP type after testing the UDP port numbers, not before.
2021-01-12 23:52:23 +08:00
cp = rtcp_print(ndo, cp);
Initial revision
1999-10-08 07:47:09 +08:00
break;
patches to help build on Linux 2.2
1999-10-18 05:37:10 +08:00
case PT_SNMP:
UDP: Harmonize some function calls Some calls use '(const u_char *)(up + 1)' or '(const void *)(up + 1)'. Other calls use 'cp' (same value). Update the calls to only use 'cp'. Moreover: Update some other casted 'up + 1' uses to 'cp'. Update some pointers to packet bytes from 'void *' to 'u_char *'.
2020-06-09 17:57:22 +08:00
snmp_print(ndo, cp, length);
patches to help build on Linux 2.2
1999-10-18 05:37:10 +08:00
break;
add cisco NetFlow support from OpenBSD.
2000-04-27 18:05:30 +08:00
case PT_CNFP:
Use ND_TCHECK() to do bounds checking. While we're at it, just use the record count to when iterating over records; the ND_TCHECK()s will make sure we don't run past the end of the captured data. Also get rid of an unused argument to cnfp_print().
2014-11-10 15:24:53 +08:00
cnfp_print(ndo, cp);
add cisco NetFlow support from OpenBSD.
2000-04-27 18:05:30 +08:00
break;
From Motonori Shindo: allow "-T" to take "tftp" as an argument to force decoding as TFTP.
2003-05-11 14:01:16 +08:00
case PT_TFTP:
NDOize 7 more small decoders This change converts DVMRP, DLT_ENC, EGP, GeoNet, NetFlow, SLIP and TFTP decoders.
2014-03-21 20:48:24 +08:00
tftp_print(ndo, cp, length);
From Motonori Shindo: allow "-T" to take "tftp" as an argument to force decoding as TFTP.
2003-05-11 14:01:16 +08:00
break;
From Bruce M. Simpson <bms@spc.org>: RFC 3561 AODV support.
2003-08-06 14:49:38 +08:00
case PT_AODV:
UDP: Harmonize some function calls Some calls use '(const u_char *)(up + 1)' or '(const void *)(up + 1)'. Other calls use 'cp' (same value). Update the calls to only use 'cp'. Moreover: Update some other casted 'up + 1' uses to 'cp'. Update some pointers to packet bytes from 'void *' to 'u_char *'.
2020-06-09 17:57:22 +08:00
aodv_print(ndo, cp, length,
Updates from Bruce Simpson: Fix numerous bugs in my AODV submission, red faces all round, mainly due to misunderstanding of EXTRACT_STRING() macro arguments (because these are macros, type checking didn't happen). AODV HELLO extensions are now correctly printed. The code is closer to FreeBSD's style guidelines. Don't use "u_char" and "u_long", use "u_int8_t" and "u_int32_t". "u_long" is definitely wrong as it's 64 bits on some platforms; "u_char" is safe, but the official tcpdump style uses "u_int8_t". At least according to the (long-since-expired) draft-perkins-aodv6-01, the V6 AODV messages have different message type values from the V4 ones in draft-ietf-manet-aodv-13. However, draft-ietf-manet-aodv-13 says that the only differences are in the addresses; we support both. Clean up the way we tell the AODV6 dissector that we're running atop IPv6 a bit. Use "udpipaddr_print()" if we're printing AODV packets as a result of saying "anything that matches this filter is AODV", rather than doing it ourselves under the assumption that it's running over IPv4.
2003-09-13 06:05:56 +08:00
ip6 != NULL);
From Bruce M. Simpson <bms@spc.org>: RFC 3561 AODV support.
2003-08-06 14:49:38 +08:00
break;
Add "radius" as an option for -T. This allows tcpdump to handle RADIUS running on non-standard ports. Submitted-By: ssb@sourceforge.net Man page also updated by me.
2012-07-01 06:59:18 +08:00
case PT_RADIUS:
NDOize Frame Relay, LMP and RADIUS decoders
2014-03-18 20:09:00 +08:00
radius_print(ndo, cp, length);
Add "radius" as an option for -T. This allows tcpdump to handle RADIUS running on non-standard ports. Submitted-By: ssb@sourceforge.net Man page also updated by me.
2012-07-01 06:59:18 +08:00
break;
- Add support for OTV (draft-hasmit-otv-04). - Use the packettype infrastructure (-T vxlan) for VXLAN parsing (waiting for a well known dest port)
2013-02-26 20:44:11 +08:00
case PT_VXLAN:
UDP: Harmonize some function calls Some calls use '(const u_char *)(up + 1)' or '(const void *)(up + 1)'. Other calls use 'cp' (same value). Update the calls to only use 'cp'. Moreover: Update some other casted 'up + 1' uses to 'cp'. Update some pointers to packet bytes from 'void *' to 'u_char *'.
2020-06-09 17:57:22 +08:00
vxlan_print(ndo, cp, length);
- Add support for OTV (draft-hasmit-otv-04). - Use the packettype infrastructure (-T vxlan) for VXLAN parsing (waiting for a well known dest port)
2013-02-26 20:44:11 +08:00
break;
use existing PGM decoder for UDP-encapsulated PGM The original PGM uses its own IP protocol number. "EPGM" or "PGM/UDP" stands for UDP-encapsulated PGM, which has no assigned UDP port number and can be decoded only by means of -T option, which now accepts "pgm" protocol type for this purpose. There is also a sample capture of EPGM now (similar to the one of native PGM, but produced using the "epgm://" protocol schema) and a respective test case.
2013-03-15 01:17:53 +08:00
case PT_PGM:
improve ZeroMQ support (ZMTP/1.0 inside PGM/EPGM) This change adds new code to decode ZeroMQ datagrams, couples it with the PGM decoder and extends the -T option to make all this work. There are two new test cases based on existing captures of ZMTP/1.0 inside [E]PGM to decode the ZMTP/1.0 part of these. This functionality enables decoding of the traffic zeromq library produces for "pgm://" and "epgm://" protocol schemas.
2013-03-15 01:59:38 +08:00
case PT_PGM_ZMTP1:
NDOize 7 bigger decoders This change converts IGMP, IPv6 mobility options, LDP, Lightweight Access Point, PGM, PPTP and RIP decoders.
2014-03-19 17:57:56 +08:00
pgm_print(ndo, cp, length, bp2);
use existing PGM decoder for UDP-encapsulated PGM The original PGM uses its own IP protocol number. "EPGM" or "PGM/UDP" stands for UDP-encapsulated PGM, which has no assigned UDP port number and can be decoded only by means of -T option, which now accepts "pgm" protocol type for this purpose. There is also a sample capture of EPGM now (similar to the one of native PGM, but produced using the "epgm://" protocol schema) and a respective test case.
2013-03-15 01:17:53 +08:00
break;
LMP: add -T override and fix version 1 test(s) The Link Management Protocol version 1 sample capture added to the tests directory in commit 212eef2 was produced using non-standard UDP port 49998. Later assignment of port 701 reflected in commit 960aee5 made it impossible to decode the capture. This change adds a -T override for LMP, uses it to replace the broken test with two working tests and dismisses the custom test script, lmp.sh.
2013-09-07 16:22:37 +08:00
case PT_LMP:
NDOize Frame Relay, LMP and RADIUS decoders
2014-03-18 20:09:00 +08:00
lmp_print(ndo, cp, length);
LMP: add -T override and fix version 1 test(s) The Link Management Protocol version 1 sample capture added to the tests directory in commit 212eef2 was produced using non-standard UDP port 49998. Later assignment of port 701 reflected in commit 960aee5 made it impossible to decode the capture. This change adds a -T override for LMP, uses it to replace the broken test with two working tests and dismisses the custom test script, lmp.sh.
2013-09-07 16:22:37 +08:00
break;
The ptp (precision time protocol) with UDP as the transport protocol. - the print routines for ptp different ptp messages - test completed for sync message, announce message, delay request message, delay response message and follow up message. - integration of the ptp v2 code with the tcpdump code. Signed-off-by: Partha S. Ghosh <psglinux@gmail.com>
2018-12-14 14:28:36 +08:00
case PT_PTP:
ptp_print(ndo, cp, length);
break;
Autosar SOME/IP protocol support
2020-02-18 23:38:16 +08:00
case PT_SOMEIP:
someip_print(ndo, cp, length);
break;
Add "domain" as an option for -T This allows tcpdump to handle DNS running on non-standard ports. Add two test files with DNS over TCP and DNS over UDP, port 8053.
