mirrors/tcpdump
0
0
Fork 0
mirror of https://github.com/the-tcpdump-group/tcpdump.git synced 2024-11-24 02:23:27 +08:00
Code Issues Packages Projects Releases Wiki Activity
e55b187600
tcpdump/print-tcp.c

968 lines
38 KiB
C
Raw Normal View History

Patches from NetBSD tree.
2007-08-29 10:31:44 +08:00
/* $NetBSD: print-tcp.c,v 1.9 2007/07/26 18:15:12 plunky Exp $ */
Initial revision
1999-10-08 07:47:09 +08:00
/*
* Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997
* The Regents of the University of California. All rights reserved.
*
tweaked copyright.
2005-04-07 02:53:56 +08:00
* Copyright (c) 1999-2004 The tcpdump.org project
*
Initial revision
1999-10-08 07:47:09 +08:00
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that: (1) source code distributions
* retain the above copyright notice and this paragraph in its entirety, (2)
* distributions including binary code include the above copyright notice and
* this paragraph in its entirety in the documentation or other materials
* provided with the distribution, and (3) all advertising materials mentioning
* features or use of this software display the following acknowledgement:
* ``This product includes software developed by the University of California,
* Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
* the University nor the names of its contributors may be used to endorse
* or promote products derived from this software without specific prior
* written permission.
* THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
* WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
*/
Move the printer summaries from INSTALL.txt to each printer with the tag '\summary:' for greping. Remark: Currently some printers have no summary line. Moreover: Summarize all printers with a single line in INSTALL.txt
2016-08-14 21:42:19 +08:00
/* \summary: TCP printer */
Have the configure script arrange that the Makefile define _U_ appropriately, and that GNUmakefile and the MSVC++ project file define it apppriately, as we do with libpcap, rather than defining it in "interface.h". Undo the rcsid-shuffling and addition of extra #includes, as we no longer need to arrange that "interface.h" be included before using _U_ in an RCS ID or copyright.
2003-11-16 17:36:07 +08:00
#ifndef lint
pulled up some changes from the 4.0 release branch
2008-11-10 07:35:03 +08:00
#else
Patches from NetBSD tree.
2007-08-29 10:31:44 +08:00
__RCSID("$NetBSD: print-tcp.c,v 1.8 2007/07/24 11:53:48 drochner Exp $");
Have the configure script arrange that the Makefile define _U_ appropriately, and that GNUmakefile and the MSVC++ project file define it apppriately, as we do with libpcap, rather than defining it in "interface.h". Undo the rcsid-shuffling and addition of extra #includes, as we no longer need to arrange that "interface.h" be included before using _U_ in an RCS ID or copyright.
2003-11-16 17:36:07 +08:00
#endif
Switch to config.h instead of passing defines in DEFS.
1999-11-21 17:36:43 +08:00
#ifdef HAVE_CONFIG_H
Always include <config.h> rather than "config.h". This can prevent bizarre failures if, for example, you've done a configuration in the top-level source directory, leaving behind one config.h file, and then do an out-of-tree build in another directory, with different configuration options. This way, we always pick up the same config.h, in the build directory.
2018-01-22 04:27:08 +08:00
#include <config.h>
Initial revision
1999-10-08 07:47:09 +08:00
#endif
Use quoted include netdissect-stdinc.h instead of angle-bracketed one
2018-01-20 22:59:49 +08:00
#include "netdissect-stdinc.h"
Initial revision
1999-10-08 07:47:09 +08:00
#include <stdlib.h>
#include <string.h>
TCP: Modernize packet parsing style. Enable ND_LONGJMP_FROM_TCHECK. Report invalid packets as invalid. Remove most ND_TCHECK*() instances as they were redundant. Update a custom snapend guard to use nd_trunc_longjmp(). Reduce arity of print_tcp_fastopen_option(). Use ND_TTEST_LEN() in tcp_verify_signature() and nd_printn() in print_tcp_rst_data(). For NFS_PORT remove ND_TTEST_4() from the test condition as it is not a valid factor, there is the subsequent GET_BE_U_4() to check bounds.
2021-01-18 05:22:34 +08:00
#define ND_LONGJMP_FROM_TCHECK
Printers must include 'netdissect.h', not 'interface.h'
2015-09-06 05:35:58 +08:00
#include "netdissect.h"
Initial revision
1999-10-08 07:47:09 +08:00
#include "addrtoname.h"
#include "extract.h"
Add "tcp.h" and "udp.h" headers, to declare the TCP and UDP stuff needed by dissectors, and have dissectors include them rather than <netinet/udp.h>, <netinet/udp_var.h>, or <netinet/tcp.h>, if they actually need that stuff. Remove all unnecessary includes of <netinet/udp*.h> or <netinet/tcp*.h> files.
2000-09-23 16:26:30 +08:00
#include "tcp.h"
Add an "ip.h" header, to declare the IP stuff needed by dissectors, and have dissectors include them rather than <netinet/ip.h> or <netinet/ip_var.h>, if they actually need that stuff. Put the declarations of the ICMP stuff directly into "print-icmp.c". Remove all unnecessary includes of <netinet/ip*.h> files. Copy the byte-order stuff from "nameser.h" into "tcp.h".
2000-09-23 16:54:24 +08:00
#include "ip.h"
put stripped-down version of ip6.h and icmp6.h into tcpdump tree. ip6.h is almost normal RFC2292 header. icmp6.h has couple of extensions (not covered by RFC2292), like MLD, ICMPv6 nodeinfo, and router renumber. XXX how to synchronize with future kame changes?
2000-10-07 13:53:09 +08:00
#include "ip6.h"
Add a new "ipproto.h" header file, with definitions of IP protocol type values. Use that rather than private definitions in various files. Add "gmpls.h" to the list of files in FILES, and add it and "ipfc.h" to the list of files in INSTALL.
2003-06-07 19:57:51 +08:00
#include "ipproto.h"
Have our own headers to declare the format of ONC (Sun) RPC messages on the wire; the definitions in many systems use u_long, which is 64 bits long on many platforms - that's OK for in-memory structures, but it doesn't match what's on the wire. Use headers based on the Sun ones, but use u_int32_t for fields, and otherwise make the structures match what's on the wire, and change some names to avoid collision with <rpc/rpc.h>, which print-sunrpc.c includes to declare "getrpcbynumber()" and the structure it returns. Record whether "getrpcbynumber()" is found, and use it only if it's found, rather than basing the decisison on whether we're building for Win32 or not.
2004-12-27 08:41:29 +08:00
#include "rpc_auth.h"
#include "rpc_msg.h"
Add an "ip.h" header, to declare the IP stuff needed by dissectors, and have dissectors include them rather than <netinet/ip.h> or <netinet/ip_var.h>, if they actually need that stuff. Put the declarations of the ICMP stuff directly into "print-icmp.c". Remove all unnecessary includes of <netinet/ip*.h> files. Copy the byte-order stuff from "nameser.h" into "tcp.h".
2000-09-23 16:54:24 +08:00
From Bruce M. Simpson: add a "-M" flag to specify a shared secret for TCP-MD5 (RFC 2385) digest verification if we have libcrypto.
2004-03-23 15:15:36 +08:00
#ifdef HAVE_LIBCRYPTO
#include <openssl/md5.h>
TCP: Use quoted include for 'signature.h' instead of angle-bracketed one
2015-07-03 20:26:54 +08:00
#include "signature.h"
In "tcp_verify_signature()", don't assume we can do IPv6, and distinguish between "signature invalid" and "we can't check the signature". Have its caller show the raw signature if we can't check it.
2004-09-15 09:21:17 +08:00
NDOize DECnet, OSPF and TCP decoders
2014-04-02 16:59:56 +08:00
static int tcp_verify_signature(netdissect_options *ndo,
const struct ip *ip, const struct tcphdr *tp,
Clean up signed vs. unsigned.
2018-01-12 03:52:30 +08:00
const u_char *data, u_int length, const u_char *rcvsig);
From Bruce M. Simpson: add a "-M" flag to specify a shared secret for TCP-MD5 (RFC 2385) digest verification if we have libcrypto.
2004-03-23 15:15:36 +08:00
#endif
Remove all storage class specifier 'register' Let the compiler do the optimizations (or not) based on build options. Avoid 'value has been optimized out' messages in gdb using '-O0'.
2017-12-14 02:17:47 +08:00
static void print_tcp_rst_data(netdissect_options *, const u_char *sp, u_int length);
static void print_tcp_fastopen_option(netdissect_options *ndo, const u_char *cp,
TCP: Modernize packet parsing style. Enable ND_LONGJMP_FROM_TCHECK. Report invalid packets as invalid. Remove most ND_TCHECK*() instances as they were redundant. Update a custom snapend guard to use nd_trunc_longjmp(). Reduce arity of print_tcp_fastopen_option(). Use ND_TTEST_LEN() in tcp_verify_signature() and nd_printn() in print_tcp_rst_data(). For NFS_PORT remove ND_TTEST_4() from the test condition as it is not a valid factor, there is the subsequent GET_BE_U_4() to check bounds.
2021-01-18 05:22:34 +08:00
u_int datalen);
Changes from Kevin Steves to print, in an RST segment, the payload as text, as per RFC 1122: 4.2.2.12 RST Segment: RFC-793 Section 3.4 A TCP SHOULD allow a received RST segment to include data. DISCUSSION It has been suggested that a RST segment could contain ASCII text that encoded and explained the cause of the RST. No standard has yet been established for such data. as some TCP implementations (e.g., HP-UX 11.0) do that. Clean up the code that prints the payload of non-RST segments.
2000-07-29 17:06:23 +08:00
#define MAX_RST_DATA_LEN 30
cast result from ntohl() with u_int32_t, some platforms still mistakingly use u_long for it. use u_int{16,32}_t. ECN support improvement (from net/openbsd).
2000-04-27 19:09:08 +08:00
Initial revision
1999-10-08 07:47:09 +08:00
struct tha {
Use nd_ipv4 rather than struct in_addr
2019-06-10 20:14:46 +08:00
nd_ipv4 src;
nd_ipv4 dst;
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
u_int port;
Initial revision
1999-10-08 07:47:09 +08:00
};
struct tcp_seq_hash {
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
struct tcp_seq_hash *nxt;
struct tha addr;
More nd_ification of structures. We don't need to use & to get a pointer to an nd_uintN_t/nd_intN_t type, as they're arrays.
2017-12-11 16:17:47 +08:00
uint32_t seq;
uint32_t ack;
Initial revision
1999-10-08 07:47:09 +08:00
};
print-tcp: separate tcp_seq_hash into ipv4 and ipv6 versions This cleans up and removes some duplicate code. The ipv4 and ipv6 versions of the codepath are virtually identical now save for the variable types.
2013-10-06 07:56:02 +08:00
struct tha6 {
Use nd_ipv6 rather than struct in6_addr
2019-06-10 21:32:20 +08:00
nd_ipv6 src;
nd_ipv6 dst;
print-tcp: separate tcp_seq_hash into ipv4 and ipv6 versions This cleans up and removes some duplicate code. The ipv4 and ipv6 versions of the codepath are virtually identical now save for the variable types.
2013-10-06 07:56:02 +08:00
u_int port;
};
struct tcp_seq_hash6 {
struct tcp_seq_hash6 *nxt;
struct tha6 addr;
More nd_ification of structures. We don't need to use & to get a pointer to an nd_uintN_t/nd_intN_t type, as they're arrays.
2017-12-11 16:17:47 +08:00
uint32_t seq;
uint32_t ack;
print-tcp: separate tcp_seq_hash into ipv4 and ipv6 versions This cleans up and removes some duplicate code. The ipv4 and ipv6 versions of the codepath are virtually identical now save for the variable types.
2013-10-06 07:56:02 +08:00
};
Initial revision
1999-10-08 07:47:09 +08:00
#define TSEQ_HASHSIZE 919
Fix a typo
2019-03-07 21:31:19 +08:00
/* These tcp options do not have the size octet */
Initial revision
1999-10-08 07:47:09 +08:00
#define ZEROLENOPT(o) ((o) == TCPOPT_EOL || (o) == TCPOPT_NOP)
print-tcp: separate tcp_seq_hash into ipv4 and ipv6 versions This cleans up and removes some duplicate code. The ipv4 and ipv6 versions of the codepath are virtually identical now save for the variable types.
2013-10-06 07:56:02 +08:00
static struct tcp_seq_hash tcp_seq_hash4[TSEQ_HASHSIZE];
static struct tcp_seq_hash6 tcp_seq_hash6[TSEQ_HASHSIZE];
Initial revision
1999-10-08 07:47:09 +08:00
NetFlow: Use tcp_flag_values[] for TCP flags. This way there is less code duplication and more consistency.
2021-01-16 18:56:30 +08:00
const struct tok tcp_flag_values[] = {
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
{ TH_FIN, "F" },
{ TH_SYN, "S" },
{ TH_RST, "R" },
{ TH_PUSH, "P" },
{ TH_ACK, "." },
{ TH_URG, "U" },
{ TH_ECNECHO, "E" },
{ TH_CWR, "W" },
{ 0, NULL }
};
Initial revision
1999-10-08 07:47:09 +08:00
justify declarations of struct tok arrays Make sure all of them are declared const and most of them -- static. Proper declaration of token arrays is a common review point for new code that is based on existing decoders. Thus fix the issue at its root.
2013-09-25 00:46:24 +08:00
static const struct tok tcp_option_values[] = {
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
{ TCPOPT_EOL, "eol" },
{ TCPOPT_NOP, "nop" },
{ TCPOPT_MAXSEG, "mss" },
{ TCPOPT_WSCALE, "wscale" },
{ TCPOPT_SACKOK, "sackOK" },
{ TCPOPT_SACK, "sack" },
{ TCPOPT_ECHO, "echo" },
{ TCPOPT_ECHOREPLY, "echoreply" },
{ TCPOPT_TIMESTAMP, "TS" },
{ TCPOPT_CC, "cc" },
{ TCPOPT_CCNEW, "ccnew" },
{ TCPOPT_CCECHO, "" },
{ TCPOPT_SIGNATURE, "md5" },
Correct TCP option Kind value for TCP Auth and add SCPS-TP. Fixes first problem in issue #516 while the second one isn't broken in tcpdump.
