mirrors/tcpdump
0
0
Fork 0
mirror of https://github.com/the-tcpdump-group/tcpdump.git synced 2024-11-24 02:23:27 +08:00
Code Issues Packages Projects Releases Wiki Activity
c695e7fee4
tcpdump/print-tcp.c

819 lines
28 KiB
C
Raw Normal View History

Patches from NetBSD tree.
2007-08-29 10:31:44 +08:00
/* $NetBSD: print-tcp.c,v 1.9 2007/07/26 18:15:12 plunky Exp $ */
Initial revision
1999-10-08 07:47:09 +08:00
/*
* Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997
* The Regents of the University of California. All rights reserved.
*
tweaked copyright.
2005-04-07 02:53:56 +08:00
* Copyright (c) 1999-2004 The tcpdump.org project
*
Initial revision
1999-10-08 07:47:09 +08:00
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that: (1) source code distributions
* retain the above copyright notice and this paragraph in its entirety, (2)
* distributions including binary code include the above copyright notice and
* this paragraph in its entirety in the documentation or other materials
* provided with the distribution, and (3) all advertising materials mentioning
* features or use of this software display the following acknowledgement:
* ``This product includes software developed by the University of California,
* Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
* the University nor the names of its contributors may be used to endorse
* or promote products derived from this software without specific prior
* written permission.
* THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
* WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
*/
Have the configure script arrange that the Makefile define _U_ appropriately, and that GNUmakefile and the MSVC++ project file define it apppriately, as we do with libpcap, rather than defining it in "interface.h". Undo the rcsid-shuffling and addition of extra #includes, as we no longer need to arrange that "interface.h" be included before using _U_ in an RCS ID or copyright.
2003-11-16 17:36:07 +08:00
#ifndef lint
static const char rcsid[] _U_ =
Add more bounds checks to the NFS dissector - check before references to items in the RPC header. When dissecting NFS over TCP, fetch the fragment header length, use it to limit the dissection of the request or reply (in case there's more than one request or reply in the packet), and do the same direction-plus-port checks that are done for NFS over UDP. Also eliminate the bounds check for the RPC header in the TCP dissector code, and do checks for the fields it looks at (other checks are done by the NFS dissector).
2007-12-22 11:08:04 +08:00
"@(#) $Header: /tcpdump/master/tcpdump/print-tcp.c,v 1.133 2007-12-22 03:08:04 guy Exp $ (LBL)";
Patches from NetBSD tree.
2007-08-29 10:31:44 +08:00
#else
__RCSID("$NetBSD: print-tcp.c,v 1.8 2007/07/24 11:53:48 drochner Exp $");
Have the configure script arrange that the Makefile define _U_ appropriately, and that GNUmakefile and the MSVC++ project file define it apppriately, as we do with libpcap, rather than defining it in "interface.h". Undo the rcsid-shuffling and addition of extra #includes, as we no longer need to arrange that "interface.h" be included before using _U_ in an RCS ID or copyright.
2003-11-16 17:36:07 +08:00
#endif
Switch to config.h instead of passing defines in DEFS.
1999-11-21 17:36:43 +08:00
#ifdef HAVE_CONFIG_H
#include "config.h"
Initial revision
1999-10-08 07:47:09 +08:00
#endif
Added support for Win32, based on WinPcap.
2002-08-01 16:52:55 +08:00
#include <tcpdump-stdinc.h>
Initial revision
1999-10-08 07:47:09 +08:00
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include "interface.h"
#include "addrtoname.h"
#include "extract.h"
Add "tcp.h" and "udp.h" headers, to declare the TCP and UDP stuff needed by dissectors, and have dissectors include them rather than <netinet/udp.h>, <netinet/udp_var.h>, or <netinet/tcp.h>, if they actually need that stuff. Remove all unnecessary includes of <netinet/udp*.h> or <netinet/tcp*.h> files.
2000-09-23 16:26:30 +08:00
#include "tcp.h"
Add an "ip.h" header, to declare the IP stuff needed by dissectors, and have dissectors include them rather than <netinet/ip.h> or <netinet/ip_var.h>, if they actually need that stuff. Put the declarations of the ICMP stuff directly into "print-icmp.c". Remove all unnecessary includes of <netinet/ip*.h> files. Copy the byte-order stuff from "nameser.h" into "tcp.h".
2000-09-23 16:54:24 +08:00
#include "ip.h"
put stripped-down version of ip6.h and icmp6.h into tcpdump tree. ip6.h is almost normal RFC2292 header. icmp6.h has couple of extensions (not covered by RFC2292), like MLD, ICMPv6 nodeinfo, and router renumber. XXX how to synchronize with future kame changes?
2000-10-07 13:53:09 +08:00
#ifdef INET6
#include "ip6.h"
#endif
Add a new "ipproto.h" header file, with definitions of IP protocol type values. Use that rather than private definitions in various files. Add "gmpls.h" to the list of files in FILES, and add it and "ipfc.h" to the list of files in INSTALL.
2003-06-07 19:57:51 +08:00
#include "ipproto.h"
Have our own headers to declare the format of ONC (Sun) RPC messages on the wire; the definitions in many systems use u_long, which is 64 bits long on many platforms - that's OK for in-memory structures, but it doesn't match what's on the wire. Use headers based on the Sun ones, but use u_int32_t for fields, and otherwise make the structures match what's on the wire, and change some names to avoid collision with <rpc/rpc.h>, which print-sunrpc.c includes to declare "getrpcbynumber()" and the structure it returns. Record whether "getrpcbynumber()" is found, and use it only if it's found, rather than basing the decisison on whether we're building for Win32 or not.