2020-03-02 23:04:35 +08:00
case PT_DOMAIN:
DNS: Do the 'over TCP' processing in the printer Add the parameter 'over_tcp'. Move the shift by 2 bytes from the TCP printer to the DNS printer. Move adding a prepended space from the TCP printer to the DNS printer. Add a length check. Add some comments about 'over_tcp' and 'is_mdns' call values.
2020-06-10 18:13:53 +08:00
/* over_tcp: FALSE, is_mdns: FALSE */
domain_print(ndo, cp, length, FALSE, FALSE);
Add "domain" as an option for -T This allows tcpdump to handle DNS running on non-standard ports. Add two test files with DNS over TCP and DNS over UDP, port 8053.
2020-03-02 23:04:35 +08:00
break;
Initial support to parse QUIC packets.
2021-10-01 09:34:46 +08:00
case PT_QUIC:
quic_print(ndo, cp, length);
break;
Initial revision
1999-10-08 07:47:09 +08:00
}
return;
}
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
if (!ndo->ndo_qflag) {
Remove all storage class specifier 'register' Let the compiler do the optimizations (or not) based on build options. Avoid 'value has been optimized out' messages in gdb using '-O0'.
2017-12-14 02:17:47 +08:00
const struct sunrpc_msg *rp;
Have our own headers to declare the format of ONC (Sun) RPC messages on the wire; the definitions in many systems use u_long, which is 64 bits long on many platforms - that's OK for in-memory structures, but it doesn't match what's on the wire. Use headers based on the Sun ones, but use u_int32_t for fields, and otherwise make the structures match what's on the wire, and change some names to avoid collision with <rpc/rpc.h>, which print-sunrpc.c includes to declare "getrpcbynumber()" and the structure it returns. Record whether "getrpcbynumber()" is found, and use it only if it's found, rather than basing the decisison on whether we're building for Win32 or not.
2004-12-27 08:41:29 +08:00
enum sunrpc_msg_type direction;
Initial revision
1999-10-08 07:47:09 +08:00
UDP: Harmonize some function calls Some calls use '(const u_char *)(up + 1)' or '(const void *)(up + 1)'. Other calls use 'cp' (same value). Update the calls to only use 'cp'. Moreover: Update some other casted 'up + 1' uses to 'cp'. Update some pointers to packet bytes from 'void *' to 'u_char *'.
2020-06-09 17:57:22 +08:00
rp = (const struct sunrpc_msg *)cp;
Use more ND_TCHECK_n()/ND_TTEST_n() macros
2018-01-13 05:00:45 +08:00
if (ND_TTEST_4(rp->rm_direction)) {
Use the new GET_ macros instead of the EXTRACT_ ones The exceptions are currently: Some EXTRACT_ in print-juniper.c, not used on packet buffer pointer. An EXTRACT_BE_U_3 in addrtoname.c, not always used on packet buffer pointer.
2018-06-16 23:23:21 +08:00
direction = (enum sunrpc_msg_type) GET_BE_U_4(rp->rm_direction);
Have our own headers to declare the format of ONC (Sun) RPC messages on the wire; the definitions in many systems use u_long, which is 64 bits long on many platforms - that's OK for in-memory structures, but it doesn't match what's on the wire. Use headers based on the Sun ones, but use u_int32_t for fields, and otherwise make the structures match what's on the wire, and change some names to avoid collision with <rpc/rpc.h>, which print-sunrpc.c includes to declare "getrpcbynumber()" and the structure it returns. Record whether "getrpcbynumber()" is found, and use it only if it's found, rather than basing the decisison on whether we're building for Win32 or not.
2004-12-27 08:41:29 +08:00
if (dport == NFS_PORT && direction == SUNRPC_CALL) {
Remove unneeded '&' when getting a pointer to an nd_uintN_t type
2018-01-12 06:06:48 +08:00
ND_PRINT("NFS request xid %u ",
Use the new GET_ macros instead of the EXTRACT_ ones The exceptions are currently: Some EXTRACT_ in print-juniper.c, not used on packet buffer pointer. An EXTRACT_BE_U_3 in addrtoname.c, not always used on packet buffer pointer.
2018-06-16 23:23:21 +08:00
GET_BE_U_4(rp->rm_xid));
NFS: Rename two printer functions Their names must end with '_print'
2017-11-16 20:49:06 +08:00
nfsreq_noaddr_print(ndo, (const u_char *)rp, length,
Fix a bunch of de-constifications.
2015-04-27 08:24:42 +08:00
(const u_char *)ip);
Initial revision
1999-10-08 07:47:09 +08:00
return;
}
Have our own headers to declare the format of ONC (Sun) RPC messages on the wire; the definitions in many systems use u_long, which is 64 bits long on many platforms - that's OK for in-memory structures, but it doesn't match what's on the wire. Use headers based on the Sun ones, but use u_int32_t for fields, and otherwise make the structures match what's on the wire, and change some names to avoid collision with <rpc/rpc.h>, which print-sunrpc.c includes to declare "getrpcbynumber()" and the structure it returns. Record whether "getrpcbynumber()" is found, and use it only if it's found, rather than basing the decisison on whether we're building for Win32 or not.
2004-12-27 08:41:29 +08:00
if (sport == NFS_PORT && direction == SUNRPC_REPLY) {
Remove unneeded '&' when getting a pointer to an nd_uintN_t type
2018-01-12 06:06:48 +08:00
ND_PRINT("NFS reply xid %u ",
Use the new GET_ macros instead of the EXTRACT_ ones The exceptions are currently: Some EXTRACT_ in print-juniper.c, not used on packet buffer pointer. An EXTRACT_BE_U_3 in addrtoname.c, not always used on packet buffer pointer.
2018-06-16 23:23:21 +08:00
GET_BE_U_4(rp->rm_xid));
NFS: Rename two printer functions Their names must end with '_print'
2017-11-16 20:49:06 +08:00
nfsreply_noaddr_print(ndo, (const u_char *)rp, length,
Fix a bunch of de-constifications.
2015-04-27 08:24:42 +08:00
(const u_char *)ip);
Initial revision
1999-10-08 07:47:09 +08:00
return;
}
#ifdef notdef
Have our own headers to declare the format of ONC (Sun) RPC messages on the wire; the definitions in many systems use u_long, which is 64 bits long on many platforms - that's OK for in-memory structures, but it doesn't match what's on the wire. Use headers based on the Sun ones, but use u_int32_t for fields, and otherwise make the structures match what's on the wire, and change some names to avoid collision with <rpc/rpc.h>, which print-sunrpc.c includes to declare "getrpcbynumber()" and the structure it returns. Record whether "getrpcbynumber()" is found, and use it only if it's found, rather than basing the decisison on whether we're building for Win32 or not.
2004-12-27 08:41:29 +08:00
if (dport == SUNRPC_PORT && direction == SUNRPC_CALL) {
SUNRPC: Rename entry function Most printer entry functions are based on the file name (without print-). Do the same for SUNRPC (sunrpcrequest_print -> sunrpc_print). This change allows easier update by script.
2017-11-16 17:18:43 +08:00
sunrpc_print((const u_char *)rp, length, (const u_char *)ip);
Initial revision
1999-10-08 07:47:09 +08:00
return;
}
#endif
}
}
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
if (ndo->ndo_vflag && !ndo->ndo_Kflag && !fragmented) {
udp: clean up indentation. Consistently use tabs. [skip ci]
2020-05-25 11:58:48 +08:00
/* Check the checksum, if possible. */
UDP: Modernize packet parsing style. Remove all ND_TCHECK_*() instances as redundant. Remove or convert a few improvised snapshot end guards. Reduce arity of rtcp_print(). Test the AppleTalk LAP type after testing the UDP port numbers, not before.