2016-05-06 03:31:01 +08:00
{ TCPOPT_SCPS, "scps" },
Revert "Correct TCP option Kind value for TCP Auth and add SCPS-TP." This reverts commit 986b783f0574e50a9fc71c6937f0988b27f9529c.
2016-11-08 07:43:17 +08:00
{ TCPOPT_UTO, "uto" },
TCP: put TCP-AO option decoding right As it was correctly pointed out in GitHub issue #516, the TCPOPT_TCPAO (formerly TCPOPT_AUTH) case had an issue with option length processing, though without significant consequences thanks to a check elsewhere. Besides that, the old code (introduced in 2005) decoded a structure similar to a proposed encoding variant of the early (first published in 2007) revisions of the Internet-Draft but different from the encoding of RFC 5925 (published in 2010). These issues are now addressed and the TCP option renamed to TCP-AO.
2016-11-02 01:05:01 +08:00
{ TCPOPT_TCPAO, "tcp-ao" },
Fix MPTCP support Added: * option length check * option type and TCP flags check * more information printed Signed-off-by: Gregory Detal <gregory.detal@uclouvain.be>
2013-04-17 22:05:21 +08:00
{ TCPOPT_MPTCP, "mptcp" },
Add support for TCP Fast Open official IANA option number https://tools.ietf.org/html/rfc7413
2015-04-08 08:42:55 +08:00
{ TCPOPT_FASTOPEN, "tfo" },
add support for experimental tcp fast open and parsing experimental options
2013-06-16 11:46:54 +08:00
{ TCPOPT_EXPERIMENT2, "exp" },
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
{ 0, NULL }
};
patches from Andrew Tridgell <tridge@linuxcare.com> to add decoding of SMB packets
1999-11-21 23:57:50 +08:00
Have all Internet-checksum computing routines return a uint16_t. Those checksums are 16-bit; change the return types of those routines appropriately.
2018-12-11 16:50:15 +08:00
static uint16_t
NDOize DECnet, OSPF and TCP decoders
2014-04-02 16:59:56 +08:00
tcp_cksum(netdissect_options *ndo,
Remove all storage class specifier 'register' Let the compiler do the optimizations (or not) based on build options. Avoid 'value has been optimized out' messages in gdb using '-O0'.
2017-12-14 02:17:47 +08:00
const struct ip *ip,
const struct tcphdr *tp,
u_int len)
tcp checksum. requested from darren reed. code from netbsd.
2000-08-02 01:28:09 +08:00
{
Clean up whitespaces
2018-10-27 23:36:31 +08:00
return nextproto4_cksum(ndo, ip, (const uint8_t *)tp, len, len,
IPPROTO_TCP);
tcp checksum. requested from darren reed. code from netbsd.
2000-08-02 01:28:09 +08:00
}
Have all Internet-checksum computing routines return a uint16_t. Those checksums are 16-bit; change the return types of those routines appropriately.
2018-12-11 16:50:15 +08:00
static uint16_t
Don't overwrite the destination IPv6 address for routing headers. If we have a routing header, instead of overwriting the packet's IPv6 destination address in the packet with the final destination, so that the next protocol's checksum routine can use it, we do as we do for IPv4, and, in the "next protocol checksum" routine, scan the headers looking for a routing header and, if we find one, copy the final destination from it. While we're at it, clean up a few things.
2016-02-13 12:26:39 +08:00
tcp6_cksum(netdissect_options *ndo,
Remove all storage class specifier 'register' Let the compiler do the optimizations (or not) based on build options. Avoid 'value has been optimized out' messages in gdb using '-O0'.
2017-12-14 02:17:47 +08:00
const struct ip6_hdr *ip6,
const struct tcphdr *tp,
u_int len)
Don't overwrite the destination IPv6 address for routing headers. If we have a routing header, instead of overwriting the packet's IPv6 destination address in the packet with the final destination, so that the next protocol's checksum routine can use it, we do as we do for IPv4, and, in the "next protocol checksum" routine, scan the headers looking for a routing header and, if we find one, copy the final destination from it. While we're at it, clean up a few things.
2016-02-13 12:26:39 +08:00
{
Clean up whitespaces
2018-10-27 23:36:31 +08:00
return nextproto6_cksum(ndo, ip6, (const uint8_t *)tp, len, len,
IPPROTO_TCP);
Don't overwrite the destination IPv6 address for routing headers. If we have a routing header, instead of overwriting the packet's IPv6 destination address in the packet with the final destination, so that the next protocol's checksum routine can use it, we do as we do for IPv4, and, in the "next protocol checksum" routine, scan the headers looking for a routing header and, if we find one, copy the final destination from it. While we're at it, clean up a few things.
2016-02-13 12:26:39 +08:00
}
Initial revision
1999-10-08 07:47:09 +08:00
void
NDOize DECnet, OSPF and TCP decoders
2014-04-02 16:59:56 +08:00
tcp_print(netdissect_options *ndo,
Remove all storage class specifier 'register' Let the compiler do the optimizations (or not) based on build options. Avoid 'value has been optimized out' messages in gdb using '-O0'.
2017-12-14 02:17:47 +08:00
const u_char *bp, u_int length,
const u_char *bp2, int fragmented)
Initial revision
1999-10-08 07:47:09 +08:00
{
Remove all storage class specifier 'register' Let the compiler do the optimizations (or not) based on build options. Avoid 'value has been optimized out' messages in gdb using '-O0'.
2017-12-14 02:17:47 +08:00
const struct tcphdr *tp;
const struct ip *ip;
u_char flags;
u_int hlen;
char ch;
u_intN_t is dead, long live uintN_t. And, as we require at least autoconf 2.61, and as autoconf 2.61 and later have AC_TYPE_UINTn_T and AC_TYPE_INTn_T macros, we use them to define the uintN_t and intN_t macros if the system doesn't define them for us. This lets us get rid of bitypes.h as well.
2014-04-23 15:20:40 +08:00
uint16_t sport, dport, win, urp;
uint32_t seq, ack, thseq, thack;
Don't use "uint"; it's not guaranteed to be defined. Don't define a variable in the middle of a block; not all C compilers support that.
2009-09-22 01:02:05 +08:00
u_int utoval;
u_intN_t is dead, long live uintN_t. And, as we require at least autoconf 2.61, and as autoconf 2.61 and later have AC_TYPE_UINTn_T and AC_TYPE_INTn_T macros, we use them to define the uintN_t and intN_t macros if the system doesn't define them for us. This lets us get rid of bitypes.h as well.
2014-04-23 15:20:40 +08:00
uint16_t magic;
Remove all storage class specifier 'register' Let the compiler do the optimizations (or not) based on build options. Avoid 'value has been optimized out' messages in gdb using '-O0'.
2017-12-14 02:17:47 +08:00
int rev;
const struct ip6_hdr *ip6;
TCP: Add a bounds check before decoding the payload At least the header data is required. Moreover: Update the output of a test accordingly. Fix indentation.
2021-02-13 04:49:40 +08:00
u_int header_len; /* Header length in bytes */
Initial revision
1999-10-08 07:47:09 +08:00
Clean up whitespaces
2018-10-27 23:36:31 +08:00
ndo->ndo_protocol = "tcp";
Fix a bunch of de-constifications.
2015-04-27 08:24:42 +08:00
tp = (const struct tcphdr *)bp;
ip = (const struct ip *)bp2;
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
if (IP_V(ip) == 6)
Fix a bunch of de-constifications.
2015-04-27 08:24:42 +08:00
ip6 = (const struct ip6_hdr *)bp2;
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
else
ip6 = NULL;
ch = '\0';
TCP: Use more ND_TTEST_n() macros
2018-01-09 06:14:20 +08:00
if (!ND_TTEST_2(tp->th_dport)) {
Clean up whitespaces
2018-10-27 23:36:31 +08:00
if (ip6) {
ND_PRINT("%s > %s:",
TCP: Use GET_IPADDR_STRING()/GET_IP6ADDR_STRING() calls Replace the calls to ipaddr_string()/ip6addr_string() with calls to GET_IPADDR_STRING()/GET_IP6ADDR_STRING() macros performing bounds checking.
2020-09-23 22:28:52 +08:00
GET_IP6ADDR_STRING(ip6->ip6_src),
GET_IP6ADDR_STRING(ip6->ip6_dst));
Clean up whitespaces
2018-10-27 23:36:31 +08:00
} else {
Add more nd_print_trunc() calls Update the output of some tests accordingly.
2018-05-18 14:33:54 +08:00
ND_PRINT("%s > %s:",
TCP: Use GET_IPADDR_STRING()/GET_IP6ADDR_STRING() calls Replace the calls to ipaddr_string()/ip6addr_string() with calls to GET_IPADDR_STRING()/GET_IP6ADDR_STRING() macros performing bounds checking.
2020-09-23 22:28:52 +08:00
GET_IPADDR_STRING(ip->ip_src),
GET_IPADDR_STRING(ip->ip_dst));
Have ip{6}addr_string take a u_char * as the second argument. Fix warnings that introduces.
2018-01-31 16:43:45 +08:00
}
TCP: Modernize packet parsing style. Enable ND_LONGJMP_FROM_TCHECK. Report invalid packets as invalid. Remove most ND_TCHECK*() instances as they were redundant. Update a custom snapend guard to use nd_trunc_longjmp(). Reduce arity of print_tcp_fastopen_option(). Use ND_TTEST_LEN() in tcp_verify_signature() and nd_printn() in print_tcp_rst_data(). For NFS_PORT remove ND_TTEST_4() from the test condition as it is not a valid factor, there is the subsequent GET_BE_U_4() to check bounds.
2021-01-18 05:22:34 +08:00
nd_trunc_longjmp(ndo);
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
}
Use the new GET_ macros instead of the EXTRACT_ ones The exceptions are currently: Some EXTRACT_ in print-juniper.c, not used on packet buffer pointer. An EXTRACT_BE_U_3 in addrtoname.c, not always used on packet buffer pointer.
2018-06-16 23:23:21 +08:00
sport = GET_BE_U_2(tp->th_sport);
dport = GET_BE_U_2(tp->th_dport);
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
if (ip6) {
Use the new GET_ macros instead of the EXTRACT_ ones The exceptions are currently: Some EXTRACT_ in print-juniper.c, not used on packet buffer pointer. An EXTRACT_BE_U_3 in addrtoname.c, not always used on packet buffer pointer.
2018-06-16 23:23:21 +08:00
if (GET_U_1(ip6->ip6_nxt) == IPPROTO_TCP) {
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ND_PRINT("%s.%s > %s.%s: ",
TCP: Use GET_IPADDR_STRING()/GET_IP6ADDR_STRING() calls Replace the calls to ipaddr_string()/ip6addr_string() with calls to GET_IPADDR_STRING()/GET_IP6ADDR_STRING() macros performing bounds checking.
2020-09-23 22:28:52 +08:00
GET_IP6ADDR_STRING(ip6->ip6_src),
Clean up whitespaces
2018-10-27 23:36:31 +08:00
tcpport_string(ndo, sport),
TCP: Use GET_IPADDR_STRING()/GET_IP6ADDR_STRING() calls Replace the calls to ipaddr_string()/ip6addr_string() with calls to GET_IPADDR_STRING()/GET_IP6ADDR_STRING() macros performing bounds checking.
2020-09-23 22:28:52 +08:00
GET_IP6ADDR_STRING(ip6->ip6_dst),
Clean up whitespaces
2018-10-27 23:36:31 +08:00
tcpport_string(ndo, dport));
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
} else {
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ND_PRINT("%s > %s: ",
Clean up whitespaces
2018-10-27 23:36:31 +08:00
tcpport_string(ndo, sport), tcpport_string(ndo, dport));
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
}
Don't require IPv6 library support in order to support IPv6 addresses. Have our own routines to convert between IPv4/IPv6 addresses and strings; that helps if, for example, we want to build binary versions of tcpdump for Windows that can run both on NT 5 (W2K/WXP), which doesn't have inet_ntop() or inet_pton(), and NT 6 (Vista/7/8/10), which do. It also means that we don't require IPv6 library support on UN*X to print addresses (if somebody wants to build tcpdump for older UN*Xes lacking IPv6 support in the system library or in add-on libraries). Get rid of files in the missing directory that we don't need, and various no-longer-necessary autoconf tests.
2015-09-18 05:56:44 +08:00
} else {
Use the new GET_ macros instead of the EXTRACT_ ones The exceptions are currently: Some EXTRACT_ in print-juniper.c, not used on packet buffer pointer. An EXTRACT_BE_U_3 in addrtoname.c, not always used on packet buffer pointer.
2018-06-16 23:23:21 +08:00
if (GET_U_1(ip->ip_p) == IPPROTO_TCP) {
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ND_PRINT("%s.%s > %s.%s: ",
TCP: Use GET_IPADDR_STRING()/GET_IP6ADDR_STRING() calls Replace the calls to ipaddr_string()/ip6addr_string() with calls to GET_IPADDR_STRING()/GET_IP6ADDR_STRING() macros performing bounds checking.
2020-09-23 22:28:52 +08:00
GET_IPADDR_STRING(ip->ip_src),
Clean up whitespaces
2018-10-27 23:36:31 +08:00
tcpport_string(ndo, sport),
TCP: Use GET_IPADDR_STRING()/GET_IP6ADDR_STRING() calls Replace the calls to ipaddr_string()/ip6addr_string() with calls to GET_IPADDR_STRING()/GET_IP6ADDR_STRING() macros performing bounds checking.
2020-09-23 22:28:52 +08:00
GET_IPADDR_STRING(ip->ip_dst),
Clean up whitespaces
2018-10-27 23:36:31 +08:00
tcpport_string(ndo, dport));
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
} else {
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ND_PRINT("%s > %s: ",
Clean up whitespaces
2018-10-27 23:36:31 +08:00
tcpport_string(ndo, sport), tcpport_string(ndo, dport));
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
}
}
CVE-2016-7975/Make sure we have the data offset field before fetching it. Fixes a heap overflow found with American Fuzzy Lop by Hanno Böck.
2015-07-04 07:47:12 +08:00
hlen = TH_OFF(tp) * 4;
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
if (hlen < sizeof(*tp)) {
More use of %zu to print sizeof values.