2004-12-27 08:41:29 +08:00
#include "rpc_auth.h"
#include "rpc_msg.h"
Add an "ip.h" header, to declare the IP stuff needed by dissectors, and have dissectors include them rather than <netinet/ip.h> or <netinet/ip_var.h>, if they actually need that stuff. Put the declarations of the ICMP stuff directly into "print-icmp.c". Remove all unnecessary includes of <netinet/ip*.h> files. Copy the byte-order stuff from "nameser.h" into "tcp.h".
2000-09-23 16:54:24 +08:00
decode DNS over TCP
2001-02-03 13:04:49 +08:00
#include "nameser.h"
From Bruce M. Simpson: add a "-M" flag to specify a shared secret for TCP-MD5 (RFC 2385) digest verification if we have libcrypto.
2004-03-23 15:15:36 +08:00
#ifdef HAVE_LIBCRYPTO
#include <openssl/md5.h>
In "tcp_verify_signature()", don't assume we can do IPv6, and distinguish between "signature invalid" and "we can't check the signature". Have its caller show the raw signature if we can't check it.
2004-09-15 09:21:17 +08:00
#define SIGNATURE_VALID 0
#define SIGNATURE_INVALID 1
#define CANT_CHECK_SIGNATURE 2
get rid of warning in print-tcp.c about const violations. the signature checker was writing over a structure that should not have been modified - change the code to make a copy instead.
2004-04-05 08:12:54 +08:00
static int tcp_verify_signature(const struct ip *ip, const struct tcphdr *tp,
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
const u_char *data, int length, const u_char *rcvsig);
From Bruce M. Simpson: add a "-M" flag to specify a shared secret for TCP-MD5 (RFC 2385) digest verification if we have libcrypto.
2004-03-23 15:15:36 +08:00
#endif
Changes from Kevin Steves to print, in an RST segment, the payload as text, as per RFC 1122: 4.2.2.12 RST Segment: RFC-793 Section 3.4 A TCP SHOULD allow a received RST segment to include data. DISCUSSION It has been suggested that a RST segment could contain ASCII text that encoded and explained the cause of the RST. No standard has yet been established for such data. as some TCP implementations (e.g., HP-UX 11.0) do that. Clean up the code that prints the payload of non-RST segments.
2000-07-29 17:06:23 +08:00
static void print_tcp_rst_data(register const u_char *sp, u_int length);
#define MAX_RST_DATA_LEN 30
cast result from ntohl() with u_int32_t, some platforms still mistakingly use u_long for it. use u_int{16,32}_t. ECN support improvement (from net/openbsd).
2000-04-27 19:09:08 +08:00
Initial revision
1999-10-08 07:47:09 +08:00
struct tha {
Bring in KAME IPv6 tcpdump. replaces esp/ah/isakmp decoder. Hope I did not break anything. Portability on IPv4-only node needs checking, I'll do this very soon. (sorry for rather jumbo commit) XXx what is _FAVOR_BSD?
1999-10-30 13:11:06 +08:00
#ifndef INET6
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
struct in_addr src;
struct in_addr dst;
Bring in KAME IPv6 tcpdump. replaces esp/ah/isakmp decoder. Hope I did not break anything. Portability on IPv4-only node needs checking, I'll do this very soon. (sorry for rather jumbo commit) XXx what is _FAVOR_BSD?
1999-10-30 13:11:06 +08:00
#else
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
struct in6_addr src;
struct in6_addr dst;
Bring in KAME IPv6 tcpdump. replaces esp/ah/isakmp decoder. Hope I did not break anything. Portability on IPv4-only node needs checking, I'll do this very soon. (sorry for rather jumbo commit) XXx what is _FAVOR_BSD?
1999-10-30 13:11:06 +08:00
#endif /*INET6*/
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
u_int port;
Initial revision
1999-10-08 07:47:09 +08:00
};
struct tcp_seq_hash {
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
struct tcp_seq_hash *nxt;
struct tha addr;
tcp_seq seq;
tcp_seq ack;
Initial revision
1999-10-08 07:47:09 +08:00
};
#define TSEQ_HASHSIZE 919
/* These tcp optinos do not have the size octet */
#define ZEROLENOPT(o) ((o) == TCPOPT_EOL || (o) == TCPOPT_NOP)
static struct tcp_seq_hash tcp_seq_hash[TSEQ_HASHSIZE];
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
struct tok tcp_flag_values[] = {
{ TH_FIN, "F" },
{ TH_SYN, "S" },
{ TH_RST, "R" },
{ TH_PUSH, "P" },
{ TH_ACK, "." },
{ TH_URG, "U" },
{ TH_ECNECHO, "E" },
{ TH_CWR, "W" },
{ 0, NULL }
};
Initial revision
1999-10-08 07:47:09 +08:00
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
struct tok tcp_option_values[] = {
{ TCPOPT_EOL, "eol" },
{ TCPOPT_NOP, "nop" },
{ TCPOPT_MAXSEG, "mss" },
{ TCPOPT_WSCALE, "wscale" },
{ TCPOPT_SACKOK, "sackOK" },
{ TCPOPT_SACK, "sack" },
{ TCPOPT_ECHO, "echo" },
{ TCPOPT_ECHOREPLY, "echoreply" },
{ TCPOPT_TIMESTAMP, "TS" },
{ TCPOPT_CC, "cc" },
{ TCPOPT_CCNEW, "ccnew" },
{ TCPOPT_CCECHO, "" },
{ TCPOPT_SIGNATURE, "md5" },
{ TCPOPT_AUTH, "enhanced auth" },
{ 0, NULL }
};
patches from Andrew Tridgell <tridge@linuxcare.com> to add decoding of SMB packets
1999-11-21 23:57:50 +08:00
tcp checksum. requested from darren reed. code from netbsd.