2021-01-12 23:52:23 +08:00
uint16_t sum;
Handle UDP checksums more like TCP checksums. Instead of printing the result of udp_cksum() if it's non-zero, print the checksum field value and the value it should have had. That means that what we print is the same regardless of whether we're running on a big-endian or little-endian machine. Also, just as we did with TCP: Check -v and -K, and the fragmented flag, up front; then check the IP version etc.. Don't check for IPv6 if we already know it's IPv4. Fetch the checksum field only once. Update some test files for the new output format.
2011-06-17 13:10:36 +08:00
/*
* XXX - do this even if vflag == 1?
* TCP does, and we do so for UDP-over-IPv6.
*/
udp: clean up indentation. Consistently use tabs. [skip ci]
2020-05-25 11:58:48 +08:00
if (IP_V(ip) == 4 && (ndo->ndo_vflag > 1)) {
Handle UDP checksums more like TCP checksums. Instead of printing the result of udp_cksum() if it's non-zero, print the checksum field value and the value it should have had. That means that what we print is the same regardless of whether we're running on a big-endian or little-endian machine. Also, just as we did with TCP: Check -v and -K, and the fragmented flag, up front; then check the IP version etc.. Don't check for IPv6 if we already know it's IPv4. Fetch the checksum field only once. Update some test files for the new output format.
2011-06-17 13:10:36 +08:00
if (udp_sum == 0) {
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ND_PRINT("[no cksum] ");
Replace ND_TTEST2()/ND_TCHECK2() macros by macros using pointers (1/n) ND_TTEST2(var, l) -> ND_TTEST_LEN(p, l) ND_TCHECK2(var, l) -> ND_TCHECK_LEN(p, l)
2017-12-11 19:46:51 +08:00
} else if (ND_TTEST_LEN(cp, length)) {
NDOize AODV, IPv4 and SCTP decoders
2014-03-26 19:47:29 +08:00
sum = udp_cksum(ndo, ip, up, length + sizeof(struct udphdr));
Handle UDP checksums more like TCP checksums. Instead of printing the result of udp_cksum() if it's non-zero, print the checksum field value and the value it should have had. That means that what we print is the same regardless of whether we're running on a big-endian or little-endian machine. Also, just as we did with TCP: Check -v and -K, and the fragmented flag, up front; then check the IP version etc.. Don't check for IPv6 if we already know it's IPv4. Fetch the checksum field only once. Update some test files for the new output format.
2011-06-17 13:10:36 +08:00
udp: clean up indentation. Consistently use tabs. [skip ci]
2020-05-25 11:58:48 +08:00
if (sum != 0) {
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ND_PRINT("[bad udp cksum 0x%04x -> 0x%04x!] ",
Handle UDP checksums more like TCP checksums. Instead of printing the result of udp_cksum() if it's non-zero, print the checksum field value and the value it should have had. That means that what we print is the same regardless of whether we're running on a big-endian or little-endian machine. Also, just as we did with TCP: Check -v and -K, and the fragmented flag, up front; then check the IP version etc.. Don't check for IPv6 if we already know it's IPv4. Fetch the checksum field only once. Update some test files for the new output format.
2011-06-17 13:10:36 +08:00
udp_sum,
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
in_cksum_shouldbe(udp_sum, sum));
Handle UDP checksums more like TCP checksums. Instead of printing the result of udp_cksum() if it's non-zero, print the checksum field value and the value it should have had. That means that what we print is the same regardless of whether we're running on a big-endian or little-endian machine. Also, just as we did with TCP: Check -v and -K, and the fragmented flag, up front; then check the IP version etc.. Don't check for IPv6 if we already know it's IPv4. Fetch the checksum field only once. Update some test files for the new output format.
2011-06-17 13:10:36 +08:00
} else
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ND_PRINT("[udp sum ok] ");
Handle UDP checksums more like TCP checksums. Instead of printing the result of udp_cksum() if it's non-zero, print the checksum field value and the value it should have had. That means that what we print is the same regardless of whether we're running on a big-endian or little-endian machine. Also, just as we did with TCP: Check -v and -K, and the fragmented flag, up front; then check the IP version etc.. Don't check for IPv6 if we already know it's IPv4. Fetch the checksum field only once. Update some test files for the new output format.
2011-06-17 13:10:36 +08:00
}
udp header checksum. from netbsd.
2000-08-02 01:36:49 +08:00
}
Remove the IPv6 payload length checks for checksumming. If there isn't an IPv6 payload, there isn't any TCP or UDP packet, and there's no TCP or UDP header to checksum, so there's no need for the check (it's not there for IPv4).
2019-05-01 15:23:08 +08:00
else if (IP_V(ip) == 6) {
Handle UDP checksums more like TCP checksums. Instead of printing the result of udp_cksum() if it's non-zero, print the checksum field value and the value it should have had. That means that what we print is the same regardless of whether we're running on a big-endian or little-endian machine. Also, just as we did with TCP: Check -v and -K, and the fragmented flag, up front; then check the IP version etc.. Don't check for IPv6 if we already know it's IPv4. Fetch the checksum field only once. Update some test files for the new output format.
2011-06-17 13:10:36 +08:00
/* for IPv6, UDP checksum is mandatory */
Replace ND_TTEST2()/ND_TCHECK2() macros by macros using pointers (1/n) ND_TTEST2(var, l) -> ND_TTEST_LEN(p, l) ND_TCHECK2(var, l) -> ND_TCHECK_LEN(p, l)
2017-12-11 19:46:51 +08:00
if (ND_TTEST_LEN(cp, length)) {
Don't overwrite the destination IPv6 address for routing headers. If we have a routing header, instead of overwriting the packet's IPv6 destination address in the packet with the final destination, so that the next protocol's checksum routine can use it, we do as we do for IPv4, and, in the "next protocol checksum" routine, scan the headers looking for a routing header and, if we find one, copy the final destination from it. While we're at it, clean up a few things.
2016-02-13 12:26:39 +08:00
sum = udp6_cksum(ndo, ip6, up, length + sizeof(struct udphdr));
Handle UDP checksums more like TCP checksums. Instead of printing the result of udp_cksum() if it's non-zero, print the checksum field value and the value it should have had. That means that what we print is the same regardless of whether we're running on a big-endian or little-endian machine. Also, just as we did with TCP: Check -v and -K, and the fragmented flag, up front; then check the IP version etc.. Don't check for IPv6 if we already know it's IPv4. Fetch the checksum field only once. Update some test files for the new output format.
2011-06-17 13:10:36 +08:00
udp: clean up indentation. Consistently use tabs. [skip ci]
2020-05-25 11:58:48 +08:00
if (sum != 0) {
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ND_PRINT("[bad udp cksum 0x%04x -> 0x%04x!] ",
Handle UDP checksums more like TCP checksums. Instead of printing the result of udp_cksum() if it's non-zero, print the checksum field value and the value it should have had. That means that what we print is the same regardless of whether we're running on a big-endian or little-endian machine. Also, just as we did with TCP: Check -v and -K, and the fragmented flag, up front; then check the IP version etc.. Don't check for IPv6 if we already know it's IPv4. Fetch the checksum field only once. Update some test files for the new output format.
2011-06-17 13:10:36 +08:00
udp_sum,
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
in_cksum_shouldbe(udp_sum, sum));
Handle UDP checksums more like TCP checksums. Instead of printing the result of udp_cksum() if it's non-zero, print the checksum field value and the value it should have had. That means that what we print is the same regardless of whether we're running on a big-endian or little-endian machine. Also, just as we did with TCP: Check -v and -K, and the fragmented flag, up front; then check the IP version etc.. Don't check for IPv6 if we already know it's IPv4. Fetch the checksum field only once. Update some test files for the new output format.
2011-06-17 13:10:36 +08:00
} else
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ND_PRINT("[udp sum ok] ");
Handle UDP checksums more like TCP checksums. Instead of printing the result of udp_cksum() if it's non-zero, print the checksum field value and the value it should have had. That means that what we print is the same regardless of whether we're running on a big-endian or little-endian machine. Also, just as we did with TCP: Check -v and -K, and the fragmented flag, up front; then check the IP version etc.. Don't check for IPv6 if we already know it's IPv4. Fetch the checksum field only once. Update some test files for the new output format.