2019-08-12 03:23:36 +08:00
ND_PRINT(" tcp %u [bad hdr length %u - too short, < %zu]",
length - hlen, hlen, sizeof(*tp));
TCP: Modernize packet parsing style. Enable ND_LONGJMP_FROM_TCHECK. Report invalid packets as invalid. Remove most ND_TCHECK*() instances as they were redundant. Update a custom snapend guard to use nd_trunc_longjmp(). Reduce arity of print_tcp_fastopen_option(). Use ND_TTEST_LEN() in tcp_verify_signature() and nd_printn() in print_tcp_rst_data(). For NFS_PORT remove ND_TTEST_4() from the test condition as it is not a valid factor, there is the subsequent GET_BE_U_4() to check bounds.
2021-01-18 05:22:34 +08:00
goto invalid;
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
}
Use the new GET_ macros instead of the EXTRACT_ ones The exceptions are currently: Some EXTRACT_ in print-juniper.c, not used on packet buffer pointer. An EXTRACT_BE_U_3 in addrtoname.c, not always used on packet buffer pointer.
2018-06-16 23:23:21 +08:00
seq = GET_BE_U_4(tp->th_seq);
ack = GET_BE_U_4(tp->th_ack);
win = GET_BE_U_2(tp->th_win);
urp = GET_BE_U_2(tp->th_urp);
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
NDOize DECnet, OSPF and TCP decoders
2014-04-02 16:59:56 +08:00
if (ndo->ndo_qflag) {
Clean up signed vs. unsigned.
2018-01-12 03:52:30 +08:00
ND_PRINT("tcp %u", length - hlen);
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
if (hlen > length) {
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ND_PRINT(" [bad hdr length %u - too long, > %u]",
Clean up whitespaces
2018-10-27 23:36:31 +08:00
hlen, length);
TCP: Modernize packet parsing style. Enable ND_LONGJMP_FROM_TCHECK. Report invalid packets as invalid. Remove most ND_TCHECK*() instances as they were redundant. Update a custom snapend guard to use nd_trunc_longjmp(). Reduce arity of print_tcp_fastopen_option(). Use ND_TTEST_LEN() in tcp_verify_signature() and nd_printn() in print_tcp_rst_data(). For NFS_PORT remove ND_TTEST_4() from the test condition as it is not a valid factor, there is the subsequent GET_BE_U_4() to check bounds.
2021-01-18 05:22:34 +08:00
goto invalid;
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
}
return;
}
Use the new GET_ macros instead of the EXTRACT_ ones The exceptions are currently: Some EXTRACT_ in print-juniper.c, not used on packet buffer pointer. An EXTRACT_BE_U_3 in addrtoname.c, not always used on packet buffer pointer.
2018-06-16 23:23:21 +08:00
flags = GET_U_1(tp->th_flags);
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ND_PRINT("Flags [%s]", bittok2str_nosep(tcp_flag_values, "none", flags));
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
NDOize DECnet, OSPF and TCP decoders
2014-04-02 16:59:56 +08:00
if (!ndo->ndo_Sflag && (flags & TH_ACK)) {
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
/*
* Find (or record) the initial sequence numbers for
* this conversation. (we pick an arbitrary
* collating order so there's only one entry for
* both directions).
*/
rev = 0;
if (ip6) {
Remove all storage class specifier 'register' Let the compiler do the optimizations (or not) based on build options. Avoid 'value has been optimized out' messages in gdb using '-O0'.
2017-12-14 02:17:47 +08:00
struct tcp_seq_hash6 *th;
print-tcp: separate tcp_seq_hash into ipv4 and ipv6 versions This cleans up and removes some duplicate code. The ipv4 and ipv6 versions of the codepath are virtually identical now save for the variable types.
2013-10-06 07:56:02 +08:00
struct tcp_seq_hash6 *tcp_seq_hash;
Squelch some alignment warnings. Make src and dst "const void *"s to squelch taking address of packed member 'ip6_dst' of class or structure 'ip6_hdr' may result in an unaligned pointer value [-Waddress-of-packed-member] warnings from some versions of Clang.
2017-07-23 04:25:46 +08:00
const void *src, *dst;
print-tcp: separate tcp_seq_hash into ipv4 and ipv6 versions This cleans up and removes some duplicate code. The ipv4 and ipv6 versions of the codepath are virtually identical now save for the variable types.
2013-10-06 07:56:02 +08:00
struct tha6 tha;
tcp_seq_hash = tcp_seq_hash6;
Remove unneeded '&' when getting a pointer to a nd_ipv6 type
2018-01-31 21:33:40 +08:00
src = (const void *)ip6->ip6_src;
dst = (const void *)ip6->ip6_dst;
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
if (sport > dport)
rev = 1;
else if (sport == dport) {
Style update Use parens around the sizeof argument, to match the style used elsewhere.
2018-02-07 02:15:45 +08:00
if (UNALIGNED_MEMCMP(src, dst, sizeof(ip6->ip6_dst)) > 0)
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
rev = 1;
}
if (rev) {
Style update Use parens around the sizeof argument, to match the style used elsewhere.
2018-02-07 02:15:45 +08:00
UNALIGNED_MEMCPY(&tha.src, dst, sizeof(ip6->ip6_dst));
UNALIGNED_MEMCPY(&tha.dst, src, sizeof(ip6->ip6_src));
Cast dport and sport to u_int before shifting them. The result of the expression is ultimately going to be put into a u_int; cast them to u_int so that we'll be shifting unsigned values left rather than int values, to avoid undefined behavior. This should fix GitHub issue #681.
2018-05-25 03:11:09 +08:00
tha.port = ((u_int)dport) << 16 | sport;
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
} else {
Style update Use parens around the sizeof argument, to match the style used elsewhere.
2018-02-07 02:15:45 +08:00
UNALIGNED_MEMCPY(&tha.dst, dst, sizeof(ip6->ip6_dst));
UNALIGNED_MEMCPY(&tha.src, src, sizeof(ip6->ip6_src));
Cast dport and sport to u_int before shifting them. The result of the expression is ultimately going to be put into a u_int; cast them to u_int so that we'll be shifting unsigned values left rather than int values, to avoid undefined behavior. This should fix GitHub issue #681.
2018-05-25 03:11:09 +08:00
tha.port = ((u_int)sport) << 16 | dport;
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
}
print-tcp: separate tcp_seq_hash into ipv4 and ipv6 versions This cleans up and removes some duplicate code. The ipv4 and ipv6 versions of the codepath are virtually identical now save for the variable types.
2013-10-06 07:56:02 +08:00
for (th = &tcp_seq_hash[tha.port % TSEQ_HASHSIZE];
th->nxt; th = th->nxt)
if (memcmp((char *)&tha, (char *)&th->addr,
sizeof(th->addr)) == 0)
break;
if (!th->nxt || (flags & TH_SYN)) {
/* didn't find it or new conversation */
Clean up whitespaces
2018-10-27 23:36:31 +08:00
/* calloc() return used by the 'tcp_seq_hash6'
hash table: do not free() */
print-tcp: separate tcp_seq_hash into ipv4 and ipv6 versions This cleans up and removes some duplicate code. The ipv4 and ipv6 versions of the codepath are virtually identical now save for the variable types.
2013-10-06 07:56:02 +08:00
if (th->nxt == NULL) {
th->nxt = (struct tcp_seq_hash6 *)
calloc(1, sizeof(*th));
if (th->nxt == NULL)
Printers must use ndo_error() function (via ndo->ndo_error)
2015-09-06 02:11:12 +08:00
(*ndo->ndo_error)(ndo,
Clean up whitespaces
2018-10-27 23:36:31 +08:00
S_ERR_ND_MEM_ALLOC,
Use __func__ from C99 in error messages. [skip ci] This automatically fixes a few error messages that would tell an incorrect function name.
2020-10-08 06:33:51 +08:00
"%s: calloc", __func__);
print-tcp: separate tcp_seq_hash into ipv4 and ipv6 versions This cleans up and removes some duplicate code. The ipv4 and ipv6 versions of the codepath are virtually identical now save for the variable types.
2013-10-06 07:56:02 +08:00
}
th->addr = tha;
if (rev)
th->ack = seq, th->seq = ack - 1;
else
th->seq = seq, th->ack = ack - 1;
} else {
if (rev)
seq -= th->ack, ack -= th->seq;
else
seq -= th->seq, ack -= th->ack;
}
thseq = th->seq;
thack = th->ack;
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
} else {
Remove all storage class specifier 'register' Let the compiler do the optimizations (or not) based on build options. Avoid 'value has been optimized out' messages in gdb using '-O0'.
2017-12-14 02:17:47 +08:00
struct tcp_seq_hash *th;
print-tcp: separate tcp_seq_hash into ipv4 and ipv6 versions This cleans up and removes some duplicate code. The ipv4 and ipv6 versions of the codepath are virtually identical now save for the variable types.
2013-10-06 07:56:02 +08:00
struct tcp_seq_hash *tcp_seq_hash;
struct tha tha;
tcp_seq_hash = tcp_seq_hash4;
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
if (sport > dport)
rev = 1;
else if (sport == dport) {
Style update Use parens around the sizeof argument, to match the style used elsewhere.
2018-02-07 02:15:45 +08:00
if (UNALIGNED_MEMCMP(ip->ip_src, ip->ip_dst, sizeof(ip->ip_dst)) > 0)
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
rev = 1;
}
if (rev) {
Remove unneeded '&' when getting a pointer to a nd_ipv4 type
2018-01-31 21:31:20 +08:00
UNALIGNED_MEMCPY(&tha.src, ip->ip_dst,
Style update Use parens around the sizeof argument, to match the style used elsewhere.
2018-02-07 02:15:45 +08:00
sizeof(ip->ip_dst));
Remove unneeded '&' when getting a pointer to a nd_ipv4 type
2018-01-31 21:31:20 +08:00
UNALIGNED_MEMCPY(&tha.dst, ip->ip_src,
Style update Use parens around the sizeof argument, to match the style used elsewhere.
2018-02-07 02:15:45 +08:00
sizeof(ip->ip_src));
Cast dport and sport to u_int before shifting them. The result of the expression is ultimately going to be put into a u_int; cast them to u_int so that we'll be shifting unsigned values left rather than int values, to avoid undefined behavior. This should fix GitHub issue #681.
2018-05-25 03:11:09 +08:00
tha.port = ((u_int)dport) << 16 | sport;
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
} else {
Remove unneeded '&' when getting a pointer to a nd_ipv4 type
2018-01-31 21:31:20 +08:00
UNALIGNED_MEMCPY(&tha.dst, ip->ip_dst,
Style update Use parens around the sizeof argument, to match the style used elsewhere.
2018-02-07 02:15:45 +08:00
sizeof(ip->ip_dst));
Remove unneeded '&' when getting a pointer to a nd_ipv4 type
2018-01-31 21:31:20 +08:00
UNALIGNED_MEMCPY(&tha.src, ip->ip_src,
Style update Use parens around the sizeof argument, to match the style used elsewhere.
2018-02-07 02:15:45 +08:00
sizeof(ip->ip_src));
Cast dport and sport to u_int before shifting them. The result of the expression is ultimately going to be put into a u_int; cast them to u_int so that we'll be shifting unsigned values left rather than int values, to avoid undefined behavior. This should fix GitHub issue #681.
2018-05-25 03:11:09 +08:00
tha.port = ((u_int)sport) << 16 | dport;
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
}
Initial revision
1999-10-08 07:47:09 +08:00
print-tcp: separate tcp_seq_hash into ipv4 and ipv6 versions This cleans up and removes some duplicate code. The ipv4 and ipv6 versions of the codepath are virtually identical now save for the variable types.
2013-10-06 07:56:02 +08:00
for (th = &tcp_seq_hash[tha.port % TSEQ_HASHSIZE];
th->nxt; th = th->nxt)
if (memcmp((char *)&tha, (char *)&th->addr,
sizeof(th->addr)) == 0)
break;
if (!th->nxt || (flags & TH_SYN)) {
/* didn't find it or new conversation */
Clean up whitespaces
2018-10-27 23:36:31 +08:00
/* calloc() return used by the 'tcp_seq_hash4'
hash table: do not free() */
print-tcp: separate tcp_seq_hash into ipv4 and ipv6 versions This cleans up and removes some duplicate code. The ipv4 and ipv6 versions of the codepath are virtually identical now save for the variable types.
2013-10-06 07:56:02 +08:00
if (th->nxt == NULL) {
th->nxt = (struct tcp_seq_hash *)
calloc(1, sizeof(*th));
if (th->nxt == NULL)
Printers must use ndo_error() function (via ndo->ndo_error)
2015-09-06 02:11:12 +08:00
(*ndo->ndo_error)(ndo,
Clean up whitespaces
2018-10-27 23:36:31 +08:00
S_ERR_ND_MEM_ALLOC,
Use __func__ from C99 in error messages. [skip ci] This automatically fixes a few error messages that would tell an incorrect function name.
2020-10-08 06:33:51 +08:00
"%s: calloc", __func__);
print-tcp: separate tcp_seq_hash into ipv4 and ipv6 versions This cleans up and removes some duplicate code. The ipv4 and ipv6 versions of the codepath are virtually identical now save for the variable types.
2013-10-06 07:56:02 +08:00
}
th->addr = tha;
if (rev)
th->ack = seq, th->seq = ack - 1;
else
th->seq = seq, th->ack = ack - 1;
} else {
if (rev)
seq -= th->ack, ack -= th->seq;
else
seq -= th->seq, ack -= th->ack;
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
}
print-tcp: separate tcp_seq_hash into ipv4 and ipv6 versions This cleans up and removes some duplicate code. The ipv4 and ipv6 versions of the codepath are virtually identical now save for the variable types.
2013-10-06 07:56:02 +08:00
thseq = th->seq;
thack = th->ack;
}
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
} else {
/*fool gcc*/
merge 'threv' and 'rev' variables in print-tcp into just 'rev'
2013-10-06 07:37:15 +08:00
thseq = thack = rev = 0;
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
}
if (hlen > length) {
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ND_PRINT(" [bad hdr length %u - too long, > %u]",
Clean up whitespaces
2018-10-27 23:36:31 +08:00
hlen, length);
TCP: Modernize packet parsing style. Enable ND_LONGJMP_FROM_TCHECK. Report invalid packets as invalid. Remove most ND_TCHECK*() instances as they were redundant. Update a custom snapend guard to use nd_trunc_longjmp(). Reduce arity of print_tcp_fastopen_option(). Use ND_TTEST_LEN() in tcp_verify_signature() and nd_printn() in print_tcp_rst_data(). For NFS_PORT remove ND_TTEST_4() from the test condition as it is not a valid factor, there is the subsequent GET_BE_U_4() to check bounds.