2000-08-02 01:28:09 +08:00
static int tcp_cksum(register const struct ip *ip,
register const struct tcphdr *tp,
Cut off "snapend" at the length of the IPv4 or IPv6 payload, so we don't run past the end of that payload. Check that the IPv4 total length isn't less than the header length. Use "%u", not "%d", to print unsigned values. Properly update "len" in the header-processing loop for IPv6. Doing so means we can trust the length passed to the TCP and UDP dissectors when constructing the IPv6 pseudo-header; do so (but fix the length we pass to the UDP-over-IPv6 checksum routine). That length is unsigned; make the corresponding arguments to the TCP and UDP checksum routines unsigned.
2003-11-19 08:17:32 +08:00
register u_int len)
tcp checksum. requested from darren reed. code from netbsd.
2000-08-02 01:28:09 +08:00
{
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
union phu {
struct phdr {
u_int32_t src;
u_int32_t dst;
u_char mbz;
u_char proto;
u_int16_t len;
} ph;
u_int16_t pa[6];
} phu;
const u_int16_t *sp;
/* pseudo-header.. */
phu.ph.len = htons((u_int16_t)len);
phu.ph.mbz = 0;
phu.ph.proto = IPPROTO_TCP;
memcpy(&phu.ph.src, &ip->ip_src.s_addr, sizeof(u_int32_t));
if (IP_HL(ip) == 5)
memcpy(&phu.ph.dst, &ip->ip_dst.s_addr, sizeof(u_int32_t));
else
phu.ph.dst = ip_finddst(ip);
sp = &phu.pa[0];
return in_cksum((u_short *)tp, len,
sp[0]+sp[1]+sp[2]+sp[3]+sp[4]+sp[5]);
tcp checksum. requested from darren reed. code from netbsd.
2000-08-02 01:28:09 +08:00
}
#ifdef INET6
static int tcp6_cksum(const struct ip6_hdr *ip6, const struct tcphdr *tp,
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
u_int len)
tcp checksum. requested from darren reed. code from netbsd.
2000-08-02 01:28:09 +08:00
{
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
size_t i;
u_int32_t sum = 0;
union {
struct {
struct in6_addr ph_src;
struct in6_addr ph_dst;
u_int32_t ph_len;
u_int8_t ph_zero[3];
u_int8_t ph_nxt;
} ph;
u_int16_t pa[20];
} phu;
/* pseudo-header */
memset(&phu, 0, sizeof(phu));
phu.ph.ph_src = ip6->ip6_src;
phu.ph.ph_dst = ip6->ip6_dst;
phu.ph.ph_len = htonl(len);
phu.ph.ph_nxt = IPPROTO_TCP;
for (i = 0; i < sizeof(phu.pa) / sizeof(phu.pa[0]); i++)
sum += phu.pa[i];
return in_cksum((u_short *)tp, len, sum);
tcp checksum. requested from darren reed. code from netbsd.
2000-08-02 01:28:09 +08:00
}
#endif
Initial revision
1999-10-08 07:47:09 +08:00
void
tcp_print(register const u_char *bp, register u_int length,
do not try to compute tcp/udp checksum for fragmented datagram. from: jinmei@kame.net
2000-11-18 03:08:14 +08:00
register const u_char *bp2, int fragmented)
Initial revision
1999-10-08 07:47:09 +08:00
{
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
register const struct tcphdr *tp;
register const struct ip *ip;
register u_char flags;
register u_int hlen;
register char ch;
u_int16_t sport, dport, win, urp;
u_int32_t seq, ack, thseq, thack;
int threv;
Bring in KAME IPv6 tcpdump. replaces esp/ah/isakmp decoder. Hope I did not break anything. Portability on IPv4-only node needs checking, I'll do this very soon. (sorry for rather jumbo commit) XXx what is _FAVOR_BSD?
1999-10-30 13:11:06 +08:00
#ifdef INET6
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
register const struct ip6_hdr *ip6;
Bring in KAME IPv6 tcpdump. replaces esp/ah/isakmp decoder. Hope I did not break anything. Portability on IPv4-only node needs checking, I'll do this very soon. (sorry for rather jumbo commit) XXx what is _FAVOR_BSD?
1999-10-30 13:11:06 +08:00
#endif
Initial revision
1999-10-08 07:47:09 +08:00
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
tp = (struct tcphdr *)bp;
ip = (struct ip *)bp2;
Bring in KAME IPv6 tcpdump. replaces esp/ah/isakmp decoder. Hope I did not break anything. Portability on IPv4-only node needs checking, I'll do this very soon. (sorry for rather jumbo commit) XXx what is _FAVOR_BSD?