2011-06-17 13:10:36 +08:00
}
udp header checksum. from netbsd.
2000-08-02 01:36:49 +08:00
}
Handle UDP checksums more like TCP checksums. Instead of printing the result of udp_cksum() if it's non-zero, print the checksum field value and the value it should have had. That means that what we print is the same regardless of whether we're running on a big-endian or little-endian machine. Also, just as we did with TCP: Check -v and -K, and the fragmented flag, up front; then check the IP version etc.. Don't check for IPv6 if we already know it's IPv4. Fetch the checksum field only once. Update some test files for the new output format.
2011-06-17 13:10:36 +08:00
}
udp header checksum. from netbsd.
2000-08-02 01:36:49 +08:00
NDOize EIGRP, ICMP, L2TP, STP and UDP decoders
2014-03-16 03:25:06 +08:00
if (!ndo->ndo_qflag) {
Harmonize TCP source or destination ports tests with UDP ones
2015-12-15 03:28:14 +08:00
if (IS_SRC_OR_DST_PORT(NAMESERVER_PORT))
DNS: Do the 'over TCP' processing in the printer Add the parameter 'over_tcp'. Move the shift by 2 bytes from the TCP printer to the DNS printer. Move adding a prepended space from the TCP printer to the DNS printer. Add a length check. Add some comments about 'over_tcp' and 'is_mdns' call values.
2020-06-10 18:13:53 +08:00
/* over_tcp: FALSE, is_mdns: FALSE */
domain_print(ndo, cp, length, FALSE, FALSE);
Harmonize TCP source or destination ports tests with UDP ones
2015-12-15 03:28:14 +08:00
else if (IS_SRC_OR_DST_PORT(MULTICASTDNS_PORT))
DNS: Do the 'over TCP' processing in the printer Add the parameter 'over_tcp'. Move the shift by 2 bytes from the TCP printer to the DNS printer. Move adding a prepended space from the TCP printer to the DNS printer. Add a length check. Add some comments about 'over_tcp' and 'is_mdns' call values.
2020-06-10 18:13:53 +08:00
/* over_tcp: FALSE, is_mdns: TRUE */
domain_print(ndo, cp, length, FALSE, TRUE);
Harmonize TCP source or destination ports tests with UDP ones
2015-12-15 03:28:14 +08:00
else if (IS_SRC_OR_DST_PORT(TIMED_PORT))
UDP: Harmonize some function calls Some calls use '(const u_char *)(up + 1)' or '(const void *)(up + 1)'. Other calls use 'cp' (same value). Update the calls to only use 'cp'. Moreover: Update some other casted 'up + 1' uses to 'cp'. Update some pointers to packet bytes from 'void *' to 'u_char *'.
2020-06-09 17:57:22 +08:00
timed_print(ndo, (const u_char *)cp);
Harmonize TCP source or destination ports tests with UDP ones
2015-12-15 03:28:14 +08:00
else if (IS_SRC_OR_DST_PORT(TFTP_PORT))
UDP: Harmonize some function calls Some calls use '(const u_char *)(up + 1)' or '(const void *)(up + 1)'. Other calls use 'cp' (same value). Update the calls to only use 'cp'. Moreover: Update some other casted 'up + 1' uses to 'cp'. Update some pointers to packet bytes from 'void *' to 'u_char *'.
2020-06-09 17:57:22 +08:00
tftp_print(ndo, cp, length);
Harmonize TCP source or destination ports tests with UDP ones
2015-12-15 03:28:14 +08:00
else if (IS_SRC_OR_DST_PORT(BOOTPC_PORT) || IS_SRC_OR_DST_PORT(BOOTPS_PORT))
UDP: Harmonize some function calls Some calls use '(const u_char *)(up + 1)' or '(const void *)(up + 1)'. Other calls use 'cp' (same value). Update the calls to only use 'cp'. Moreover: Update some other casted 'up + 1' uses to 'cp'. Update some pointers to packet bytes from 'void *' to 'u_char *'.
2020-06-09 17:57:22 +08:00
bootp_print(ndo, cp, length);
Harmonize TCP source or destination ports tests with UDP ones
2015-12-15 03:28:14 +08:00
else if (IS_SRC_OR_DST_PORT(RIP_PORT))
UDP: Harmonize some function calls Some calls use '(const u_char *)(up + 1)' or '(const void *)(up + 1)'. Other calls use 'cp' (same value). Update the calls to only use 'cp'. Moreover: Update some other casted 'up + 1' uses to 'cp'. Update some pointers to packet bytes from 'void *' to 'u_char *'.
2020-06-09 17:57:22 +08:00
rip_print(ndo, cp, length);
Harmonize TCP source or destination ports tests with UDP ones
2015-12-15 03:28:14 +08:00
else if (IS_SRC_OR_DST_PORT(AODV_PORT))
UDP: Harmonize some function calls Some calls use '(const u_char *)(up + 1)' or '(const void *)(up + 1)'. Other calls use 'cp' (same value). Update the calls to only use 'cp'. Moreover: Update some other casted 'up + 1' uses to 'cp'. Update some pointers to packet bytes from 'void *' to 'u_char *'.
2020-06-09 17:57:22 +08:00
aodv_print(ndo, cp, length,
Updates from Bruce Simpson: Fix numerous bugs in my AODV submission, red faces all round, mainly due to misunderstanding of EXTRACT_STRING() macro arguments (because these are macros, type checking didn't happen). AODV HELLO extensions are now correctly printed. The code is closer to FreeBSD's style guidelines. Don't use "u_char" and "u_long", use "u_int8_t" and "u_int32_t". "u_long" is definitely wrong as it's 64 bits on some platforms; "u_char" is safe, but the official tcpdump style uses "u_int8_t". At least according to the (long-since-expired) draft-perkins-aodv6-01, the V6 AODV messages have different message type values from the V4 ones in draft-ietf-manet-aodv-13. However, draft-ietf-manet-aodv-13 says that the only differences are in the addresses; we support both. Clean up the way we tell the AODV6 dissector that we're running atop IPv6 a bit. Use "udpipaddr_print()" if we're printing AODV packets as a result of saying "anything that matches this filter is AODV", rather than doing it ourselves under the assumption that it's running over IPv4.
2003-09-13 06:05:56 +08:00
ip6 != NULL);
udp: clean up indentation. Consistently use tabs. [skip ci]
2020-05-25 11:58:48 +08:00
else if (IS_SRC_OR_DST_PORT(ISAKMP_PORT))
UDP: Harmonize some function calls Some calls use '(const u_char *)(up + 1)' or '(const void *)(up + 1)'. Other calls use 'cp' (same value). Update the calls to only use 'cp'. Moreover: Update some other casted 'up + 1' uses to 'cp'. Update some pointers to packet bytes from 'void *' to 'u_char *'.
2020-06-09 17:57:22 +08:00
isakmp_print(ndo, cp, length, bp2);
udp: clean up indentation. Consistently use tabs. [skip ci]
2020-05-25 11:58:48 +08:00
else if (IS_SRC_OR_DST_PORT(ISAKMP_PORT_NATT))
UDP: Harmonize some function calls Some calls use '(const u_char *)(up + 1)' or '(const void *)(up + 1)'. Other calls use 'cp' (same value). Update the calls to only use 'cp'. Moreover: Update some other casted 'up + 1' uses to 'cp'. Update some pointers to packet bytes from 'void *' to 'u_char *'.
2020-06-09 17:57:22 +08:00
isakmp_rfc3948_print(ndo, cp, length, bp2, IP_V(ip), fragmented, ttl_hl);
udp: clean up indentation. Consistently use tabs. [skip ci]
2020-05-25 11:58:48 +08:00
else if (IS_SRC_OR_DST_PORT(ISAKMP_PORT_USER1) || IS_SRC_OR_DST_PORT(ISAKMP_PORT_USER2))
UDP: Harmonize some function calls Some calls use '(const u_char *)(up + 1)' or '(const void *)(up + 1)'. Other calls use 'cp' (same value). Update the calls to only use 'cp'. Moreover: Update some other casted 'up + 1' uses to 'cp'. Update some pointers to packet bytes from 'void *' to 'u_char *'.