2021-01-18 05:22:34 +08:00
goto invalid;
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
}
NDOize DECnet, OSPF and TCP decoders
2014-04-02 16:59:56 +08:00
if (ndo->ndo_vflag && !ndo->ndo_Kflag && !fragmented) {
Clean up the checksum checking. Check -v and -K, and the fragmented flag, up front; then check the IP version etc.. Don't check for IPv6 if we already know it's IPv4. Fetch the checksum field only once.
2011-06-17 12:50:26 +08:00
/* Check the checksum, if possible. */
u_intN_t is dead, long live uintN_t. And, as we require at least autoconf 2.61, and as autoconf 2.61 and later have AC_TYPE_UINTn_T and AC_TYPE_INTn_T macros, we use them to define the uintN_t and intN_t macros if the system doesn't define them for us. This lets us get rid of bitypes.h as well.
2014-04-23 15:20:40 +08:00
uint16_t sum, tcp_sum;
display cosmetics: be more verbose on IP6 TCP checksum errors, align IP4,IP6 checksum printing
2004-04-25 01:19:00 +08:00
Clean up the checksum checking. Check -v and -K, and the fragmented flag, up front; then check the IP version etc.. Don't check for IPv6 if we already know it's IPv4. Fetch the checksum field only once.
2011-06-17 12:50:26 +08:00
if (IP_V(ip) == 4) {
TCP: Replace ND_TTEST2 calls by ND_TTEST_LEN calls
2017-12-15 04:48:23 +08:00
if (ND_TTEST_LEN(tp->th_sport, length)) {
NDOize DECnet, OSPF and TCP decoders
2014-04-02 16:59:56 +08:00
sum = tcp_cksum(ndo, ip, tp, length);
Use the new GET_ macros instead of the EXTRACT_ ones The exceptions are currently: Some EXTRACT_ in print-juniper.c, not used on packet buffer pointer. An EXTRACT_BE_U_3 in addrtoname.c, not always used on packet buffer pointer.
2018-06-16 23:23:21 +08:00
tcp_sum = GET_BE_U_2(tp->th_sum);
Clean up the checksum checking. Check -v and -K, and the fragmented flag, up front; then check the IP version etc.. Don't check for IPv6 if we already know it's IPv4. Fetch the checksum field only once.
2011-06-17 12:50:26 +08:00
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ND_PRINT(", cksum 0x%04x", tcp_sum);
Clean up the checksum checking. Check -v and -K, and the fragmented flag, up front; then check the IP version etc.. Don't check for IPv6 if we already know it's IPv4. Fetch the checksum field only once.
2011-06-17 12:50:26 +08:00
if (sum != 0)
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ND_PRINT(" (incorrect -> 0x%04x)",
in_cksum_shouldbe(tcp_sum, sum));
Clean up the checksum checking. Check -v and -K, and the fragmented flag, up front; then check the IP version etc.. Don't check for IPv6 if we already know it's IPv4. Fetch the checksum field only once.
2011-06-17 12:50:26 +08:00
else
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ND_PRINT(" (correct)");
Clean up the checksum checking. Check -v and -K, and the fragmented flag, up front; then check the IP version etc.. Don't check for IPv6 if we already know it's IPv4. Fetch the checksum field only once.
2011-06-17 12:50:26 +08:00
}
Remove the IPv6 payload length checks for checksumming. If there isn't an IPv6 payload, there isn't any TCP or UDP packet, and there's no TCP or UDP header to checksum, so there's no need for the check (it's not there for IPv4).
2019-05-01 15:23:08 +08:00
} else if (IP_V(ip) == 6) {
TCP: Replace ND_TTEST2 calls by ND_TTEST_LEN calls
2017-12-15 04:48:23 +08:00
if (ND_TTEST_LEN(tp->th_sport, length)) {
Don't overwrite the destination IPv6 address for routing headers. If we have a routing header, instead of overwriting the packet's IPv6 destination address in the packet with the final destination, so that the next protocol's checksum routine can use it, we do as we do for IPv4, and, in the "next protocol checksum" routine, scan the headers looking for a routing header and, if we find one, copy the final destination from it. While we're at it, clean up a few things.
2016-02-13 12:26:39 +08:00
sum = tcp6_cksum(ndo, ip6, tp, length);
Use the new GET_ macros instead of the EXTRACT_ ones The exceptions are currently: Some EXTRACT_ in print-juniper.c, not used on packet buffer pointer. An EXTRACT_BE_U_3 in addrtoname.c, not always used on packet buffer pointer.
2018-06-16 23:23:21 +08:00
tcp_sum = GET_BE_U_2(tp->th_sum);
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ND_PRINT(", cksum 0x%04x", tcp_sum);
Clean up the checksum checking. Check -v and -K, and the fragmented flag, up front; then check the IP version etc.. Don't check for IPv6 if we already know it's IPv4. Fetch the checksum field only once.
2011-06-17 12:50:26 +08:00
if (sum != 0)
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ND_PRINT(" (incorrect -> 0x%04x)",
in_cksum_shouldbe(tcp_sum, sum));
Clean up the checksum checking. Check -v and -K, and the fragmented flag, up front; then check the IP version etc.. Don't check for IPv6 if we already know it's IPv4. Fetch the checksum field only once.
2011-06-17 12:50:26 +08:00
else
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ND_PRINT(" (correct)");
Clean up the checksum checking. Check -v and -K, and the fragmented flag, up front; then check the IP version etc.. Don't check for IPv6 if we already know it's IPv4. Fetch the checksum field only once.
2011-06-17 12:50:26 +08:00
}
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
}
Clean up the checksum checking. Check -v and -K, and the fragmented flag, up front; then check the IP version etc.. Don't check for IPv6 if we already know it's IPv4. Fetch the checksum field only once.
2011-06-17 12:50:26 +08:00
}
tcp checksum. requested from darren reed. code from netbsd.
2000-08-02 01:28:09 +08:00
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
length -= hlen;
NDOize DECnet, OSPF and TCP decoders
2014-04-02 16:59:56 +08:00
if (ndo->ndo_vflag > 1 || length > 0 || flags & (TH_SYN | TH_FIN | TH_RST)) {
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ND_PRINT(", seq %u", seq);
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
if (length > 0) {
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ND_PRINT(":%u", seq + length);
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
}
}
if (flags & TH_ACK) {
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ND_PRINT(", ack %u", ack);
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
}
Clean up signed vs. unsigned.
2018-01-12 03:52:30 +08:00
ND_PRINT(", win %u", win);
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
if (flags & TH_URG)
Clean up signed vs. unsigned.
2018-01-12 03:52:30 +08:00
ND_PRINT(", urg %u", urp);
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
/*
* Handle any options.
*/
if (hlen > sizeof(*tp)) {
Remove all storage class specifier 'register' Let the compiler do the optimizations (or not) based on build options. Avoid 'value has been optimized out' messages in gdb using '-O0'.
2017-12-14 02:17:47 +08:00
const u_char *cp;
u_int i, opt, datalen;
u_int len;
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
hlen -= sizeof(*tp);
cp = (const u_char *)tp + sizeof(*tp);
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ND_PRINT(", options [");
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
while (hlen > 0) {
From Alexander Dupuy: if the separator character is null, it means "no separator needed", so don't print it.
2007-04-04 04:02:56 +08:00
if (ch != '\0')
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ND_PRINT("%c", ch);
Use the new GET_ macros instead of the EXTRACT_ ones The exceptions are currently: Some EXTRACT_ in print-juniper.c, not used on packet buffer pointer. An EXTRACT_BE_U_3 in addrtoname.c, not always used on packet buffer pointer.
2018-06-16 23:23:21 +08:00
opt = GET_U_1(cp);
Use more the EXTRACT_8BITS() macro to fetch a one-byte value (17/n) Assignment, *p++ -> EXTRACT_8BITS(p); p++; Partial list.
2017-11-22 03:23:59 +08:00
cp++;
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
if (ZEROLENOPT(opt))
len = 1;
else {
Use the new GET_ macros instead of the EXTRACT_ ones The exceptions are currently: Some EXTRACT_ in print-juniper.c, not used on packet buffer pointer. An EXTRACT_BE_U_3 in addrtoname.c, not always used on packet buffer pointer.
2018-06-16 23:23:21 +08:00
len = GET_U_1(cp);
Use more the EXTRACT_8BITS() macro to fetch a one-byte value (17/n) Assignment, *p++ -> EXTRACT_8BITS(p); p++; Partial list.
2017-11-22 03:23:59 +08:00
cp++; /* total including type, len */
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
if (len < 2 || len > hlen)
goto bad;
--hlen; /* account for length byte */
}
--hlen; /* account for type byte */
datalen = 0;
Initial revision
1999-10-08 07:47:09 +08:00
/* Bail if "l" bytes of data are not left or were not captured */
TCP: Modernize packet parsing style. Enable ND_LONGJMP_FROM_TCHECK. Report invalid packets as invalid. Remove most ND_TCHECK*() instances as they were redundant. Update a custom snapend guard to use nd_trunc_longjmp(). Reduce arity of print_tcp_fastopen_option(). Use ND_TTEST_LEN() in tcp_verify_signature() and nd_printn() in print_tcp_rst_data(). For NFS_PORT remove ND_TTEST_4() from the test condition as it is not a valid factor, there is the subsequent GET_BE_U_4() to check bounds.
2021-01-18 05:22:34 +08:00
#define LENCHECK(l) { if ((l) > hlen) goto bad; }
Initial revision
1999-10-08 07:47:09 +08:00
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ND_PRINT("%s", tok2str(tcp_option_values, "unknown-%u", opt));
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
switch (opt) {
case TCPOPT_MAXSEG:
datalen = 2;
LENCHECK(datalen);
Use the new GET_ macros instead of the EXTRACT_ ones The exceptions are currently: Some EXTRACT_ in print-juniper.c, not used on packet buffer pointer. An EXTRACT_BE_U_3 in addrtoname.c, not always used on packet buffer pointer.
2018-06-16 23:23:21 +08:00
ND_PRINT(" %u", GET_BE_U_2(cp));
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
break;
case TCPOPT_WSCALE:
datalen = 1;
LENCHECK(datalen);
Use the new GET_ macros instead of the EXTRACT_ ones The exceptions are currently: Some EXTRACT_ in print-juniper.c, not used on packet buffer pointer. An EXTRACT_BE_U_3 in addrtoname.c, not always used on packet buffer pointer.
2018-06-16 23:23:21 +08:00
ND_PRINT(" %u", GET_U_1(cp));
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
break;
case TCPOPT_SACK:
datalen = len - 2;
if (datalen % 8 != 0) {
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ND_PRINT(" invalid sack");
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
} else {
u_intN_t is dead, long live uintN_t. And, as we require at least autoconf 2.61, and as autoconf 2.61 and later have AC_TYPE_UINTn_T and AC_TYPE_INTn_T macros, we use them to define the uintN_t and intN_t macros if the system doesn't define them for us. This lets us get rid of bitypes.h as well.
2014-04-23 15:20:40 +08:00
uint32_t s, e;
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
Clean up signed vs. unsigned.
2018-01-12 03:52:30 +08:00
ND_PRINT(" %u ", datalen / 8);
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
for (i = 0; i < datalen; i += 8) {
LENCHECK(i + 4);
Use the new GET_ macros instead of the EXTRACT_ ones The exceptions are currently: Some EXTRACT_ in print-juniper.c, not used on packet buffer pointer. An EXTRACT_BE_U_3 in addrtoname.c, not always used on packet buffer pointer.
2018-06-16 23:23:21 +08:00
s = GET_BE_U_4(cp + i);
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
LENCHECK(i + 8);
Use the new GET_ macros instead of the EXTRACT_ ones The exceptions are currently: Some EXTRACT_ in print-juniper.c, not used on packet buffer pointer. An EXTRACT_BE_U_3 in addrtoname.c, not always used on packet buffer pointer.
2018-06-16 23:23:21 +08:00
e = GET_BE_U_4(cp + i + 4);
merge 'threv' and 'rev' variables in print-tcp into just 'rev'
2013-10-06 07:37:15 +08:00
if (rev) {
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
s -= thseq;
e -= thseq;
} else {
s -= thack;
e -= thack;
}
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ND_PRINT("{%u:%u}", s, e);
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
}
}
break;
case TCPOPT_CC:
case TCPOPT_CCNEW:
case TCPOPT_CCECHO:
case TCPOPT_ECHO:
case TCPOPT_ECHOREPLY:
/*
* those options share their semantics.
* fall through
*/
datalen = 4;
LENCHECK(datalen);
Use the new GET_ macros instead of the EXTRACT_ ones The exceptions are currently: Some EXTRACT_ in print-juniper.c, not used on packet buffer pointer. An EXTRACT_BE_U_3 in addrtoname.c, not always used on packet buffer pointer.
2018-06-16 23:23:21 +08:00
ND_PRINT(" %u", GET_BE_U_4(cp));
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
break;
case TCPOPT_TIMESTAMP:
datalen = 8;
LENCHECK(datalen);
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ND_PRINT(" val %u ecr %u",
Use the new GET_ macros instead of the EXTRACT_ ones The exceptions are currently: Some EXTRACT_ in print-juniper.c, not used on packet buffer pointer. An EXTRACT_BE_U_3 in addrtoname.c, not always used on packet buffer pointer.
2018-06-16 23:23:21 +08:00
GET_BE_U_4(cp),
GET_BE_U_4(cp + 4));
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
break;
case TCPOPT_SIGNATURE:
datalen = TCP_SIGLEN;
LENCHECK(datalen);
TCP: Modernize packet parsing style. Enable ND_LONGJMP_FROM_TCHECK. Report invalid packets as invalid. Remove most ND_TCHECK*() instances as they were redundant. Update a custom snapend guard to use nd_trunc_longjmp(). Reduce arity of print_tcp_fastopen_option(). Use ND_TTEST_LEN() in tcp_verify_signature() and nd_printn() in print_tcp_rst_data(). For NFS_PORT remove ND_TTEST_4() from the test condition as it is not a valid factor, there is the subsequent GET_BE_U_4() to check bounds.