1999-10-30 13:11:06 +08:00
#ifdef INET6
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
if (IP_V(ip) == 6)
ip6 = (struct ip6_hdr *)bp2;
else
ip6 = NULL;
Bring in KAME IPv6 tcpdump. replaces esp/ah/isakmp decoder. Hope I did not break anything. Portability on IPv4-only node needs checking, I'll do this very soon. (sorry for rather jumbo commit) XXx what is _FAVOR_BSD?
1999-10-30 13:11:06 +08:00
#endif /*INET6*/
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
ch = '\0';
if (!TTEST(tp->th_dport)) {
(void)printf("%s > %s: [|tcp]",
ipaddr_string(&ip->ip_src),
ipaddr_string(&ip->ip_dst));
return;
}
sport = EXTRACT_16BITS(&tp->th_sport);
dport = EXTRACT_16BITS(&tp->th_dport);
hlen = TH_OFF(tp) * 4;
/*
Add more bounds checks to the NFS dissector - check before references to items in the RPC header. When dissecting NFS over TCP, fetch the fragment header length, use it to limit the dissection of the request or reply (in case there's more than one request or reply in the packet), and do the same direction-plus-port checks that are done for NFS over UDP. Also eliminate the bounds check for the RPC header in the TCP dissector code, and do checks for the fields it looks at (other checks are done by the NFS dissector).
2007-12-22 11:08:04 +08:00
* If data present, header length valid, and NFS port used,
* assume NFS.
* Pass offset of data plus 4 bytes for RPC TCP msg length
* to NFS print routines.
*/
if (!qflag && hlen >= sizeof(*tp) && hlen <= length &&
(length - hlen) >= 4) {
u_char *fraglenp;
u_int32_t fraglen;
register struct sunrpc_msg *rp;
enum sunrpc_msg_type direction;
fraglenp = (u_char *)tp + hlen;
if (TTEST2(*fraglenp, 4)) {
fraglen = EXTRACT_32BITS(fraglenp) & 0x7FFFFFFF;
if (fraglen > (length - hlen) - 4)
fraglen = (length - hlen) - 4;
rp = (struct sunrpc_msg *)(fraglenp + 4);
if (TTEST(rp->rm_direction)) {
direction = (enum sunrpc_msg_type)EXTRACT_32BITS(&rp->rm_direction);
if (dport == NFS_PORT &&
direction == SUNRPC_CALL) {
nfsreq_print((u_char *)rp, fraglen,
(u_char *)ip);
return;
}
if (sport == NFS_PORT &&
direction == SUNRPC_REPLY) {
nfsreply_print((u_char *)rp, fraglen,
(u_char *)ip);
return;
}
}
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
}
}
Bring in KAME IPv6 tcpdump. replaces esp/ah/isakmp decoder. Hope I did not break anything. Portability on IPv4-only node needs checking, I'll do this very soon. (sorry for rather jumbo commit) XXx what is _FAVOR_BSD?
1999-10-30 13:11:06 +08:00
#ifdef INET6
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
if (ip6) {
if (ip6->ip6_nxt == IPPROTO_TCP) {
(void)printf("%s.%s > %s.%s: ",
ip6addr_string(&ip6->ip6_src),
tcpport_string(sport),
ip6addr_string(&ip6->ip6_dst),
tcpport_string(dport));
} else {
(void)printf("%s > %s: ",
tcpport_string(sport), tcpport_string(dport));
}
} else
Bring in KAME IPv6 tcpdump. replaces esp/ah/isakmp decoder. Hope I did not break anything. Portability on IPv4-only node needs checking, I'll do this very soon. (sorry for rather jumbo commit) XXx what is _FAVOR_BSD?
1999-10-30 13:11:06 +08:00
#endif /*INET6*/
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
{
if (ip->ip_p == IPPROTO_TCP) {
(void)printf("%s.%s > %s.%s: ",
ipaddr_string(&ip->ip_src),
tcpport_string(sport),
ipaddr_string(&ip->ip_dst),
tcpport_string(dport));
} else {
(void)printf("%s > %s: ",
tcpport_string(sport), tcpport_string(dport));
}
}
if (hlen < sizeof(*tp)) {
(void)printf(" tcp %d [bad hdr length %u - too short, < %lu]",
length - hlen, hlen, (unsigned long)sizeof(*tp));
return;
}
TCHECK(*tp);
seq = EXTRACT_32BITS(&tp->th_seq);
ack = EXTRACT_32BITS(&tp->th_ack);
win = EXTRACT_16BITS(&tp->th_win);
urp = EXTRACT_16BITS(&tp->th_urp);
if (qflag) {
(void)printf("tcp %d", length - hlen);
if (hlen > length) {
(void)printf(" [bad hdr length %u - too long, > %u]",
hlen, length);
}
return;
}
flags = tp->th_flags;
printf("Flags [%s]", bittok2str_nosep(tcp_flag_values, "none", flags));
if (!Sflag && (flags & TH_ACK)) {
register struct tcp_seq_hash *th;
const void *src, *dst;
register int rev;
struct tha tha;
/*
* Find (or record) the initial sequence numbers for
* this conversation. (we pick an arbitrary
* collating order so there's only one entry for
* both directions).