2020-06-09 17:57:22 +08:00
isakmp_print(ndo, cp, length, bp2);
Harmonize TCP source or destination ports tests with UDP ones
2015-12-15 03:28:14 +08:00
else if (IS_SRC_OR_DST_PORT(SNMP_PORT) || IS_SRC_OR_DST_PORT(SNMPTRAP_PORT))
UDP: Harmonize some function calls Some calls use '(const u_char *)(up + 1)' or '(const void *)(up + 1)'. Other calls use 'cp' (same value). Update the calls to only use 'cp'. Moreover: Update some other casted 'up + 1' uses to 'cp'. Update some pointers to packet bytes from 'void *' to 'u_char *'.
2020-06-09 17:57:22 +08:00
snmp_print(ndo, cp, length);
Harmonize TCP source or destination ports tests with UDP ones
2015-12-15 03:28:14 +08:00
else if (IS_SRC_OR_DST_PORT(NTP_PORT))
UDP: Harmonize some function calls Some calls use '(const u_char *)(up + 1)' or '(const void *)(up + 1)'. Other calls use 'cp' (same value). Update the calls to only use 'cp'. Moreover: Update some other casted 'up + 1' uses to 'cp'. Update some pointers to packet bytes from 'void *' to 'u_char *'.
2020-06-09 17:57:22 +08:00
ntp_print(ndo, cp, length);
Harmonize TCP source or destination ports tests with UDP ones
2015-12-15 03:28:14 +08:00
else if (IS_SRC_OR_DST_PORT(KERBEROS_PORT) || IS_SRC_OR_DST_PORT(KERBEROS_SEC_PORT))
UDP: Harmonize some function calls Some calls use '(const u_char *)(up + 1)' or '(const void *)(up + 1)'. Other calls use 'cp' (same value). Update the calls to only use 'cp'. Moreover: Update some other casted 'up + 1' uses to 'cp'. Update some pointers to packet bytes from 'void *' to 'u_char *'.
2020-06-09 17:57:22 +08:00
krb_print(ndo, (const u_char *)cp);
Harmonize TCP source or destination ports tests with UDP ones
2015-12-15 03:28:14 +08:00
else if (IS_SRC_OR_DST_PORT(L2TP_PORT))
UDP: Harmonize some function calls Some calls use '(const u_char *)(up + 1)' or '(const void *)(up + 1)'. Other calls use 'cp' (same value). Update the calls to only use 'cp'. Moreover: Update some other casted 'up + 1' uses to 'cp'. Update some pointers to packet bytes from 'void *' to 'u_char *'.
2020-06-09 17:57:22 +08:00
l2tp_print(ndo, cp, length);
Get rid of "TCPDUMP" in some libnetdissect codes
2015-10-08 22:36:23 +08:00
#ifdef ENABLE_SMB
Harmonize TCP source or destination ports tests with UDP ones
2015-12-15 03:28:14 +08:00
else if (IS_SRC_OR_DST_PORT(NETBIOS_NS_PORT))
UDP: Harmonize some function calls Some calls use '(const u_char *)(up + 1)' or '(const void *)(up + 1)'. Other calls use 'cp' (same value). Update the calls to only use 'cp'. Moreover: Update some other casted 'up + 1' uses to 'cp'. Update some pointers to packet bytes from 'void *' to 'u_char *'.
2020-06-09 17:57:22 +08:00
nbt_udp137_print(ndo, cp, length);
Harmonize TCP source or destination ports tests with UDP ones
2015-12-15 03:28:14 +08:00
else if (IS_SRC_OR_DST_PORT(NETBIOS_DGRAM_PORT))
UDP: Harmonize some function calls Some calls use '(const u_char *)(up + 1)' or '(const void *)(up + 1)'. Other calls use 'cp' (same value). Update the calls to only use 'cp'. Moreover: Update some other casted 'up + 1' uses to 'cp'. Update some pointers to packet bytes from 'void *' to 'u_char *'.
2020-06-09 17:57:22 +08:00
nbt_udp138_print(ndo, cp, length);
disable smb printing until we have boundary checks in *smb*.c (there's almost no boundary check).
2001-10-04 17:18:45 +08:00
#endif
use macros for VAT and WB port numbers
2013-04-03 19:08:17 +08:00
else if (dport == VAT_PORT)
UDP: Harmonize some function calls Some calls use '(const u_char *)(up + 1)' or '(const void *)(up + 1)'. Other calls use 'cp' (same value). Update the calls to only use 'cp'. Moreover: Update some other casted 'up + 1' uses to 'cp'. Update some pointers to packet bytes from 'void *' to 'u_char *'.
2020-06-09 17:57:22 +08:00
vat_print(ndo, cp, length);
Harmonize TCP source or destination ports tests with UDP ones
2015-12-15 03:28:14 +08:00
else if (IS_SRC_OR_DST_PORT(ZEPHYR_SRV_PORT) || IS_SRC_OR_DST_PORT(ZEPHYR_CLT_PORT))
UDP: Harmonize some function calls Some calls use '(const u_char *)(up + 1)' or '(const void *)(up + 1)'. Other calls use 'cp' (same value). Update the calls to only use 'cp'. Moreover: Update some other casted 'up + 1' uses to 'cp'. Update some pointers to packet bytes from 'void *' to 'u_char *'.
2020-06-09 17:57:22 +08:00
zephyr_print(ndo, cp, length);
whitespace cleanup
2002-06-12 01:08:37 +08:00
/*
* Since there are 10 possible ports to check, I think
* a <> test would be more efficient
*/
else if ((sport >= RX_PORT_LOW && sport <= RX_PORT_HIGH) ||
(dport >= RX_PORT_LOW && dport <= RX_PORT_HIGH))
UDP: Harmonize some function calls Some calls use '(const u_char *)(up + 1)' or '(const void *)(up + 1)'. Other calls use 'cp' (same value). Update the calls to only use 'cp'. Moreover: Update some other casted 'up + 1' uses to 'cp'. Update some pointers to packet bytes from 'void *' to 'u_char *'.
2020-06-09 17:57:22 +08:00
rx_print(ndo, cp, length, sport, dport,
Fix a bunch of de-constifications.
2015-04-27 08:24:42 +08:00
(const u_char *) ip);
Harmonize TCP source or destination ports tests with UDP ones
2015-12-15 03:28:14 +08:00
else if (IS_SRC_OR_DST_PORT(RIPNG_PORT))
UDP: Harmonize some function calls Some calls use '(const u_char *)(up + 1)' or '(const void *)(up + 1)'. Other calls use 'cp' (same value). Update the calls to only use 'cp'. Moreover: Update some other casted 'up + 1' uses to 'cp'. Update some pointers to packet bytes from 'void *' to 'u_char *'.
2020-06-09 17:57:22 +08:00
ripng_print(ndo, cp, length);
Harmonize TCP source or destination ports tests with UDP ones
2015-12-15 03:28:14 +08:00
else if (IS_SRC_OR_DST_PORT(DHCP6_SERV_PORT) || IS_SRC_OR_DST_PORT(DHCP6_CLI_PORT))
UDP: Harmonize some function calls Some calls use '(const u_char *)(up + 1)' or '(const void *)(up + 1)'. Other calls use 'cp' (same value). Update the calls to only use 'cp'. Moreover: Update some other casted 'up + 1' uses to 'cp'. Update some pointers to packet bytes from 'void *' to 'u_char *'.
2020-06-09 17:57:22 +08:00
dhcp6_print(ndo, cp, length);
Harmonize TCP source or destination ports tests with UDP ones
2015-12-15 03:28:14 +08:00
else if (IS_SRC_OR_DST_PORT(AHCP_PORT))
UDP: Harmonize some function calls Some calls use '(const u_char *)(up + 1)' or '(const void *)(up + 1)'. Other calls use 'cp' (same value). Update the calls to only use 'cp'. Moreover: Update some other casted 'up + 1' uses to 'cp'. Update some pointers to packet bytes from 'void *' to 'u_char *'.