2021-01-18 05:22:34 +08:00
ND_TCHECK_LEN(cp, datalen);
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ND_PRINT(" ");
From Bruce M. Simpson: add a "-M" flag to specify a shared secret for TCP-MD5 (RFC 2385) digest verification if we have libcrypto.
2004-03-23 15:15:36 +08:00
#ifdef HAVE_LIBCRYPTO
NDOize DECnet, OSPF and TCP decoders
2014-04-02 16:59:56 +08:00
switch (tcp_verify_signature(ndo, ip, tp,
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
bp + TH_OFF(tp) * 4, length, cp)) {
case SIGNATURE_VALID:
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ND_PRINT("valid");
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
break;
case SIGNATURE_INVALID:
Use more nd_print_invalid()
2018-11-02 22:14:52 +08:00
nd_print_invalid(ndo);
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
break;
case CANT_CHECK_SIGNATURE:
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ND_PRINT("can't check - ");
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
for (i = 0; i < TCP_SIGLEN; ++i)
Use the new GET_ macros instead of the EXTRACT_ ones The exceptions are currently: Some EXTRACT_ in print-juniper.c, not used on packet buffer pointer. An EXTRACT_BE_U_3 in addrtoname.c, not always used on packet buffer pointer.
2018-06-16 23:23:21 +08:00
ND_PRINT("%02x",
GET_U_1(cp + i));
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
break;
}
From Bruce M. Simpson: add a "-M" flag to specify a shared secret for TCP-MD5 (RFC 2385) digest verification if we have libcrypto.
2004-03-23 15:15:36 +08:00
#else
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
for (i = 0; i < TCP_SIGLEN; ++i)
Use the new GET_ macros instead of the EXTRACT_ ones The exceptions are currently: Some EXTRACT_ in print-juniper.c, not used on packet buffer pointer. An EXTRACT_BE_U_3 in addrtoname.c, not always used on packet buffer pointer.
2018-06-16 23:23:21 +08:00
ND_PRINT("%02x", GET_U_1(cp + i));
From Bruce M. Simpson: add a "-M" flag to specify a shared secret for TCP-MD5 (RFC 2385) digest verification if we have libcrypto.
2004-03-23 15:15:36 +08:00
#endif
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
break;
From Bruce M. Simpson: add a "-M" flag to specify a shared secret for TCP-MD5 (RFC 2385) digest verification if we have libcrypto.
2004-03-23 15:15:36 +08:00
Correct TCP option Kind value for TCP Auth and add SCPS-TP. Fixes first problem in issue #516 while the second one isn't broken in tcpdump.
2016-05-06 03:31:01 +08:00
case TCPOPT_SCPS:
datalen = 2;
LENCHECK(datalen);
Use the new GET_ macros instead of the EXTRACT_ ones The exceptions are currently: Some EXTRACT_ in print-juniper.c, not used on packet buffer pointer. An EXTRACT_BE_U_3 in addrtoname.c, not always used on packet buffer pointer.
2018-06-16 23:23:21 +08:00
ND_PRINT(" cap %02x id %u", GET_U_1(cp),
GET_U_1(cp + 1));
Correct TCP option Kind value for TCP Auth and add SCPS-TP. Fixes first problem in issue #516 while the second one isn't broken in tcpdump.
2016-05-06 03:31:01 +08:00
break;
TCP: put TCP-AO option decoding right As it was correctly pointed out in GitHub issue #516, the TCPOPT_TCPAO (formerly TCPOPT_AUTH) case had an issue with option length processing, though without significant consequences thanks to a check elsewhere. Besides that, the old code (introduced in 2005) decoded a structure similar to a proposed encoding variant of the early (first published in 2007) revisions of the Internet-Draft but different from the encoding of RFC 5925 (published in 2010). These issues are now addressed and the TCP option renamed to TCP-AO.
2016-11-02 01:05:01 +08:00
case TCPOPT_TCPAO:
datalen = len - 2;
/* RFC 5925 Section 2.2:
* "The Length value MUST be greater than or equal to 4."
* (This includes the Kind and Length fields already processed
* at this point.)
*/
if (datalen < 2) {
Use more nd_print_invalid()
2018-11-02 22:14:52 +08:00
nd_print_invalid(ndo);
TCP: put TCP-AO option decoding right As it was correctly pointed out in GitHub issue #516, the TCPOPT_TCPAO (formerly TCPOPT_AUTH) case had an issue with option length processing, though without significant consequences thanks to a check elsewhere. Besides that, the old code (introduced in 2005) decoded a structure similar to a proposed encoding variant of the early (first published in 2007) revisions of the Internet-Draft but different from the encoding of RFC 5925 (published in 2010). These issues are now addressed and the TCP option renamed to TCP-AO.
2016-11-02 01:05:01 +08:00
} else {
LENCHECK(1);
Use the new GET_ macros instead of the EXTRACT_ ones The exceptions are currently: Some EXTRACT_ in print-juniper.c, not used on packet buffer pointer. An EXTRACT_BE_U_3 in addrtoname.c, not always used on packet buffer pointer.
2018-06-16 23:23:21 +08:00
ND_PRINT(" keyid %u", GET_U_1(cp));
TCP: put TCP-AO option decoding right As it was correctly pointed out in GitHub issue #516, the TCPOPT_TCPAO (formerly TCPOPT_AUTH) case had an issue with option length processing, though without significant consequences thanks to a check elsewhere. Besides that, the old code (introduced in 2005) decoded a structure similar to a proposed encoding variant of the early (first published in 2007) revisions of the Internet-Draft but different from the encoding of RFC 5925 (published in 2010). These issues are now addressed and the TCP option renamed to TCP-AO.
2016-11-02 01:05:01 +08:00
LENCHECK(2);
Use the new GET_ macros instead of the EXTRACT_ ones The exceptions are currently: Some EXTRACT_ in print-juniper.c, not used on packet buffer pointer. An EXTRACT_BE_U_3 in addrtoname.c, not always used on packet buffer pointer.
2018-06-16 23:23:21 +08:00
ND_PRINT(" rnextkeyid %u",
GET_U_1(cp + 1));
TCP: put TCP-AO option decoding right As it was correctly pointed out in GitHub issue #516, the TCPOPT_TCPAO (formerly TCPOPT_AUTH) case had an issue with option length processing, though without significant consequences thanks to a check elsewhere. Besides that, the old code (introduced in 2005) decoded a structure similar to a proposed encoding variant of the early (first published in 2007) revisions of the Internet-Draft but different from the encoding of RFC 5925 (published in 2010). These issues are now addressed and the TCP option renamed to TCP-AO.
2016-11-02 01:05:01 +08:00
if (datalen > 2) {
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ND_PRINT(" mac 0x");
TCP: put TCP-AO option decoding right As it was correctly pointed out in GitHub issue #516, the TCPOPT_TCPAO (formerly TCPOPT_AUTH) case had an issue with option length processing, though without significant consequences thanks to a check elsewhere. Besides that, the old code (introduced in 2005) decoded a structure similar to a proposed encoding variant of the early (first published in 2007) revisions of the Internet-Draft but different from the encoding of RFC 5925 (published in 2010). These issues are now addressed and the TCP option renamed to TCP-AO.
2016-11-02 01:05:01 +08:00
for (i = 2; i < datalen; i++) {
LENCHECK(i + 1);
Use the new GET_ macros instead of the EXTRACT_ ones The exceptions are currently: Some EXTRACT_ in print-juniper.c, not used on packet buffer pointer. An EXTRACT_BE_U_3 in addrtoname.c, not always used on packet buffer pointer.
2018-06-16 23:23:21 +08:00
ND_PRINT("%02x",
GET_U_1(cp + i));
TCP: put TCP-AO option decoding right As it was correctly pointed out in GitHub issue #516, the TCPOPT_TCPAO (formerly TCPOPT_AUTH) case had an issue with option length processing, though without significant consequences thanks to a check elsewhere. Besides that, the old code (introduced in 2005) decoded a structure similar to a proposed encoding variant of the early (first published in 2007) revisions of the Internet-Draft but different from the encoding of RFC 5925 (published in 2010). These issues are now addressed and the TCP option renamed to TCP-AO.
2016-11-02 01:05:01 +08:00
}
}
add basic support for keyed authentication TCP option
2005-11-29 17:07:47 +08:00
}
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
break;
case TCPOPT_EOL:
case TCPOPT_NOP:
case TCPOPT_SACKOK:
/*
* Nothing interesting.
* fall through
*/
break;
From Fang Wang: RFC 5482 specifies a new TCP option -- the TCP User Timeout Option (UTO) -- that allows one end of a TCP connection to advertise its current user timeout value. The Kind of UTO option is 28 and the Length is 4. The tcpdump currently does not recognize UTO option.
2009-08-19 06:02:37 +08:00
case TCPOPT_UTO:
datalen = 2;
LENCHECK(datalen);
Use the new GET_ macros instead of the EXTRACT_ ones The exceptions are currently: Some EXTRACT_ in print-juniper.c, not used on packet buffer pointer. An EXTRACT_BE_U_3 in addrtoname.c, not always used on packet buffer pointer.
2018-06-16 23:23:21 +08:00
utoval = GET_BE_U_2(cp);
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ND_PRINT(" 0x%x", utoval);
From Fang Wang: RFC 5482 specifies a new TCP option -- the TCP User Timeout Option (UTO) -- that allows one end of a TCP connection to advertise its current user timeout value. The Kind of UTO option is 28 and the Length is 4. The tcpdump currently does not recognize UTO option.
2009-08-19 06:02:37 +08:00
if (utoval & 0x0001)
utoval = (utoval >> 1) * 60;
else
utoval >>= 1;
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ND_PRINT(" %u", utoval);
From Fang Wang: RFC 5482 specifies a new TCP option -- the TCP User Timeout Option (UTO) -- that allows one end of a TCP connection to advertise its current user timeout value. The Kind of UTO option is 28 and the Length is 4. The tcpdump currently does not recognize UTO option.
2009-08-19 06:02:37 +08:00
break;
Multipath TCP (RFC 6824) support This commit adds the support of Multipath TCP (MPTCP). MPTCP is a new extension to TCP standardized at the IETF. MPTCP allows to use several IP addresses at the same time by distributing data across several subflows (TCP connections) while still presenting the standard TCP socket API to the application. Its benefits are better resource utilization, better throughput and smoother reaction to failures.
2013-02-26 00:00:02 +08:00
case TCPOPT_MPTCP:
TCP: Add a bounds check before decoding the payload At least the header data is required. Moreover: Update the output of a test accordingly. Fix indentation.
2021-02-13 04:49:40 +08:00
{
TCP: Update the snapend before decoding a MPTCP option Update the snapend to the end of the option before calling mptcp_print(). Some options (MPTCP or others) may be present after a MPTCP option. This prevents that, in mptcp_print(), the remaining length < the remaining caplen.
2021-02-12 04:09:00 +08:00
const u_char *snapend_save;
int ret;
Multipath TCP (RFC 6824) support This commit adds the support of Multipath TCP (MPTCP). MPTCP is a new extension to TCP standardized at the IETF. MPTCP allows to use several IP addresses at the same time by distributing data across several subflows (TCP connections) while still presenting the standard TCP socket API to the application. Its benefits are better resource utilization, better throughput and smoother reaction to failures.
2013-02-26 00:00:02 +08:00
datalen = len - 2;
Fix MPTCP support Added: * option length check * option type and TCP flags check * more information printed Signed-off-by: Gregory Detal <gregory.detal@uclouvain.be>
2013-04-17 22:05:21 +08:00
LENCHECK(datalen);
TCP: Modernize packet parsing style. Enable ND_LONGJMP_FROM_TCHECK. Report invalid packets as invalid. Remove most ND_TCHECK*() instances as they were redundant. Update a custom snapend guard to use nd_trunc_longjmp(). Reduce arity of print_tcp_fastopen_option(). Use ND_TTEST_LEN() in tcp_verify_signature() and nd_printn() in print_tcp_rst_data(). For NFS_PORT remove ND_TTEST_4() from the test condition as it is not a valid factor, there is the subsequent GET_BE_U_4() to check bounds.
2021-01-18 05:22:34 +08:00
/* FIXME: Proof-read mptcp_print() and if it
* always covers all bytes when it returns 1,
* only do ND_TCHECK_LEN() if it returned 0.
*/
ND_TCHECK_LEN(cp, datalen);
TCP: Add a comment This is a follow-up to commit 568d18f6eafb8df0d2500652b1cad49618051349. [skip ci]
2021-02-17 04:01:27 +08:00
/* Update the snapend to the end of the option
* before calling mptcp_print(). Some options
* (MPTCP or others) may be present after a
* MPTCP option. This prevents that, in
* mptcp_print(), the remaining length < the
* remaining caplen.
*/
TCP: Update the snapend before decoding a MPTCP option Update the snapend to the end of the option before calling mptcp_print(). Some options (MPTCP or others) may be present after a MPTCP option. This prevents that, in mptcp_print(), the remaining length < the remaining caplen.
2021-02-12 04:09:00 +08:00
snapend_save = ndo->ndo_snapend;
ndo->ndo_snapend = ND_MIN(cp - 2 + len,
ndo->ndo_snapend);
ret = mptcp_print(ndo, cp - 2, len, flags);
ndo->ndo_snapend = snapend_save;
if (!ret)
Multipath TCP (RFC 6824) support This commit adds the support of Multipath TCP (MPTCP). MPTCP is a new extension to TCP standardized at the IETF. MPTCP allows to use several IP addresses at the same time by distributing data across several subflows (TCP connections) while still presenting the standard TCP socket API to the application. Its benefits are better resource utilization, better throughput and smoother reaction to failures.
2013-02-26 00:00:02 +08:00
goto bad;
break;
TCP: Update the snapend before decoding a MPTCP option Update the snapend to the end of the option before calling mptcp_print(). Some options (MPTCP or others) may be present after a MPTCP option. This prevents that, in mptcp_print(), the remaining length < the remaining caplen.
2021-02-12 04:09:00 +08:00
}
Multipath TCP (RFC 6824) support This commit adds the support of Multipath TCP (MPTCP). MPTCP is a new extension to TCP standardized at the IETF. MPTCP allows to use several IP addresses at the same time by distributing data across several subflows (TCP connections) while still presenting the standard TCP socket API to the application. Its benefits are better resource utilization, better throughput and smoother reaction to failures.