*/
Bring in KAME IPv6 tcpdump. replaces esp/ah/isakmp decoder. Hope I did not break anything. Portability on IPv4-only node needs checking, I'll do this very soon. (sorry for rather jumbo commit) XXx what is _FAVOR_BSD?
1999-10-30 13:11:06 +08:00
#ifdef INET6
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
memset(&tha, 0, sizeof(tha));
rev = 0;
if (ip6) {
src = &ip6->ip6_src;
dst = &ip6->ip6_dst;
if (sport > dport)
rev = 1;
else if (sport == dport) {
if (memcmp(src, dst, sizeof ip6->ip6_dst) > 0)
rev = 1;
}
if (rev) {
memcpy(&tha.src, dst, sizeof ip6->ip6_dst);
memcpy(&tha.dst, src, sizeof ip6->ip6_src);
tha.port = dport << 16 | sport;
} else {
memcpy(&tha.dst, dst, sizeof ip6->ip6_dst);
memcpy(&tha.src, src, sizeof ip6->ip6_src);
tha.port = sport << 16 | dport;
}
} else {
src = &ip->ip_src;
dst = &ip->ip_dst;
if (sport > dport)
rev = 1;
else if (sport == dport) {
if (memcmp(src, dst, sizeof ip->ip_dst) > 0)
rev = 1;
}
if (rev) {
memcpy(&tha.src, dst, sizeof ip->ip_dst);
memcpy(&tha.dst, src, sizeof ip->ip_src);
tha.port = dport << 16 | sport;
} else {
memcpy(&tha.dst, dst, sizeof ip->ip_dst);
memcpy(&tha.src, src, sizeof ip->ip_src);
tha.port = sport << 16 | dport;
}
}
Bring in KAME IPv6 tcpdump. replaces esp/ah/isakmp decoder. Hope I did not break anything. Portability on IPv4-only node needs checking, I'll do this very soon. (sorry for rather jumbo commit) XXx what is _FAVOR_BSD?
1999-10-30 13:11:06 +08:00
#else
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
rev = 0;
src = &ip->ip_src;
dst = &ip->ip_dst;
if (sport > dport)
rev = 1;
else if (sport == dport) {
if (memcmp(src, dst, sizeof ip->ip_dst) > 0)
rev = 1;
}
if (rev) {
memcpy(&tha.src, dst, sizeof ip->ip_dst);
memcpy(&tha.dst, src, sizeof ip->ip_src);
tha.port = dport << 16 | sport;
} else {
memcpy(&tha.dst, dst, sizeof ip->ip_dst);
memcpy(&tha.src, src, sizeof ip->ip_src);
tha.port = sport << 16 | dport;
}
Bring in KAME IPv6 tcpdump. replaces esp/ah/isakmp decoder. Hope I did not break anything. Portability on IPv4-only node needs checking, I'll do this very soon. (sorry for rather jumbo commit) XXx what is _FAVOR_BSD?
1999-10-30 13:11:06 +08:00
#endif
Initial revision
1999-10-08 07:47:09 +08:00
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
threv = rev;
for (th = &tcp_seq_hash[tha.port % TSEQ_HASHSIZE];
th->nxt; th = th->nxt)
if (memcmp((char *)&tha, (char *)&th->addr,
sizeof(th->addr)) == 0)
break;
if (!th->nxt || (flags & TH_SYN)) {
/* didn't find it or new conversation */
if (th->nxt == NULL) {
th->nxt = (struct tcp_seq_hash *)
calloc(1, sizeof(*th));
if (th->nxt == NULL)
error("tcp_print: calloc");
}
th->addr = tha;
if (rev)
th->ack = seq, th->seq = ack - 1;
else
th->seq = seq, th->ack = ack - 1;
} else {
if (rev)
seq -= th->ack, ack -= th->seq;
else
seq -= th->seq, ack -= th->ack;
}
thseq = th->seq;
thack = th->ack;
} else {
/*fool gcc*/
thseq = thack = threv = 0;
}
if (hlen > length) {
(void)printf(" [bad hdr length %u - too long, > %u]",
hlen, length);
return;
}
if (IP_V(ip) == 4 && vflag && !Kflag && !fragmented) {
u_int16_t sum, tcp_sum;
if (TTEST2(tp->th_sport, length)) {
sum = tcp_cksum(ip, tp, length);
display cosmetics: be more verbose on IP6 TCP checksum errors, align IP4,IP6 checksum printing
2004-04-25 01:19:00 +08:00
(void)printf(", cksum 0x%04x",EXTRACT_16BITS(&tp->th_sum));
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
if (sum != 0) {
tcp_sum = EXTRACT_16BITS(&tp->th_sum);
From Kevin Steves <stevesk@pobox.com>: remove extra comma after checksum verification print.
2007-01-30 03:19:51 +08:00
(void)printf(" (incorrect -> 0x%04x)",in_cksum_shouldbe(tcp_sum, sum));
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
} else
From Kevin Steves <stevesk@pobox.com>: remove extra comma after checksum verification print.
2007-01-30 03:19:51 +08:00
(void)printf(" (correct)");
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
}
}
tcp checksum. requested from darren reed. code from netbsd.