2020-06-09 17:57:22 +08:00
ahcp_print(ndo, cp, length);
Harmonize TCP source or destination ports tests with UDP ones
2015-12-15 03:28:14 +08:00
else if (IS_SRC_OR_DST_PORT(BABEL_PORT) || IS_SRC_OR_DST_PORT(BABEL_PORT_OLD))
UDP: Harmonize some function calls Some calls use '(const u_char *)(up + 1)' or '(const void *)(up + 1)'. Other calls use 'cp' (same value). Update the calls to only use 'cp'. Moreover: Update some other casted 'up + 1' uses to 'cp'. Update some pointers to packet bytes from 'void *' to 'u_char *'.
2020-06-09 17:57:22 +08:00
babel_print(ndo, cp, length);
Printer for HNCP (RFCs 7787 and 7788). This is joint work with Antonin Décimo.
2016-07-29 03:09:41 +08:00
else if (IS_SRC_OR_DST_PORT(HNCP_PORT))
UDP: Harmonize some function calls Some calls use '(const u_char *)(up + 1)' or '(const void *)(up + 1)'. Other calls use 'cp' (same value). Update the calls to only use 'cp'. Moreover: Update some other casted 'up + 1' uses to 'cp'. Update some pointers to packet bytes from 'void *' to 'u_char *'.
2020-06-09 17:57:22 +08:00
hncp_print(ndo, cp, length);
Initial revision
1999-10-08 07:47:09 +08:00
/*
* Kludge in test for whiteboard packets.
*/
use macros for VAT and WB port numbers
2013-04-03 19:08:17 +08:00
else if (dport == WB_PORT)
UDP: Harmonize some function calls Some calls use '(const u_char *)(up + 1)' or '(const void *)(up + 1)'. Other calls use 'cp' (same value). Update the calls to only use 'cp'. Moreover: Update some other casted 'up + 1' uses to 'cp'. Update some pointers to packet bytes from 'void *' to 'u_char *'.
2020-06-09 17:57:22 +08:00
wb_print(ndo, cp, length);
Harmonize TCP source or destination ports tests with UDP ones
2015-12-15 03:28:14 +08:00
else if (IS_SRC_OR_DST_PORT(CISCO_AUTORP_PORT))
UDP: Harmonize some function calls Some calls use '(const u_char *)(up + 1)' or '(const void *)(up + 1)'. Other calls use 'cp' (same value). Update the calls to only use 'cp'. Moreover: Update some other casted 'up + 1' uses to 'cp'. Update some pointers to packet bytes from 'void *' to 'u_char *'.
2020-06-09 17:57:22 +08:00
cisco_autorp_print(ndo, cp, length);
Harmonize TCP source or destination ports tests with UDP ones
2015-12-15 03:28:14 +08:00
else if (IS_SRC_OR_DST_PORT(RADIUS_PORT) ||
IS_SRC_OR_DST_PORT(RADIUS_NEW_PORT) ||
IS_SRC_OR_DST_PORT(RADIUS_ACCOUNTING_PORT) ||
IS_SRC_OR_DST_PORT(RADIUS_NEW_ACCOUNTING_PORT) ||
Translate UDP/1700 as RADIUS Used for Cisco CoA/Disconnect, as shown on https://supportforums.cisco.com/discussion/11719766/ise-112-change-authorization-avaya-switches-5520. The RFC says port 3799, but Cisco does this otherwise, which means this is not an officially reserved port for RADIUS.
2015-07-22 23:03:56 +08:00
IS_SRC_OR_DST_PORT(RADIUS_CISCO_COA_PORT) ||
Harmonize TCP source or destination ports tests with UDP ones
2015-12-15 03:28:14 +08:00
IS_SRC_OR_DST_PORT(RADIUS_COA_PORT) )
UDP: Harmonize some function calls Some calls use '(const u_char *)(up+1)'. Other calls use 'cp' (same value). Update the calls to only use 'cp'. (follow-up to ea0f25cc7765554e521bf7ea44d94f77500749f5)
2020-07-31 18:19:51 +08:00
radius_print(ndo, cp, length);
HSRP dissector, from Julian Cowley <julian@lava.net>.
2001-09-17 14:22:31 +08:00
else if (dport == HSRP_PORT)
UDP: Harmonize some function calls Some calls use '(const u_char *)(up + 1)' or '(const void *)(up + 1)'. Other calls use 'cp' (same value). Update the calls to only use 'cp'. Moreover: Update some other casted 'up + 1' uses to 'cp'. Update some pointers to packet bytes from 'void *' to 'u_char *'.
2020-06-09 17:57:22 +08:00
hsrp_print(ndo, cp, length);
Harmonize TCP source or destination ports tests with UDP ones
2015-12-15 03:28:14 +08:00
else if (IS_SRC_OR_DST_PORT(LWRES_PORT))
UDP: Harmonize some function calls Some calls use '(const u_char *)(up + 1)' or '(const void *)(up + 1)'. Other calls use 'cp' (same value). Update the calls to only use 'cp'. Moreover: Update some other casted 'up + 1' uses to 'cp'. Update some pointers to packet bytes from 'void *' to 'u_char *'.
2020-06-09 17:57:22 +08:00
lwres_print(ndo, cp, length);
Harmonize TCP source or destination ports tests with UDP ones
2015-12-15 03:28:14 +08:00
else if (IS_SRC_OR_DST_PORT(LDP_PORT))
UDP: Harmonize some function calls Some calls use '(const u_char *)(up + 1)' or '(const void *)(up + 1)'. Other calls use 'cp' (same value). Update the calls to only use 'cp'. Moreover: Update some other casted 'up + 1' uses to 'cp'. Update some pointers to packet bytes from 'void *' to 'u_char *'.
2020-06-09 17:57:22 +08:00
ldp_print(ndo, cp, length);
Harmonize TCP source or destination ports tests with UDP ones
2015-12-15 03:28:14 +08:00
else if (IS_SRC_OR_DST_PORT(OLSR_PORT))
UDP: Harmonize some function calls Some calls use '(const u_char *)(up + 1)' or '(const void *)(up + 1)'. Other calls use 'cp' (same value). Update the calls to only use 'cp'. Moreover: Update some other casted 'up + 1' uses to 'cp'. Update some pointers to packet bytes from 'void *' to 'u_char *'.
2020-06-09 17:57:22 +08:00
olsr_print(ndo, cp, length,
print-olsr: Add basic IPv6 support. Unfortunately OLSR uses the same IDs for IPv4 and IPv6 packets, even though the size of "messages" differ. The version of the internet protocol is therefore handed to the "olsr_print" function. The code isn't very nice, due to a high density of #ifdef INET6'es. If IPv6-support really should be optional, I'm afraid this is inevitable. Both, compilation with and without IPv6 support has been tested. The patch addresses fixes other issues, too. The length given in the packet was used for pointer arithmetic without checking if the value was in a reasonable range first in several places. It should now be possible to decode more than one "namespace message" within a single packet. Other changes remove trailing whitespace or fix lines indented with tabs (the majority of the file is indented using spaces). Signed-off-by: Florian Forster <octo@leeloo.lan.home.verplant.org>
2009-05-17 06:05:30 +08:00
(IP_V(ip) == 6) ? 1 : 0);
Harmonize TCP source or destination ports tests with UDP ones
2015-12-15 03:28:14 +08:00
else if (IS_SRC_OR_DST_PORT(MPLS_LSP_PING_PORT))
UDP: Harmonize some function calls Some calls use '(const u_char *)(up + 1)' or '(const void *)(up + 1)'. Other calls use 'cp' (same value). Update the calls to only use 'cp'. Moreover: Update some other casted 'up + 1' uses to 'cp'. Update some pointers to packet bytes from 'void *' to 'u_char *'.