2013-02-26 00:00:02 +08:00
Add support for TCP Fast Open official IANA option number https://tools.ietf.org/html/rfc7413
2015-04-08 08:42:55 +08:00
case TCPOPT_FASTOPEN:
datalen = len - 2;
LENCHECK(datalen);
TCP: Modernize packet parsing style. Enable ND_LONGJMP_FROM_TCHECK. Report invalid packets as invalid. Remove most ND_TCHECK*() instances as they were redundant. Update a custom snapend guard to use nd_trunc_longjmp(). Reduce arity of print_tcp_fastopen_option(). Use ND_TTEST_LEN() in tcp_verify_signature() and nd_printn() in print_tcp_rst_data(). For NFS_PORT remove ND_TTEST_4() from the test condition as it is not a valid factor, there is the subsequent GET_BE_U_4() to check bounds.
2021-01-18 05:22:34 +08:00
ND_TCHECK_LEN(cp, datalen);
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ND_PRINT(" ");
TCP: Modernize packet parsing style. Enable ND_LONGJMP_FROM_TCHECK. Report invalid packets as invalid. Remove most ND_TCHECK*() instances as they were redundant. Update a custom snapend guard to use nd_trunc_longjmp(). Reduce arity of print_tcp_fastopen_option(). Use ND_TTEST_LEN() in tcp_verify_signature() and nd_printn() in print_tcp_rst_data(). For NFS_PORT remove ND_TTEST_4() from the test condition as it is not a valid factor, there is the subsequent GET_BE_U_4() to check bounds.
2021-01-18 05:22:34 +08:00
print_tcp_fastopen_option(ndo, cp, datalen);
Add support for TCP Fast Open official IANA option number https://tools.ietf.org/html/rfc7413
2015-04-08 08:42:55 +08:00
break;
add support for experimental tcp fast open and parsing experimental options
2013-06-16 11:46:54 +08:00
case TCPOPT_EXPERIMENT2:
datalen = len - 2;
LENCHECK(datalen);
TCP: Modernize packet parsing style. Enable ND_LONGJMP_FROM_TCHECK. Report invalid packets as invalid. Remove most ND_TCHECK*() instances as they were redundant. Update a custom snapend guard to use nd_trunc_longjmp(). Reduce arity of print_tcp_fastopen_option(). Use ND_TTEST_LEN() in tcp_verify_signature() and nd_printn() in print_tcp_rst_data(). For NFS_PORT remove ND_TTEST_4() from the test condition as it is not a valid factor, there is the subsequent GET_BE_U_4() to check bounds.
2021-01-18 05:22:34 +08:00
ND_TCHECK_LEN(cp, datalen);
add support for experimental tcp fast open and parsing experimental options
2013-06-16 11:46:54 +08:00
if (datalen < 2)
goto bad;
add a acomment to tcp_print()
2013-10-03 15:10:26 +08:00
/* RFC6994 */
Use the new GET_ macros instead of the EXTRACT_ ones The exceptions are currently: Some EXTRACT_ in print-juniper.c, not used on packet buffer pointer. An EXTRACT_BE_U_3 in addrtoname.c, not always used on packet buffer pointer.
2018-06-16 23:23:21 +08:00
magic = GET_BE_U_2(cp);
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ND_PRINT("-");
add support for experimental tcp fast open and parsing experimental options
2013-06-16 11:46:54 +08:00
switch(magic) {
Add support for TCP Fast Open official IANA option number https://tools.ietf.org/html/rfc7413
2015-04-08 08:42:55 +08:00
case 0xf989: /* TCP Fast Open RFC 7413 */
TCP: Modernize packet parsing style. Enable ND_LONGJMP_FROM_TCHECK. Report invalid packets as invalid. Remove most ND_TCHECK*() instances as they were redundant. Update a custom snapend guard to use nd_trunc_longjmp(). Reduce arity of print_tcp_fastopen_option(). Use ND_TTEST_LEN() in tcp_verify_signature() and nd_printn() in print_tcp_rst_data(). For NFS_PORT remove ND_TTEST_4() from the test condition as it is not a valid factor, there is the subsequent GET_BE_U_4() to check bounds.
2021-01-18 05:22:34 +08:00
ND_PRINT("tfo");
print_tcp_fastopen_option(ndo, cp + 2, datalen - 2);
add support for experimental tcp fast open and parsing experimental options
2013-06-16 11:46:54 +08:00
break;
default:
/* Unknown magic number */
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ND_PRINT("%04x", magic);
add support for experimental tcp fast open and parsing experimental options
2013-06-16 11:46:54 +08:00
break;
}
break;
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
default:
datalen = len - 2;
fix printing of unknown TCP options TCP options decoder would mix decimal and hexadecimal digits when printing an unknown option. For example, the pre-TFO revision would print TFO as follows: [Unknown Option 254f989090909090000] Refine output format to print the same data as follows: [unknown-254 0xf989090909090000]
2013-10-26 16:21:04 +08:00
if (datalen)
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ND_PRINT(" 0x");
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
for (i = 0; i < datalen; ++i) {
CVE-2016-7975/Fix a bounds check. Fixes a heap overflow found with American Fuzzy Lop by Hanno Böck.
2015-07-04 03:37:37 +08:00
LENCHECK(i + 1);
Use the new GET_ macros instead of the EXTRACT_ ones The exceptions are currently: Some EXTRACT_ in print-juniper.c, not used on packet buffer pointer. An EXTRACT_BE_U_3 in addrtoname.c, not always used on packet buffer pointer.
2018-06-16 23:23:21 +08:00
ND_PRINT("%02x", GET_U_1(cp + i));
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
}
break;
}
/* Account for data printed */
cp += datalen;
hlen -= datalen;
/* Check specification against observed length */
Clean up whitespaces
2018-10-27 23:36:31 +08:00
++datalen; /* option octet */
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
if (!ZEROLENOPT(opt))
Clean up whitespaces
2018-10-27 23:36:31 +08:00
++datalen; /* size octet */
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
if (datalen != len)
Clean up signed vs. unsigned.
2018-01-12 03:52:30 +08:00
ND_PRINT("[len %u]", len);
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
ch = ',';
if (opt == TCPOPT_EOL)
break;
}
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ND_PRINT("]");
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
}
/*
* Print length field before crawling down the stack.
*/
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ND_PRINT(", length %u", length);
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
if (length <= 0)
return;
/*
* Decode payload if necessary.
*/
TCP: Add a bounds check before decoding the payload At least the header data is required. Moreover: Update the output of a test accordingly. Fix indentation.
2021-02-13 04:49:40 +08:00
header_len = TH_OFF(tp) * 4;
/*
* Do a bounds check before decoding the payload.
* At least the header data is required.
*/
if (!ND_TTEST_LEN(bp, header_len)) {
ND_PRINT(" [remaining caplen(%u) < header length(%u)]",
ND_BYTES_AVAILABLE_AFTER(bp), header_len);
nd_trunc_longjmp(ndo);
}
bp += header_len;
NDOize DECnet, OSPF and TCP decoders
2014-04-02 16:59:56 +08:00
if ((flags & TH_RST) && ndo->ndo_vflag) {
print_tcp_rst_data(ndo, bp, length);
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
return;
whitespace changes
2014-01-02 10:27:54 +08:00
}
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
NDOize DECnet, OSPF and TCP decoders
2014-04-02 16:59:56 +08:00
if (ndo->ndo_packettype) {
switch (ndo->ndo_packettype) {
ZeroMQ initial support (ZMTP/1.0 framing) This change adds support for ZMTP/1.0 (ZeroMQ Message Transport Protocol 1.0) framing in TCP packets, as defined in http://rfc.zeromq.org/spec:13 and implemented in zeromq library. Since there is no assigned port number for ZeroMQ, the user is left responsible for making only the related TCP packets captured and enforcing ZMTP/1.0 decoding through the "-T zmtp1" option. Each ZMTP/1.0 frame of a packet will produce a single additional line of output. The "-v" flag will add up to 8 lines (128 bytes) worth of hex+ASCII dump of the frame body, and "-vv" and higher will dump the full frame body, however long. Beware that this code handles neither IP fragmentation nor TCP segmentation and will incorrectly decode segments not starting at a frame boundary. The included sample capture stands for a short ZeroMQ session between a REQ/REP socket pair doing 3 anonymous 2-way exchanges. It was produced using version 2.1.9 of zeromq library patched to fix its bug #293, so that all MBZ bits of the flags field are set to 0.
2013-02-09 21:36:24 +08:00
case PT_ZMTP1:
NDOize DECnet, OSPF and TCP decoders
2014-04-02 16:59:56 +08:00
zmtp1_print(ndo, bp, length);
ZeroMQ initial support (ZMTP/1.0 framing) This change adds support for ZMTP/1.0 (ZeroMQ Message Transport Protocol 1.0) framing in TCP packets, as defined in http://rfc.zeromq.org/spec:13 and implemented in zeromq library. Since there is no assigned port number for ZeroMQ, the user is left responsible for making only the related TCP packets captured and enforcing ZMTP/1.0 decoding through the "-T zmtp1" option. Each ZMTP/1.0 frame of a packet will produce a single additional line of output. The "-v" flag will add up to 8 lines (128 bytes) worth of hex+ASCII dump of the frame body, and "-vv" and higher will dump the full frame body, however long. Beware that this code handles neither IP fragmentation nor TCP segmentation and will incorrectly decode segments not starting at a frame boundary. The included sample capture stands for a short ZeroMQ session between a REQ/REP socket pair doing 3 anonymous 2-way exchanges. It was produced using version 2.1.9 of zeromq library patched to fix its bug #293, so that all MBZ bits of the flags field are set to 0.
2013-02-09 21:36:24 +08:00
break;
Initial support for the REdis Serialization Protocol known as RESP. This commit adds support for RESP as defined in: http://redis.io/topics/protocol. It also supports inline commands and pipelining. Due to the popularity of RESP, numerous services are emerging that use this protocol. You may decode RESP packets on arbitrary ports using the "-T resp" option. Example captures can be found in tests/resp_*. A simple way to test this parser is to start redis-server and then run redis-cli commands such as "redis-cli set key value". Traditionally, redis-cli monitor is used to debug redis. Unfortunately, the "monitor" command can cause significant load on a redis-server in production. This parser may be used as a non-invasive alternative to redis-cli monitor.
2016-01-13 01:32:55 +08:00
case PT_RESP:
resp_print(ndo, bp, length);
break;
Add "domain" as an option for -T This allows tcpdump to handle DNS running on non-standard ports. Add two test files with DNS over TCP and DNS over UDP, port 8053.
2020-03-02 23:04:35 +08:00
case PT_DOMAIN:
DNS: Do the 'over TCP' processing in the printer Add the parameter 'over_tcp'. Move the shift by 2 bytes from the TCP printer to the DNS printer. Move adding a prepended space from the TCP printer to the DNS printer. Add a length check. Add some comments about 'over_tcp' and 'is_mdns' call values.
2020-06-10 18:13:53 +08:00
/* over_tcp: TRUE, is_mdns: FALSE */
domain_print(ndo, bp, length, TRUE, FALSE);
Add "domain" as an option for -T This allows tcpdump to handle DNS running on non-standard ports. Add two test files with DNS over TCP and DNS over UDP, port 8053.
2020-03-02 23:04:35 +08:00
break;
ZeroMQ initial support (ZMTP/1.0 framing) This change adds support for ZMTP/1.0 (ZeroMQ Message Transport Protocol 1.0) framing in TCP packets, as defined in http://rfc.zeromq.org/spec:13 and implemented in zeromq library. Since there is no assigned port number for ZeroMQ, the user is left responsible for making only the related TCP packets captured and enforcing ZMTP/1.0 decoding through the "-T zmtp1" option. Each ZMTP/1.0 frame of a packet will produce a single additional line of output. The "-v" flag will add up to 8 lines (128 bytes) worth of hex+ASCII dump of the frame body, and "-vv" and higher will dump the full frame body, however long. Beware that this code handles neither IP fragmentation nor TCP segmentation and will incorrectly decode segments not starting at a frame boundary. The included sample capture stands for a short ZeroMQ session between a REQ/REP socket pair doing 3 anonymous 2-way exchanges. It was produced using version 2.1.9 of zeromq library patched to fix its bug #293, so that all MBZ bits of the flags field are set to 0.
2013-02-09 21:36:24 +08:00
}
return;
}
Harmonize TCP source or destination ports tests with UDP ones
2015-12-15 03:28:14 +08:00
if (IS_SRC_OR_DST_PORT(TELNET_PORT)) {
Print *something* for Telnet regardless of the -q/-v flags. For -q, just print "[telnet]". Without -v, at least print the negotiation.
2014-10-20 04:01:59 +08:00
telnet_print(ndo, bp, length);
Harmonize TCP source or destination ports tests with UDP ones
2015-12-15 03:28:14 +08:00
} else if (IS_SRC_OR_DST_PORT(SMTP_PORT)) {
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ND_PRINT(": ");
Add a routine to print "text protocols", and add FTP/HTTP/SMTP/RTSP support. "Text protocols" are protocols that have the general feel of FTP, with command lines with a command name and space-separated arguments and response lines beginning with a 3-digit reply code. They can also include HTTP-style headers and an entity body. We add support for the FTP control channel, HTTP, SMTP, and RTSP. We also change the SIP printer to use it.
2014-10-20 02:21:44 +08:00
smtp_print(ndo, bp, length);
WHOIS is a plain text protocol, why not decode it. With txtproto_print() this has become trivial. Add a test.
2017-10-08 01:41:42 +08:00
} else if (IS_SRC_OR_DST_PORT(WHOIS_PORT)) {
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ND_PRINT(": ");
Use the ndo->ndo_protocol field instead of the protoname parameter Moreover: Fix a truncated string: "[!" is not the prefix for a truncated string. Add two comments. Clean up a whitespace.