2000-08-02 01:28:09 +08:00
#ifdef INET6
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
if (IP_V(ip) == 6 && ip6->ip6_plen && vflag && !Kflag && !fragmented) {
u_int16_t sum,tcp_sum;
if (TTEST2(tp->th_sport, length)) {
sum = tcp6_cksum(ip6, tp, length);
display cosmetics: be more verbose on IP6 TCP checksum errors, align IP4,IP6 checksum printing
2004-04-25 01:19:00 +08:00
(void)printf(", cksum 0x%04x",EXTRACT_16BITS(&tp->th_sum));
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
if (sum != 0) {
tcp_sum = EXTRACT_16BITS(&tp->th_sum);
Fix typo in "incorrect checksum" message for IPv6.
2007-11-09 08:34:25 +08:00
(void)printf(" (incorrect -> 0x%04x)",in_cksum_shouldbe(tcp_sum, sum));
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
} else
From Kevin Steves <stevesk@pobox.com>: remove extra comma after checksum verification print.
2007-01-30 03:19:51 +08:00
(void)printf(" (correct)");
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
}
}
tcp checksum. requested from darren reed. code from netbsd.
2000-08-02 01:28:09 +08:00
#endif
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
length -= hlen;
if (vflag > 1 || flags & (TH_SYN | TH_FIN | TH_RST)) {
(void)printf(", seq %u", seq);
if (length > 0) {
(void)printf(":%u", seq + length);
}
}
if (flags & TH_ACK) {
(void)printf(", ack %u", ack);
}
(void)printf(", win %d", win);
if (flags & TH_URG)
(void)printf(", urg %d", urp);
/*
* Handle any options.
*/
if (hlen > sizeof(*tp)) {
register const u_char *cp;
register u_int i, opt, datalen;
register u_int len;
hlen -= sizeof(*tp);
cp = (const u_char *)tp + sizeof(*tp);
printf(", options [");
while (hlen > 0) {
From Alexander Dupuy: if the separator character is null, it means "no separator needed", so don't print it.
2007-04-04 04:02:56 +08:00
if (ch != '\0')
putchar(ch);
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
TCHECK(*cp);
opt = *cp++;
if (ZEROLENOPT(opt))
len = 1;
else {
TCHECK(*cp);
len = *cp++; /* total including type, len */
if (len < 2 || len > hlen)
goto bad;
--hlen; /* account for length byte */
}
--hlen; /* account for type byte */
datalen = 0;
Initial revision
1999-10-08 07:47:09 +08:00
/* Bail if "l" bytes of data are not left or were not captured */
#define LENCHECK(l) { if ((l) > hlen) goto bad; TCHECK2(*cp, l); }
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
printf("%s", tok2str(tcp_option_values, "Unknown Option %u", opt));
switch (opt) {
case TCPOPT_MAXSEG:
datalen = 2;
LENCHECK(datalen);
(void)printf(" %u", EXTRACT_16BITS(cp));
break;
case TCPOPT_WSCALE:
datalen = 1;
LENCHECK(datalen);
(void)printf(" %u", *cp);
break;
case TCPOPT_SACK:
datalen = len - 2;
if (datalen % 8 != 0) {
(void)printf("malformed sack");
} else {
u_int32_t s, e;
(void)printf(" %d ", datalen / 8);
for (i = 0; i < datalen; i += 8) {
LENCHECK(i + 4);
s = EXTRACT_32BITS(cp + i);
LENCHECK(i + 8);
e = EXTRACT_32BITS(cp + i + 4);
if (threv) {
s -= thseq;
e -= thseq;
} else {
s -= thack;
e -= thack;
}
(void)printf("{%u:%u}", s, e);
}
}
break;
case TCPOPT_CC:
case TCPOPT_CCNEW:
case TCPOPT_CCECHO:
case TCPOPT_ECHO:
case TCPOPT_ECHOREPLY:
/*
* those options share their semantics.
* fall through
*/
datalen = 4;
LENCHECK(datalen);
(void)printf(" %u", EXTRACT_32BITS(cp));
break;
case TCPOPT_TIMESTAMP:
datalen = 8;
LENCHECK(datalen);
(void)printf(" val %u ecr %u",
EXTRACT_32BITS(cp),
EXTRACT_32BITS(cp + 4));
break;
case TCPOPT_SIGNATURE:
datalen = TCP_SIGLEN;
LENCHECK(datalen);
From Bruce M. Simpson: add a "-M" flag to specify a shared secret for TCP-MD5 (RFC 2385) digest verification if we have libcrypto.
2004-03-23 15:15:36 +08:00
#ifdef HAVE_LIBCRYPTO
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
switch (tcp_verify_signature(ip, tp,
bp + TH_OFF(tp) * 4, length, cp)) {
case SIGNATURE_VALID:
(void)printf("valid");
break;
case SIGNATURE_INVALID:
(void)printf("invalid");
break;
case CANT_CHECK_SIGNATURE:
(void)printf("can't check - ");
for (i = 0; i < TCP_SIGLEN; ++i)
(void)printf("%02x", cp[i]);
break;
}
From Bruce M. Simpson: add a "-M" flag to specify a shared secret for TCP-MD5 (RFC 2385) digest verification if we have libcrypto.
2004-03-23 15:15:36 +08:00
#else
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
for (i = 0; i < TCP_SIGLEN; ++i)
(void)printf("%02x", cp[i]);
From Bruce M. Simpson: add a "-M" flag to specify a shared secret for TCP-MD5 (RFC 2385) digest verification if we have libcrypto.