2020-06-09 17:57:22 +08:00
lspping_print(ndo, cp, length);
add support for Broadcom LI header (pull request #843) fix build break for Broadcom LI printer on BSD platforms incorporate review comments: make bcm_li_print() void, add a sample capture incorporate review comments: remove trailing tabs add BCM LI outputs to testset incorporate review comment: return after printing update verbose output for bcm-li
2020-04-01 20:40:50 +08:00
else if (sport == BCM_LI_PORT)
UDP: Harmonize some function calls Some calls use '(const u_char *)(up+1)'. Other calls use 'cp' (same value). Update the calls to only use 'cp'. (follow-up to ea0f25cc7765554e521bf7ea44d94f77500749f5)
2020-07-31 18:19:51 +08:00
bcm_li_print(ndo, cp, length);
support for bi-directional fault detection (BFD) Control packets as per draft-katz-ward-bfd-01.txt
2003-10-27 18:13:44 +08:00
else if (dport == BFD_CONTROL_PORT ||
Add BFD multihop and lag decoding Put back the bfd_port_values, and use it to distinguish between destination ports for RFC5883 multihop and RFC7310 lag sessions. (The destination port is the only difference between these messages.)
2019-04-27 02:03:34 +08:00
dport == BFD_MULTIHOP_PORT ||
dport == BFD_LAG_PORT ||
BFD: add SBFD support (RFC7880 and RFC7881) Add support for SBFD on UDP port 7784. SBFD is different in that packets from the reflector will be sent with *source* port 7784; in all other BFD mechanisms, it is only the destination port that matters. For SBFD print-udp.c has to check both source and destination port.
2021-02-05 13:10:31 +08:00
dport == SBFD_PORT ||
support for bi-directional fault detection (BFD) Control packets as per draft-katz-ward-bfd-01.txt
2003-10-27 18:13:44 +08:00
dport == BFD_ECHO_PORT )
UDP: Harmonize some function calls Some calls use '(const u_char *)(up+1)'. Other calls use 'cp' (same value). Update the calls to only use 'cp'. (follow-up to ea0f25cc7765554e521bf7ea44d94f77500749f5)
2020-07-31 18:19:51 +08:00
bfd_print(ndo, cp, length, dport);
BFD: add SBFD support (RFC7880 and RFC7881) Add support for SBFD on UDP port 7784. SBFD is different in that packets from the reflector will be sent with *source* port 7784; in all other BFD mechanisms, it is only the destination port that matters. For SBFD print-udp.c has to check both source and destination port.
2021-02-05 13:10:31 +08:00
else if (sport == SBFD_PORT)
bfd_print(ndo, cp, length, sport);
udp: clean up indentation. Consistently use tabs. [skip ci]
2020-05-25 11:58:48 +08:00
else if (IS_SRC_OR_DST_PORT(LMP_PORT))
UDP: Harmonize some function calls Some calls use '(const u_char *)(up + 1)' or '(const void *)(up + 1)'. Other calls use 'cp' (same value). Update the calls to only use 'cp'. Moreover: Update some other casted 'up + 1' uses to 'cp'. Update some pointers to packet bytes from 'void *' to 'u_char *'.
2020-06-09 17:57:22 +08:00
lmp_print(ndo, cp, length);
Harmonize TCP source or destination ports tests with UDP ones
2015-12-15 03:28:14 +08:00
else if (IS_SRC_OR_DST_PORT(VQP_PORT))
UDP: Harmonize some function calls Some calls use '(const u_char *)(up + 1)' or '(const void *)(up + 1)'. Other calls use 'cp' (same value). Update the calls to only use 'cp'. Moreover: Update some other casted 'up + 1' uses to 'cp'. Update some pointers to packet bytes from 'void *' to 'u_char *'.
2020-06-09 17:57:22 +08:00
vqp_print(ndo, cp, length);
udp: clean up indentation. Consistently use tabs. [skip ci]
2020-05-25 11:58:48 +08:00
else if (IS_SRC_OR_DST_PORT(SFLOW_PORT))
UDP: Harmonize some function calls Some calls use '(const u_char *)(up + 1)' or '(const void *)(up + 1)'. Other calls use 'cp' (same value). Update the calls to only use 'cp'. Moreover: Update some other casted 'up + 1' uses to 'cp'. Update some pointers to packet bytes from 'void *' to 'u_char *'.
2020-06-09 17:57:22 +08:00
sflow_print(ndo, cp, length);
udp: clean up indentation. Consistently use tabs. [skip ci]
2020-05-25 11:58:48 +08:00
else if (dport == LWAPP_CONTROL_PORT)
UDP: Harmonize some function calls Some calls use '(const u_char *)(up + 1)' or '(const void *)(up + 1)'. Other calls use 'cp' (same value). Update the calls to only use 'cp'. Moreover: Update some other casted 'up + 1' uses to 'cp'. Update some pointers to packet bytes from 'void *' to 'u_char *'.
2020-06-09 17:57:22 +08:00
lwapp_control_print(ndo, cp, length, 1);
udp: clean up indentation. Consistently use tabs. [skip ci]
2020-05-25 11:58:48 +08:00
else if (sport == LWAPP_CONTROL_PORT)
UDP: Harmonize some function calls Some calls use '(const u_char *)(up + 1)' or '(const void *)(up + 1)'. Other calls use 'cp' (same value). Update the calls to only use 'cp'. Moreover: Update some other casted 'up + 1' uses to 'cp'. Update some pointers to packet bytes from 'void *' to 'u_char *'.
2020-06-09 17:57:22 +08:00
lwapp_control_print(ndo, cp, length, 0);
udp: clean up indentation. Consistently use tabs. [skip ci]
2020-05-25 11:58:48 +08:00
else if (IS_SRC_OR_DST_PORT(LWAPP_DATA_PORT))
UDP: Harmonize some function calls Some calls use '(const u_char *)(up + 1)' or '(const void *)(up + 1)'. Other calls use 'cp' (same value). Update the calls to only use 'cp'. Moreover: Update some other casted 'up + 1' uses to 'cp'. Update some pointers to packet bytes from 'void *' to 'u_char *'.
2020-06-09 17:57:22 +08:00
lwapp_data_print(ndo, cp, length);
udp: clean up indentation. Consistently use tabs. [skip ci]
2020-05-25 11:58:48 +08:00
else if (IS_SRC_OR_DST_PORT(SIP_PORT))
UDP: Harmonize some function calls Some calls use '(const u_char *)(up + 1)' or '(const void *)(up + 1)'. Other calls use 'cp' (same value). Update the calls to only use 'cp'. Moreover: Update some other casted 'up + 1' uses to 'cp'. Update some pointers to packet bytes from 'void *' to 'u_char *'.
2020-06-09 17:57:22 +08:00
sip_print(ndo, cp, length);
udp: clean up indentation. Consistently use tabs. [skip ci]
2020-05-25 11:58:48 +08:00
else if (IS_SRC_OR_DST_PORT(SYSLOG_PORT))
UDP: Harmonize some function calls Some calls use '(const u_char *)(up + 1)' or '(const void *)(up + 1)'. Other calls use 'cp' (same value). Update the calls to only use 'cp'. Moreover: Update some other casted 'up + 1' uses to 'cp'. Update some pointers to packet bytes from 'void *' to 'u_char *'.
2020-06-09 17:57:22 +08:00
syslog_print(ndo, cp, length);
udp: clean up indentation. Consistently use tabs. [skip ci]
2020-05-25 11:58:48 +08:00
else if (IS_SRC_OR_DST_PORT(OTV_PORT))
UDP: Harmonize some function calls Some calls use '(const u_char *)(up + 1)' or '(const void *)(up + 1)'. Other calls use 'cp' (same value). Update the calls to only use 'cp'. Moreover: Update some other casted 'up + 1' uses to 'cp'. Update some pointers to packet bytes from 'void *' to 'u_char *'.
2020-06-09 17:57:22 +08:00
otv_print(ndo, cp, length);
udp: clean up indentation. Consistently use tabs. [skip ci]
2020-05-25 11:58:48 +08:00
else if (IS_SRC_OR_DST_PORT(VXLAN_PORT))
UDP: Harmonize some function calls Some calls use '(const u_char *)(up + 1)' or '(const void *)(up + 1)'. Other calls use 'cp' (same value). Update the calls to only use 'cp'. Moreover: Update some other casted 'up + 1' uses to 'cp'. Update some pointers to packet bytes from 'void *' to 'u_char *'.