2019-03-08 05:20:34 +08:00
ndo->ndo_protocol = "whois"; /* needed by txtproto_print() */
txtproto_print(ndo, bp, length, NULL, 0); /* RFC 3912 */
Harmonize TCP source or destination ports tests with UDP ones
2015-12-15 03:28:14 +08:00
} else if (IS_SRC_OR_DST_PORT(BGP_PORT))
NDOize DECnet, OSPF and TCP decoders
2014-04-02 16:59:56 +08:00
bgp_print(ndo, bp, length);
Harmonize TCP source or destination ports tests with UDP ones
2015-12-15 03:28:14 +08:00
else if (IS_SRC_OR_DST_PORT(PPTP_PORT))
NDOize DECnet, OSPF and TCP decoders
2014-04-02 16:59:56 +08:00
pptp_print(ndo, bp);
Initial support for the REdis Serialization Protocol known as RESP. This commit adds support for RESP as defined in: http://redis.io/topics/protocol. It also supports inline commands and pipelining. Due to the popularity of RESP, numerous services are emerging that use this protocol. You may decode RESP packets on arbitrary ports using the "-T resp" option. Example captures can be found in tests/resp_*. A simple way to test this parser is to start redis-server and then run redis-cli commands such as "redis-cli set key value". Traditionally, redis-cli monitor is used to debug redis. Unfortunately, the "monitor" command can cause significant load on a redis-server in production. This parser may be used as a non-invasive alternative to redis-cli monitor.
2016-01-13 01:32:55 +08:00
else if (IS_SRC_OR_DST_PORT(REDIS_PORT))
resp_print(ndo, bp, length);
Add dissector for SSH version exchange
2018-12-23 18:38:17 +08:00
else if (IS_SRC_OR_DST_PORT(SSH_PORT))
ssh_print(ndo, bp, length);
Get rid of "TCPDUMP" in some libnetdissect codes
2015-10-08 22:36:23 +08:00
#ifdef ENABLE_SMB
Harmonize TCP source or destination ports tests with UDP ones
2015-12-15 03:28:14 +08:00
else if (IS_SRC_OR_DST_PORT(NETBIOS_SSN_PORT))
NDOize DECnet, OSPF and TCP decoders
2014-04-02 16:59:56 +08:00
nbt_tcp_print(ndo, bp, length);
Clean up whitespaces
2018-10-27 23:36:31 +08:00
else if (IS_SRC_OR_DST_PORT(SMB_PORT))
smb_tcp_print(ndo, bp, length);
disable smb printing until we have boundary checks in *smb*.c (there's almost no boundary check).
2001-10-04 17:18:45 +08:00
#endif
Harmonize TCP source or destination ports tests with UDP ones
2015-12-15 03:28:14 +08:00
else if (IS_SRC_OR_DST_PORT(BEEP_PORT))
NDOize DECnet, OSPF and TCP decoders
2014-04-02 16:59:56 +08:00
beep_print(ndo, bp, length);
Harmonize TCP source or destination ports tests with UDP ones
2015-12-15 03:28:14 +08:00
else if (IS_SRC_OR_DST_PORT(OPENFLOW_PORT_OLD) || IS_SRC_OR_DST_PORT(OPENFLOW_PORT_IANA))
NDOize DECnet, OSPF and TCP decoders
2014-04-02 16:59:56 +08:00
openflow_print(ndo, bp, length);
Harmonize TCP source or destination ports tests with UDP ones
2015-12-15 03:28:14 +08:00
else if (IS_SRC_OR_DST_PORT(FTP_PORT)) {
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ND_PRINT(": ");
Add a routine to print "text protocols", and add FTP/HTTP/SMTP/RTSP support. "Text protocols" are protocols that have the general feel of FTP, with command lines with a command name and space-separated arguments and response lines beginning with a 3-digit reply code. They can also include HTTP-style headers and an entity body. We add support for the FTP control channel, HTTP, SMTP, and RTSP. We also change the SIP printer to use it.
2014-10-20 02:21:44 +08:00
ftp_print(ndo, bp, length);
Harmonize TCP source or destination ports tests with UDP ones
2015-12-15 03:28:14 +08:00
} else if (IS_SRC_OR_DST_PORT(HTTP_PORT) || IS_SRC_OR_DST_PORT(HTTP_PORT_ALT)) {
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ND_PRINT(": ");
Add a routine to print "text protocols", and add FTP/HTTP/SMTP/RTSP support. "Text protocols" are protocols that have the general feel of FTP, with command lines with a command name and space-separated arguments and response lines beginning with a 3-digit reply code. They can also include HTTP-style headers and an entity body. We add support for the FTP control channel, HTTP, SMTP, and RTSP. We also change the SIP printer to use it.
2014-10-20 02:21:44 +08:00
http_print(ndo, bp, length);
Harmonize TCP source or destination ports tests with UDP ones
2015-12-15 03:28:14 +08:00
} else if (IS_SRC_OR_DST_PORT(RTSP_PORT) || IS_SRC_OR_DST_PORT(RTSP_PORT_ALT)) {
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ND_PRINT(": ");
Add a routine to print "text protocols", and add FTP/HTTP/SMTP/RTSP support. "Text protocols" are protocols that have the general feel of FTP, with command lines with a command name and space-separated arguments and response lines beginning with a 3-digit reply code. They can also include HTTP-style headers and an entity body. We add support for the FTP control channel, HTTP, SMTP, and RTSP. We also change the SIP printer to use it.
2014-10-20 02:21:44 +08:00
rtsp_print(ndo, bp, length);
DNS: Do the 'over TCP' processing in the printer Add the parameter 'over_tcp'. Move the shift by 2 bytes from the TCP printer to the DNS printer. Move adding a prepended space from the TCP printer to the DNS printer. Add a length check. Add some comments about 'over_tcp' and 'is_mdns' call values.
2020-06-10 18:13:53 +08:00
} else if (IS_SRC_OR_DST_PORT(NAMESERVER_PORT)) {
/* over_tcp: TRUE, is_mdns: FALSE */
domain_print(ndo, bp, length, TRUE, FALSE);
Harmonize TCP source or destination ports tests with UDP ones
2015-12-15 03:28:14 +08:00
} else if (IS_SRC_OR_DST_PORT(MSDP_PORT)) {
NDOize DECnet, OSPF and TCP decoders
2014-04-02 16:59:56 +08:00
msdp_print(ndo, bp, length);
Harmonize TCP source or destination ports tests with UDP ones
2015-12-15 03:28:14 +08:00
} else if (IS_SRC_OR_DST_PORT(RPKI_RTR_PORT)) {
NDOize DECnet, OSPF and TCP decoders
2014-04-02 16:59:56 +08:00
rpki_rtr_print(ndo, bp, length);
TCP: Remove an useless test The length is tested in ldp_print().
2020-07-05 17:28:48 +08:00
} else if (IS_SRC_OR_DST_PORT(LDP_PORT)) {
NDOize DECnet, OSPF and TCP decoders
2014-04-02 16:59:56 +08:00
ldp_print(ndo, bp, length);
TCP: Update style [skip ci]
2020-06-09 19:55:07 +08:00
} else if ((IS_SRC_OR_DST_PORT(NFS_PORT)) &&
TCP: Modernize packet parsing style. Enable ND_LONGJMP_FROM_TCHECK. Report invalid packets as invalid. Remove most ND_TCHECK*() instances as they were redundant. Update a custom snapend guard to use nd_trunc_longjmp(). Reduce arity of print_tcp_fastopen_option(). Use ND_TTEST_LEN() in tcp_verify_signature() and nd_printn() in print_tcp_rst_data(). For NFS_PORT remove ND_TTEST_4() from the test condition as it is not a valid factor, there is the subsequent GET_BE_U_4() to check bounds.
2021-01-18 05:22:34 +08:00
length >= 4) {
print-tcp: move nfs specific dispacting to after the tcp header decoding
2013-10-18 07:56:18 +08:00
/*
* If data present, header length valid, and NFS port used,
* assume NFS.
* Pass offset of data plus 4 bytes for RPC TCP msg length
* to NFS print routines.
*/
u_intN_t is dead, long live uintN_t. And, as we require at least autoconf 2.61, and as autoconf 2.61 and later have AC_TYPE_UINTn_T and AC_TYPE_INTn_T macros, we use them to define the uintN_t and intN_t macros if the system doesn't define them for us. This lets us get rid of bitypes.h as well.
2014-04-23 15:20:40 +08:00
uint32_t fraglen;
Remove all storage class specifier 'register' Let the compiler do the optimizations (or not) based on build options. Avoid 'value has been optimized out' messages in gdb using '-O0'.
2017-12-14 02:17:47 +08:00
const struct sunrpc_msg *rp;
print-tcp: move nfs specific dispacting to after the tcp header decoding
2013-10-18 07:56:18 +08:00
enum sunrpc_msg_type direction;
Use the new GET_ macros instead of the EXTRACT_ ones The exceptions are currently: Some EXTRACT_ in print-juniper.c, not used on packet buffer pointer. An EXTRACT_BE_U_3 in addrtoname.c, not always used on packet buffer pointer.
2018-06-16 23:23:21 +08:00
fraglen = GET_BE_U_4(bp) & 0x7FFFFFFF;
print-tcp: move nfs specific dispacting to after the tcp header decoding
2013-10-18 07:56:18 +08:00
if (fraglen > (length) - 4)
fraglen = (length) - 4;
Fix a bunch of de-constifications.
2015-04-27 08:24:42 +08:00
rp = (const struct sunrpc_msg *)(bp + 4);
TCP: Use more ND_TTEST_n() macros
2018-01-09 06:14:20 +08:00
if (ND_TTEST_4(rp->rm_direction)) {
Use the new GET_ macros instead of the EXTRACT_ ones The exceptions are currently: Some EXTRACT_ in print-juniper.c, not used on packet buffer pointer. An EXTRACT_BE_U_3 in addrtoname.c, not always used on packet buffer pointer.
2018-06-16 23:23:21 +08:00
direction = (enum sunrpc_msg_type) GET_BE_U_4(rp->rm_direction);
print-tcp: move nfs specific dispacting to after the tcp header decoding
2013-10-18 07:56:18 +08:00
if (dport == NFS_PORT && direction == SUNRPC_CALL) {
Remove unneeded '&' when getting a pointer to an nd_uintN_t type
2018-01-09 01:40:03 +08:00
ND_PRINT(": NFS request xid %u ",
Use the new GET_ macros instead of the EXTRACT_ ones The exceptions are currently: Some EXTRACT_ in print-juniper.c, not used on packet buffer pointer. An EXTRACT_BE_U_3 in addrtoname.c, not always used on packet buffer pointer.
2018-06-16 23:23:21 +08:00
GET_BE_U_4(rp->rm_xid));
NFS: Rename two printer functions Their names must end with '_print'
2017-11-16 20:49:06 +08:00
nfsreq_noaddr_print(ndo, (const u_char *)rp, fraglen, (const u_char *)ip);
print-tcp: move nfs specific dispacting to after the tcp header decoding
2013-10-18 07:56:18 +08:00
return;
}
if (sport == NFS_PORT && direction == SUNRPC_REPLY) {
Remove unneeded '&' when getting a pointer to an nd_uintN_t type
2018-01-09 01:40:03 +08:00
ND_PRINT(": NFS reply xid %u ",
Use the new GET_ macros instead of the EXTRACT_ ones The exceptions are currently: Some EXTRACT_ in print-juniper.c, not used on packet buffer pointer. An EXTRACT_BE_U_3 in addrtoname.c, not always used on packet buffer pointer.
2018-06-16 23:23:21 +08:00
GET_BE_U_4(rp->rm_xid));
NFS: Rename two printer functions Their names must end with '_print'
2017-11-16 20:49:06 +08:00
nfsreply_noaddr_print(ndo, (const u_char *)rp, fraglen, (const u_char *)ip);
print-tcp: move nfs specific dispacting to after the tcp header decoding
2013-10-18 07:56:18 +08:00
return;
}
}
}
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
return;
TCP: Update style [skip ci]
2020-06-09 19:55:07 +08:00
bad:
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ND_PRINT("[bad opt]");
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
if (ch != '\0')
TCP: Fix a closing string It was ">", it must be "]" Update the output of some tests accordingly.
2018-05-18 15:58:36 +08:00
ND_PRINT("]");
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
return;
TCP: Modernize packet parsing style. Enable ND_LONGJMP_FROM_TCHECK. Report invalid packets as invalid. Remove most ND_TCHECK*() instances as they were redundant. Update a custom snapend guard to use nd_trunc_longjmp(). Reduce arity of print_tcp_fastopen_option(). Use ND_TTEST_LEN() in tcp_verify_signature() and nd_printn() in print_tcp_rst_data(). For NFS_PORT remove ND_TTEST_4() from the test condition as it is not a valid factor, there is the subsequent GET_BE_U_4() to check bounds.
2021-01-18 05:22:34 +08:00
invalid:
nd_print_invalid(ndo);
Initial revision
1999-10-08 07:47:09 +08:00
}
Changes from Kevin Steves to print, in an RST segment, the payload as text, as per RFC 1122: 4.2.2.12 RST Segment: RFC-793 Section 3.4 A TCP SHOULD allow a received RST segment to include data. DISCUSSION It has been suggested that a RST segment could contain ASCII text that encoded and explained the cause of the RST. No standard has yet been established for such data. as some TCP implementations (e.g., HP-UX 11.0) do that. Clean up the code that prints the payload of non-RST segments.
2000-07-29 17:06:23 +08:00
/*
* RFC1122 says the following on data in RST segments:
*
* 4.2.2.12 RST Segment: RFC-793 Section 3.4
*
* A TCP SHOULD allow a received RST segment to include data.
*
* DISCUSSION
* It has been suggested that a RST segment could contain
* ASCII text that encoded and explained the cause of the
* RST. No standard has yet been established for such
* data.
*
*/
static void
NDOize DECnet, OSPF and TCP decoders
2014-04-02 16:59:56 +08:00
print_tcp_rst_data(netdissect_options *ndo,
Remove all storage class specifier 'register' Let the compiler do the optimizations (or not) based on build options. Avoid 'value has been optimized out' messages in gdb using '-O0'.
2017-12-14 02:17:47 +08:00
const u_char *sp, u_int length)
Changes from Kevin Steves to print, in an RST segment, the payload as text, as per RFC 1122: 4.2.2.12 RST Segment: RFC-793 Section 3.4 A TCP SHOULD allow a received RST segment to include data. DISCUSSION It has been suggested that a RST segment could contain ASCII text that encoded and explained the cause of the RST. No standard has yet been established for such data. as some TCP implementations (e.g., HP-UX 11.0) do that. Clean up the code that prints the payload of non-RST segments.