2004-03-23 15:15:36 +08:00
#endif
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
break;
From Bruce M. Simpson: add a "-M" flag to specify a shared secret for TCP-MD5 (RFC 2385) digest verification if we have libcrypto.
2004-03-23 15:15:36 +08:00
add basic support for keyed authentication TCP option
2005-11-29 17:07:47 +08:00
case TCPOPT_AUTH:
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
(void)printf("keyid %d", *cp++);
add basic support for keyed authentication TCP option
2005-11-29 17:07:47 +08:00
datalen = len - 3;
for (i = 0; i < datalen; ++i) {
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
LENCHECK(i);
(void)printf("%02x", cp[i]);
add basic support for keyed authentication TCP option
2005-11-29 17:07:47 +08:00
}
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
break;
case TCPOPT_EOL:
case TCPOPT_NOP:
case TCPOPT_SACKOK:
/*
* Nothing interesting.
* fall through
*/
break;
default:
datalen = len - 2;
for (i = 0; i < datalen; ++i) {
LENCHECK(i);
(void)printf("%02x", cp[i]);
}
break;
}
/* Account for data printed */
cp += datalen;
hlen -= datalen;
/* Check specification against observed length */
++datalen; /* option octet */
if (!ZEROLENOPT(opt))
++datalen; /* size octet */
if (datalen != len)
(void)printf("[len %d]", len);
ch = ',';
if (opt == TCPOPT_EOL)
break;
}
putchar(']');
}
/*
* Print length field before crawling down the stack.
*/
printf(", length %u", length);
if (length <= 0)
return;
/*
* Decode payload if necessary.
*/
bp += TH_OFF(tp) * 4;
if ((flags & TH_RST) && vflag) {
print_tcp_rst_data(bp, length);
return;
}
if (sport == TELNET_PORT || dport == TELNET_PORT) {
if (!qflag && vflag)
telnet_print(bp, length);
} else if (sport == BGP_PORT || dport == BGP_PORT)
bgp_print(bp, length);
else if (sport == PPTP_PORT || dport == PPTP_PORT)
pptp_print(bp);
Add --enable-smb to make it easier to re-enable the SMB printer.
2001-10-09 05:25:15 +08:00
#ifdef TCPDUMP_DO_SMB
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
else if (sport == NETBIOS_SSN_PORT || dport == NETBIOS_SSN_PORT)
nbt_tcp_print(bp, length);
SMB-over-TCP (port 445) support.
2007-12-09 08:30:47 +08:00
else if (sport == SMB_PORT || dport == SMB_PORT)
smb_tcp_print(bp, length);
disable smb printing until we have boundary checks in *smb*.c (there's almost no boundary check).
2001-10-04 17:18:45 +08:00
#endif
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
else if (sport == BEEP_PORT || dport == BEEP_PORT)
beep_print(bp, length);
else if (length > 2 &&
(sport == NAMESERVER_PORT || dport == NAMESERVER_PORT ||
sport == MULTICASTDNS_PORT || dport == MULTICASTDNS_PORT)) {
/*
* TCP DNS query has 2byte length at the head.
* XXX packet could be unaligned, it can go strange
*/
ns_print(bp + 2, length - 2, 0);
} else if (sport == MSDP_PORT || dport == MSDP_PORT) {
msdp_print(bp, length);
}
else if (length > 0 && (sport == LDP_PORT || dport == LDP_PORT)) {
ldp_print(bp, length);
}
return;
bad:
fputs("[bad opt]", stdout);
if (ch != '\0')
putchar('>');
return;
trunc:
fputs("[|tcp]", stdout);
if (ch != '\0')
putchar('>');
Initial revision
1999-10-08 07:47:09 +08:00
}
Changes from Kevin Steves to print, in an RST segment, the payload as text, as per RFC 1122: 4.2.2.12 RST Segment: RFC-793 Section 3.4 A TCP SHOULD allow a received RST segment to include data. DISCUSSION It has been suggested that a RST segment could contain ASCII text that encoded and explained the cause of the RST. No standard has yet been established for such data. as some TCP implementations (e.g., HP-UX 11.0) do that. Clean up the code that prints the payload of non-RST segments.
2000-07-29 17:06:23 +08:00
/*
* RFC1122 says the following on data in RST segments:
*
* 4.2.2.12 RST Segment: RFC-793 Section 3.4
*
* A TCP SHOULD allow a received RST segment to include data.
*
* DISCUSSION
* It has been suggested that a RST segment could contain
* ASCII text that encoded and explained the cause of the
* RST. No standard has yet been established for such
* data.
*
*/
static void
print_tcp_rst_data(register const u_char *sp, u_int length)
{
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
int c;
if (TTEST2(*sp, length))
printf(" [RST");
else
printf(" [!RST");
if (length > MAX_RST_DATA_LEN) {
length = MAX_RST_DATA_LEN; /* can use -X for longer */
putchar('+'); /* indicate we truncate */
}
putchar(' ');
while (length-- && sp <= snapend) {
c = *sp++;
safeputchar(c);
}
putchar(']');
Changes from Kevin Steves to print, in an RST segment, the payload as text, as per RFC 1122: 4.2.2.12 RST Segment: RFC-793 Section 3.4 A TCP SHOULD allow a received RST segment to include data. DISCUSSION It has been suggested that a RST segment could contain ASCII text that encoded and explained the cause of the RST. No standard has yet been established for such data. as some TCP implementations (e.g., HP-UX 11.0) do that. Clean up the code that prints the payload of non-RST segments.