2020-06-09 17:57:22 +08:00
vxlan_print(ndo, cp, length);
udp: clean up indentation. Consistently use tabs. [skip ci]
2020-05-25 11:58:48 +08:00
else if (IS_SRC_OR_DST_PORT(GENEVE_PORT))
UDP: Harmonize some function calls Some calls use '(const u_char *)(up + 1)' or '(const void *)(up + 1)'. Other calls use 'cp' (same value). Update the calls to only use 'cp'. Moreover: Update some other casted 'up + 1' uses to 'cp'. Update some pointers to packet bytes from 'void *' to 'u_char *'.
2020-06-09 17:57:22 +08:00
geneve_print(ndo, cp, length);
Harmonize TCP source or destination ports tests with UDP ones
2015-12-15 03:28:14 +08:00
else if (IS_SRC_OR_DST_PORT(LISP_CONTROL_PORT))
UDP: Harmonize some function calls Some calls use '(const u_char *)(up + 1)' or '(const void *)(up + 1)'. Other calls use 'cp' (same value). Update the calls to only use 'cp'. Moreover: Update some other casted 'up + 1' uses to 'cp'. Update some pointers to packet bytes from 'void *' to 'u_char *'.
2020-06-09 17:57:22 +08:00
lisp_print(ndo, cp, length);
Add printing function for Generic Protocol Extension for VXLAN and Network Service Header. This code stands for following internet drafts: - VXLAN GPE: draft-ietf-nvo3-vxlan-gpe-01 - NSH: draft-ietf-sfc-nsh-01
2015-11-16 00:24:19 +08:00
else if (IS_SRC_OR_DST_PORT(VXLAN_GPE_PORT))
UDP: Harmonize some function calls Some calls use '(const u_char *)(up + 1)' or '(const void *)(up + 1)'. Other calls use 'cp' (same value). Update the calls to only use 'cp'. Moreover: Update some other casted 'up + 1' uses to 'cp'. Update some pointers to packet bytes from 'void *' to 'u_char *'.
2020-06-09 17:57:22 +08:00
vxlan_gpe_print(ndo, cp, length);
IEEE 802.15.4 printer which understands frame version 2 frames, and also knows how to print some mac commands and IE contents. Also includes the zep printer to decode ZigBee Encapsulation Protocol frames
2017-03-26 09:48:28 +08:00
else if (IS_SRC_OR_DST_PORT(ZEP_PORT))
UDP: Harmonize some function calls Some calls use '(const u_char *)(up + 1)' or '(const void *)(up + 1)'. Other calls use 'cp' (same value). Update the calls to only use 'cp'. Moreover: Update some other casted 'up + 1' uses to 'cp'. Update some pointers to packet bytes from 'void *' to 'u_char *'.
2020-06-09 17:57:22 +08:00
zep_print(ndo, cp, length);
Print MPLS-over-UDP.
2020-02-09 03:25:38 +08:00
else if (IS_SRC_OR_DST_PORT(MPLS_PORT))
UDP: Harmonize some function calls Some calls use '(const u_char *)(up + 1)' or '(const void *)(up + 1)'. Other calls use 'cp' (same value). Update the calls to only use 'cp'. Moreover: Update some other casted 'up + 1' uses to 'cp'. Update some pointers to packet bytes from 'void *' to 'u_char *'.
2020-06-09 17:57:22 +08:00
mpls_print(ndo, cp, length);
UDP: Modernize packet parsing style. Remove all ND_TCHECK_*() instances as redundant. Remove or convert a few improvised snapshot end guards. Reduce arity of rtcp_print(). Test the AppleTalk LAP type after testing the UDP port numbers, not before.
2021-01-12 23:52:23 +08:00
else if ((atalk_port(sport) || atalk_port(dport)) &&
GET_U_1(((const struct LAP *)cp)->type) == lapDDP) {
Don't do the DDP-over-UDP heuristic check up front. There's probably less DDP-over-UDP traffic passing through tcpdump these days than, for example, SNMP v2 traffic from a low source port longer than 512 bytes, so move the latter heuristic check after all the other checks. Fixes GitHub tcpdump issue #499.
2016-01-12 08:14:56 +08:00
if (ndo->ndo_vflag)
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ND_PRINT("kip ");
Don't do the DDP-over-UDP heuristic check up front. There's probably less DDP-over-UDP traffic passing through tcpdump these days than, for example, SNMP v2 traffic from a low source port longer than 512 bytes, so move the latter heuristic check after all the other checks. Fixes GitHub tcpdump issue #499.
2016-01-12 08:14:56 +08:00
llap_print(ndo, cp, length);
udp: clean up indentation. Consistently use tabs. [skip ci]
2020-05-25 11:58:48 +08:00
} else if (IS_SRC_OR_DST_PORT(PTP_EVENT_PORT) ||
IS_SRC_OR_DST_PORT(PTP_GENERAL_PORT)) {
ptp_print(ndo, cp, length);
} else if (IS_SRC_OR_DST_PORT(SOMEIP_PORT))
UDP: Harmonize some function calls Some calls use '(const u_char *)(up + 1)' or '(const void *)(up + 1)'. Other calls use 'cp' (same value). Update the calls to only use 'cp'. Moreover: Update some other casted 'up + 1' uses to 'cp'. Update some pointers to packet bytes from 'void *' to 'u_char *'.
2020-06-09 17:57:22 +08:00
someip_print(ndo, cp, length);
Initial support to parse QUIC packets.
2021-10-01 09:34:46 +08:00
else if (IS_SRC_OR_DST_PORT(HTTPS_PORT) &&
quic_detect(ndo, cp, length))
quic_print(ndo, cp, length);
udp: clean up indentation. Consistently use tabs. [skip ci]
2020-05-25 11:58:48 +08:00
else {
Don't print "bad length" for fragmented UDP packets In case of fragmentation, it's perfectly OK for the total UDP length to be larger than the length of the first packet, so don't raise a false alert. Signed-off-by: Martin Buck <mb-tmp-tvguho.pbz@gromit.dyndns.org>
2017-05-16 17:18:13 +08:00
if (ulen > length && !fragmented)
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ND_PRINT("UDP, bad length %u > %u",
ulen, length);
Use the length field in the UDP header. If it's less than the length of the IP payload, use it as the size of the UDP packet. If it's greater than the length of the IP payload, and we're not dissecting the payload, report the length as bad.
2014-10-20 04:42:00 +08:00
else
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ND_PRINT("UDP, length %u", ulen);
Use the length field in the UDP header. If it's less than the length of the IP payload, use it as the size of the UDP packet. If it's greater than the length of the IP payload, and we're not dissecting the payload, report the length as bad.
2014-10-20 04:42:00 +08:00
}
} else {
Don't print "bad length" for fragmented UDP packets In case of fragmentation, it's perfectly OK for the total UDP length to be larger than the length of the first packet, so don't raise a false alert. Signed-off-by: Martin Buck <mb-tmp-tvguho.pbz@gromit.dyndns.org>
2017-05-16 17:18:13 +08:00
if (ulen > length && !fragmented)
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ND_PRINT("UDP, bad length %u > %u",
ulen, length);
Initial revision
1999-10-08 07:47:09 +08:00
else
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ND_PRINT("UDP, length %u", ulen);
Use the length field in the UDP header. If it's less than the length of the IP payload, use it as the size of the UDP packet. If it's greater than the length of the IP payload, and we're not dissecting the payload, report the length as bad.
2014-10-20 04:42:00 +08:00
}
CVE-2016-7934,7935,7937/RTP: Fix two segmentation faults Add two test files for these fixes. Add more bounds checks in VAT, RTP and RTCP printers. Moreover: Add and use *_tstr[] strings. Update the output of a test accordingly. Remove spaces before tabs.
2015-11-18 00:12:22 +08:00
return;
UDP: Modernize packet parsing style. Remove all ND_TCHECK_*() instances as redundant. Remove or convert a few improvised snapshot end guards. Reduce arity of rtcp_print(). Test the AppleTalk LAP type after testing the UDP port numbers, not before.
2021-01-12 23:52:23 +08:00
invalid:
nd_print_invalid(ndo);
Initial revision
1999-10-08 07:47:09 +08:00
}
Reference in New Issue Copy Permalink