2000-07-29 17:06:23 +08:00
{
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ND_PRINT(ND_TTEST_LEN(sp, length) ? " [RST" : " [!RST");
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
if (length > MAX_RST_DATA_LEN) {
length = MAX_RST_DATA_LEN; /* can use -X for longer */
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ND_PRINT("+"); /* indicate we truncate */
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
}
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ND_PRINT(" ");
TCP: Modernize packet parsing style. Enable ND_LONGJMP_FROM_TCHECK. Report invalid packets as invalid. Remove most ND_TCHECK*() instances as they were redundant. Update a custom snapend guard to use nd_trunc_longjmp(). Reduce arity of print_tcp_fastopen_option(). Use ND_TTEST_LEN() in tcp_verify_signature() and nd_printn() in print_tcp_rst_data(). For NFS_PORT remove ND_TTEST_4() from the test condition as it is not a valid factor, there is the subsequent GET_BE_U_4() to check bounds.
2021-01-18 05:22:34 +08:00
(void)nd_printn(ndo, sp, length, ndo->ndo_snapend);
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ND_PRINT("]");
Changes from Kevin Steves to print, in an RST segment, the payload as text, as per RFC 1122: 4.2.2.12 RST Segment: RFC-793 Section 3.4 A TCP SHOULD allow a received RST segment to include data. DISCUSSION It has been suggested that a RST segment could contain ASCII text that encoded and explained the cause of the RST. No standard has yet been established for such data. as some TCP implementations (e.g., HP-UX 11.0) do that. Clean up the code that prints the payload of non-RST segments.
2000-07-29 17:06:23 +08:00
}
From Bruce M. Simpson: add a "-M" flag to specify a shared secret for TCP-MD5 (RFC 2385) digest verification if we have libcrypto.
2004-03-23 15:15:36 +08:00
Add support for TCP Fast Open official IANA option number https://tools.ietf.org/html/rfc7413
2015-04-08 08:42:55 +08:00
static void
Remove all storage class specifier 'register' Let the compiler do the optimizations (or not) based on build options. Avoid 'value has been optimized out' messages in gdb using '-O0'.
2017-12-14 02:17:47 +08:00
print_tcp_fastopen_option(netdissect_options *ndo, const u_char *cp,
TCP: Modernize packet parsing style. Enable ND_LONGJMP_FROM_TCHECK. Report invalid packets as invalid. Remove most ND_TCHECK*() instances as they were redundant. Update a custom snapend guard to use nd_trunc_longjmp(). Reduce arity of print_tcp_fastopen_option(). Use ND_TTEST_LEN() in tcp_verify_signature() and nd_printn() in print_tcp_rst_data(). For NFS_PORT remove ND_TTEST_4() from the test condition as it is not a valid factor, there is the subsequent GET_BE_U_4() to check bounds.
2021-01-18 05:22:34 +08:00
u_int datalen)
Add support for TCP Fast Open official IANA option number https://tools.ietf.org/html/rfc7413
2015-04-08 08:42:55 +08:00
{
u_int i;
if (datalen == 0) {
/* Fast Open Cookie Request */
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ND_PRINT(" cookiereq");
Add support for TCP Fast Open official IANA option number https://tools.ietf.org/html/rfc7413
2015-04-08 08:42:55 +08:00
} else {
/* Fast Open Cookie */
if (datalen % 2 != 0 || datalen < 4 || datalen > 16) {
Use more nd_print_invalid()
2018-11-02 22:14:52 +08:00
nd_print_invalid(ndo);
Add support for TCP Fast Open official IANA option number https://tools.ietf.org/html/rfc7413
2015-04-08 08:42:55 +08:00
} else {
Update ND_PRINT() as a variadic macro
2018-01-07 18:47:30 +08:00
ND_PRINT(" cookie ");
Add support for TCP Fast Open official IANA option number https://tools.ietf.org/html/rfc7413
2015-04-08 08:42:55 +08:00
for (i = 0; i < datalen; ++i)
Use the new GET_ macros instead of the EXTRACT_ ones The exceptions are currently: Some EXTRACT_ in print-juniper.c, not used on packet buffer pointer. An EXTRACT_BE_U_3 in addrtoname.c, not always used on packet buffer pointer.
2018-06-16 23:23:21 +08:00
ND_PRINT("%02x", GET_U_1(cp + i));
Add support for TCP Fast Open official IANA option number https://tools.ietf.org/html/rfc7413
2015-04-08 08:42:55 +08:00
}
}
}
From Bruce M. Simpson: add a "-M" flag to specify a shared secret for TCP-MD5 (RFC 2385) digest verification if we have libcrypto.
2004-03-23 15:15:36 +08:00
#ifdef HAVE_LIBCRYPTO
adopt MacOS deprecation workaround from FreeRADIUS A MacOS build of tcpdump used to produce deprecation warnings on OpenSSL function calls. Alan DeKok explained that this is the effect of Apple's modifications to OpenSSL and that the very same problem has already been solved in FreeRADIUS server source code with pre-processor macros. Copy the macros into tcpdump header file and make use of them around the functions that call OpenSSL functions.
2013-10-16 21:59:13 +08:00
USES_APPLE_DEPRECATED_API
From Bruce M. Simpson: add a "-M" flag to specify a shared secret for TCP-MD5 (RFC 2385) digest verification if we have libcrypto.
2004-03-23 15:15:36 +08:00
static int
NDOize DECnet, OSPF and TCP decoders
2014-04-02 16:59:56 +08:00
tcp_verify_signature(netdissect_options *ndo,
const struct ip *ip, const struct tcphdr *tp,
Clean up signed vs. unsigned.
2018-01-12 03:52:30 +08:00
const u_char *data, u_int length, const u_char *rcvsig)
From Bruce M. Simpson: add a "-M" flag to specify a shared secret for TCP-MD5 (RFC 2385) digest verification if we have libcrypto.
2004-03-23 15:15:36 +08:00
{
get rid of warning in print-tcp.c about const violations. the signature checker was writing over a structure that should not have been modified - change the code to make a copy instead.
2004-04-05 08:12:54 +08:00
struct tcphdr tp1;
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
u_char sig[TCP_SIGLEN];
char zero_proto = 0;
MD5_CTX ctx;
u_intN_t is dead, long live uintN_t. And, as we require at least autoconf 2.61, and as autoconf 2.61 and later have AC_TYPE_UINTn_T and AC_TYPE_INTn_T macros, we use them to define the uintN_t and intN_t macros if the system doesn't define them for us. This lets us get rid of bitypes.h as well.
2014-04-23 15:20:40 +08:00
uint16_t savecsum, tlen;
Fix a bunch of de-constifications.
2015-04-27 08:24:42 +08:00
const struct ip6_hdr *ip6;
u_intN_t is dead, long live uintN_t. And, as we require at least autoconf 2.61, and as autoconf 2.61 and later have AC_TYPE_UINTn_T and AC_TYPE_INTn_T macros, we use them to define the uintN_t and intN_t macros if the system doesn't define them for us. This lets us get rid of bitypes.h as well.
2014-04-23 15:20:40 +08:00
uint32_t len32;
uint8_t nxt;
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
TCP: Modernize packet parsing style. Enable ND_LONGJMP_FROM_TCHECK. Report invalid packets as invalid. Remove most ND_TCHECK*() instances as they were redundant. Update a custom snapend guard to use nd_trunc_longjmp(). Reduce arity of print_tcp_fastopen_option(). Use ND_TTEST_LEN() in tcp_verify_signature() and nd_printn() in print_tcp_rst_data(). For NFS_PORT remove ND_TTEST_4() from the test condition as it is not a valid factor, there is the subsequent GET_BE_U_4() to check bounds.
2021-01-18 05:22:34 +08:00
if (!ND_TTEST_LEN(data, length)) {
Clean up whitespaces
2018-10-27 23:36:31 +08:00
ND_PRINT("snaplen too short, ");
return (CANT_CHECK_SIGNATURE);
}
Make sure the packet isn't cut short before verifying the MD5 signature. Indicate why we can't verify the MD5 signature.
2009-02-26 17:45:39 +08:00
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
tp1 = *tp;
NDOize DECnet, OSPF and TCP decoders
2014-04-02 16:59:56 +08:00
if (ndo->ndo_sigsecret == NULL) {
Clean up whitespaces
2018-10-27 23:36:31 +08:00
ND_PRINT("shared secret not supplied with -M, ");
fix runaway ND_PRINT() parentheses
2014-04-15 21:14:51 +08:00
return (CANT_CHECK_SIGNATURE);
Make sure the packet isn't cut short before verifying the MD5 signature. Indicate why we can't verify the MD5 signature.
2009-02-26 17:45:39 +08:00
}
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
MD5_Init(&ctx);
/*
* Step 1: Update MD5 hash with IP pseudo-header.
*/
if (IP_V(ip) == 4) {
Fix a bunch of de-constifications.
2015-04-27 08:24:42 +08:00
MD5_Update(&ctx, (const char *)&ip->ip_src, sizeof(ip->ip_src));
MD5_Update(&ctx, (const char *)&ip->ip_dst, sizeof(ip->ip_dst));
MD5_Update(&ctx, (const char *)&zero_proto, sizeof(zero_proto));
MD5_Update(&ctx, (const char *)&ip->ip_p, sizeof(ip->ip_p));
Use the new GET_ macros instead of the EXTRACT_ ones The exceptions are currently: Some EXTRACT_ in print-juniper.c, not used on packet buffer pointer. An EXTRACT_BE_U_3 in addrtoname.c, not always used on packet buffer pointer.
2018-06-16 23:23:21 +08:00
tlen = GET_BE_U_2(ip->ip_len) - IP_HL(ip) * 4;
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
tlen = htons(tlen);
Fix a bunch of de-constifications.
2015-04-27 08:24:42 +08:00
MD5_Update(&ctx, (const char *)&tlen, sizeof(tlen));
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
} else if (IP_V(ip) == 6) {
Fix a bunch of de-constifications.
2015-04-27 08:24:42 +08:00
ip6 = (const struct ip6_hdr *)ip;
MD5_Update(&ctx, (const char *)&ip6->ip6_src, sizeof(ip6->ip6_src));
MD5_Update(&ctx, (const char *)&ip6->ip6_dst, sizeof(ip6->ip6_dst));
Use the new GET_ macros instead of the EXTRACT_ ones The exceptions are currently: Some EXTRACT_ in print-juniper.c, not used on packet buffer pointer. An EXTRACT_BE_U_3 in addrtoname.c, not always used on packet buffer pointer.
2018-06-16 23:23:21 +08:00
len32 = htonl(GET_BE_U_2(ip6->ip6_plen));
Fix a bunch of de-constifications.
2015-04-27 08:24:42 +08:00
MD5_Update(&ctx, (const char *)&len32, sizeof(len32));
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
nxt = 0;
Fix a bunch of de-constifications.
2015-04-27 08:24:42 +08:00
MD5_Update(&ctx, (const char *)&nxt, sizeof(nxt));
MD5_Update(&ctx, (const char *)&nxt, sizeof(nxt));
MD5_Update(&ctx, (const char *)&nxt, sizeof(nxt));
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
nxt = IPPROTO_TCP;
Fix a bunch of de-constifications.
2015-04-27 08:24:42 +08:00
MD5_Update(&ctx, (const char *)&nxt, sizeof(nxt));
Make sure the packet isn't cut short before verifying the MD5 signature. Indicate why we can't verify the MD5 signature.
2009-02-26 17:45:39 +08:00
} else {
Clean up whitespaces
2018-10-27 23:36:31 +08:00
ND_PRINT("IP version not 4 or 6, ");
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
return (CANT_CHECK_SIGNATURE);
Make sure the packet isn't cut short before verifying the MD5 signature. Indicate why we can't verify the MD5 signature.
2009-02-26 17:45:39 +08:00
}
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
/*
* Step 2: Update MD5 hash with TCP header, excluding options.
* The TCP checksum must be set to zero.
*/
Fix build if you have a crypto library.
2017-12-11 18:53:24 +08:00
memcpy(&savecsum, tp1.th_sum, sizeof(savecsum));
memset(tp1.th_sum, 0, sizeof(tp1.th_sum));
Fix a bunch of de-constifications.
2015-04-27 08:24:42 +08:00
MD5_Update(&ctx, (const char *)&tp1, sizeof(struct tcphdr));
Fix build if you have a crypto library.
2017-12-11 18:53:24 +08:00
memcpy(tp1.th_sum, &savecsum, sizeof(tp1.th_sum));
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
/*
* Step 3: Update MD5 hash with TCP segment data, if present.
*/
if (length > 0)
MD5_Update(&ctx, data, length);
/*
* Step 4: Update MD5 hash with shared secret.
*/
NDOize DECnet, OSPF and TCP decoders
2014-04-02 16:59:56 +08:00
MD5_Update(&ctx, ndo->ndo_sigsecret, strlen(ndo->ndo_sigsecret));
change the TCP printer to print new-style order: - seperate fields by comma - use [] for flags and options sets - print a trailing length field make use of tok2str() and bitttok2str() move port definitions into tcp.h
2007-01-29 17:59:42 +08:00
MD5_Final(sig, &ctx);
if (memcmp(rcvsig, sig, TCP_SIGLEN) == 0)
return (SIGNATURE_VALID);
else
return (SIGNATURE_INVALID);
From Bruce M. Simpson: add a "-M" flag to specify a shared secret for TCP-MD5 (RFC 2385) digest verification if we have libcrypto.
2004-03-23 15:15:36 +08:00
}
adopt MacOS deprecation workaround from FreeRADIUS A MacOS build of tcpdump used to produce deprecation warnings on OpenSSL function calls. Alan DeKok explained that this is the effect of Apple's modifications to OpenSSL and that the very same problem has already been solved in FreeRADIUS server source code with pre-processor macros. Copy the macros into tcpdump header file and make use of them around the functions that call OpenSSL functions.
2013-10-16 21:59:13 +08:00
USES_APPLE_RST
From Bruce M. Simpson: add a "-M" flag to specify a shared secret for TCP-MD5 (RFC 2385) digest verification if we have libcrypto.
2004-03-23 15:15:36 +08:00
#endif /* HAVE_LIBCRYPTO */
Reference in New Issue Copy Permalink