2000-07-29 17:06:23 +08:00
}
From Bruce M. Simpson: add a "-M" flag to specify a shared secret for TCP-MD5 (RFC 2385) digest verification if we have libcrypto.
2004-03-23 15:15:36 +08:00
#ifdef HAVE_LIBCRYPTO
static int
get rid of warning in print-tcp.c about const violations. the signature checker was writing over a structure that should not have been modified - change the code to make a copy instead.
2004-04-05 08:12:54 +08:00
tcp_verify_signature(const struct ip *ip, const struct tcphdr *tp,
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
const u_char *data, int length, const u_char *rcvsig)
From Bruce M. Simpson: add a "-M" flag to specify a shared secret for TCP-MD5 (RFC 2385) digest verification if we have libcrypto.
2004-03-23 15:15:36 +08:00
{
get rid of warning in print-tcp.c about const violations. the signature checker was writing over a structure that should not have been modified - change the code to make a copy instead.
2004-04-05 08:12:54 +08:00
struct tcphdr tp1;
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
u_char sig[TCP_SIGLEN];
char zero_proto = 0;
MD5_CTX ctx;
u_int16_t savecsum, tlen;
In "tcp_verify_signature()", don't assume we can do IPv6, and distinguish between "signature invalid" and "we can't check the signature". Have its caller show the raw signature if we can't check it.
2004-09-15 09:21:17 +08:00
#ifdef INET6
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
struct ip6_hdr *ip6;
u_int32_t len32;
u_int8_t nxt;
Patches from NetBSD tree.
2007-08-29 10:31:44 +08:00
#endif
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
tp1 = *tp;
if (tcpmd5secret == NULL)
return (CANT_CHECK_SIGNATURE);
MD5_Init(&ctx);
/*
* Step 1: Update MD5 hash with IP pseudo-header.
*/
if (IP_V(ip) == 4) {
MD5_Update(&ctx, (char *)&ip->ip_src, sizeof(ip->ip_src));
MD5_Update(&ctx, (char *)&ip->ip_dst, sizeof(ip->ip_dst));
MD5_Update(&ctx, (char *)&zero_proto, sizeof(zero_proto));
MD5_Update(&ctx, (char *)&ip->ip_p, sizeof(ip->ip_p));
tlen = EXTRACT_16BITS(&ip->ip_len) - IP_HL(ip) * 4;
tlen = htons(tlen);
MD5_Update(&ctx, (char *)&tlen, sizeof(tlen));
In "tcp_verify_signature()", don't assume we can do IPv6, and distinguish between "signature invalid" and "we can't check the signature". Have its caller show the raw signature if we can't check it.
2004-09-15 09:21:17 +08:00
#ifdef INET6
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
} else if (IP_V(ip) == 6) {
ip6 = (struct ip6_hdr *)ip;
MD5_Update(&ctx, (char *)&ip6->ip6_src, sizeof(ip6->ip6_src));
MD5_Update(&ctx, (char *)&ip6->ip6_dst, sizeof(ip6->ip6_dst));
len32 = htonl(ntohs(ip6->ip6_plen));
MD5_Update(&ctx, (char *)&len32, sizeof(len32));
nxt = 0;
MD5_Update(&ctx, (char *)&nxt, sizeof(nxt));
MD5_Update(&ctx, (char *)&nxt, sizeof(nxt));
MD5_Update(&ctx, (char *)&nxt, sizeof(nxt));
nxt = IPPROTO_TCP;
MD5_Update(&ctx, (char *)&nxt, sizeof(nxt));
In "tcp_verify_signature()", don't assume we can do IPv6, and distinguish between "signature invalid" and "we can't check the signature". Have its caller show the raw signature if we can't check it.
2004-09-15 09:21:17 +08:00
#endif
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
} else
return (CANT_CHECK_SIGNATURE);
/*
* Step 2: Update MD5 hash with TCP header, excluding options.
* The TCP checksum must be set to zero.
*/
savecsum = tp1.th_sum;
tp1.th_sum = 0;
MD5_Update(&ctx, (char *)&tp1, sizeof(struct tcphdr));
tp1.th_sum = savecsum;
/*
* Step 3: Update MD5 hash with TCP segment data, if present.
*/
if (length > 0)
MD5_Update(&ctx, data, length);
/*
* Step 4: Update MD5 hash with shared secret.
*/
MD5_Update(&ctx, tcpmd5secret, strlen(tcpmd5secret));
MD5_Final(sig, &ctx);
if (memcmp(rcvsig, sig, TCP_SIGLEN) == 0)
return (SIGNATURE_VALID);
else
return (SIGNATURE_INVALID);
From Bruce M. Simpson: add a "-M" flag to specify a shared secret for TCP-MD5 (RFC 2385) digest verification if we have libcrypto.
2004-03-23 15:15:36 +08:00
}
#endif /* HAVE_LIBCRYPTO */
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
/*
* Local Variables:
* c-style: whitesmith
* c-basic-offset: 8
* End:
*/
Reference in New Issue Copy Permalink