_tcp.c

This directory contains source code for tcpdump, a tool for network monitoring and data acquisition

/*
 * This file has been slightly modified by NRL for use with IPv6+IPsec.
 * Search for USE_INET6 and/or IPSEC to see the blocks where this happened.
 * See the NRL Copyright notice for conditions on the modifications.
 */
/*
 * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996
 *      The Regents of the University of California.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that: (1) source code distributions
 * retain the above copyright notice and this paragraph in its entirety, (2)
 * distributions including binary code include the above copyright notice and
 * this paragraph in its entirety in the documentation or other materials
 * provided with the distribution, and (3) all advertising materials mentioning
 * features or use of this software display the following acknowledgement:
 * ``This product includes software developed by the University of California,
 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
 * the University nor the names of its contributors may be used to endorse
 * or promote products derived from this software without specific prior
 * written permission.
 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
 */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <ctype.h>
#include <time.h>

#include <sys/param.h>
#include <netinet/in.h>
#include <netinet/in_systm.h>
#include <sys/socket.h>
#include <rpc/rpc.h>

#include "interfac.h"
#include "a2name.h"
#include "extract.h"
#include "nfs.h"
#include "smb.h"
#include "ip.h"
#include "ip6.h"
#include "tcp.h"

/* Compatibility
 */
#ifndef TCPOPT_WSCALE
#define TCPOPT_WSCALE      3       /* window scale factor (rfc1072) */
#endif
#ifndef TCPOPT_SACKOK
#define TCPOPT_SACKOK      4       /* selective ack ok (rfc1072) */
#endif
#ifndef TCPOPT_SACK
#define TCPOPT_SACK        5       /* selective ack (rfc1072) */
#endif
#ifndef TCPOPT_ECHO
#define TCPOPT_ECHO        6       /* echo (rfc1072) */
#endif
#ifndef TCPOPT_ECHOREPLY
#define TCPOPT_ECHOREPLY   7       /* echo (rfc1072) */
#endif
#ifndef TCPOPT_TIMESTAMP
#define TCPOPT_TIMESTAMP   8       /* timestamps (rfc1323) */
#endif
#ifndef TCPOPT_CC
#define TCPOPT_CC          11      /* T/TCP CC options (rfc1644) */
#endif
#ifndef TCPOPT_CCNEW
#define TCPOPT_CCNEW       12      /* T/TCP CC options (rfc1644) */
#endif
#ifndef TCPOPT_CCECHO
#define TCPOPT_CCECHO      13      /* T/TCP CC options (rfc1644) */
#endif

/*
 * Definitions required for ECN
 * for use if the OS running tcpdump does not have ECN
 */
#ifndef TH_ECNECHO
#define TH_ECNECHO         0x40    /* ECN Echo in tcp header */
#endif
#ifndef TH_CWR
#define TH_CWR             0x80    /* ECN Cwnd Reduced in tcp header */
#endif

struct tha {
#ifdef USE_INET6
       struct in6_addr src;
       struct in6_addr dst;
#else
       struct in_addr src;
       struct in_addr dst;
#endif
       u_int port;
     };

struct tcp_seq_hash {
       struct tcp_seq_hash *nxt;
       struct tha          addr;
       tcp_seq             seq;
       tcp_seq             ack;
     };

#define TSEQ_HASHSIZE 919

/* These tcp optinos do not have the size octet
 */
#define ZEROLENOPT(o) ((o) == TCPOPT_EOL || (o) == TCPOPT_NOP)

#define NETBIOS_SSN_PORT 139

static void print_tcp_rst_data (const u_char *sp, u_int length);

#define MAX_RST_DATA_LEN    30


static struct tcp_seq_hash tcp_seq_hash[TSEQ_HASHSIZE];

#define NETBIOS_SSN_PORT 139

static int tcp_cksum (const struct ip *ip, const struct tcphdr *tp, int len)
{
  int i, tlen;
  union phu {
        struct phdr {
               u_int32_t src;
               u_int32_t dst;
               u_char    mbz;
               u_char    proto;
               u_int16_t len;
             } ph;
        u_int16_t pa[6];
      } phu;
  const u_int16_t *sp;
  u_int32_t        sum;

  tlen = ntohs (ip->ip_len) - ((const char *) tp - (const char *) ip);

  /* pseudo-header.. */
  phu.ph.len = htons (tlen);
  phu.ph.mbz = 0;
  phu.ph.proto = IPPROTO_TCP;
  memcpy (&phu.ph.src, &ip->ip_src.s_addr, sizeof(u_int32_t));
  memcpy (&phu.ph.dst, &ip->ip_dst.s_addr, sizeof(u_int32_t));

  sp = &phu.pa[0];
  sum = sp[0] + sp[1] + sp[2] + sp[3] + sp[4] + sp[5];

  sp = (const u_int16_t *) tp;

  for (i = 0; i < (tlen & ~1); i += 2)
    sum += *sp++;

  if (tlen & 1)
  {
    sum += htons ((*(const u_int8_t *) sp) << 8);
  }

  while (sum > 0xffff)
    sum = (sum & 0xffff) + (sum >> 16);
  sum = ~sum & 0xffff;

  return (sum);
}

#ifdef USE_INET6
static int tcp6_cksum (const struct ip6_hdr *ip6, const struct tcphdr *tp, int len)
{
  int i, tlen;
  const u_int16_t *sp;
  u_int32_t sum;
  union
  {
    struct
    {
      struct in6_addr ph_src;
      struct in6_addr ph_dst;
      u_int32_t ph_len;
      u_int8_t ph_zero[3];
      u_int8_t ph_nxt;
    }
    ph;
    u_int16_t pa[20];
  }
  phu;

  tlen = ntohs (ip6->ip6_plen) + sizeof(struct ip6_hdr) - ((const char *) tp - (const char *) ip6);

  /* pseudo-header */
  memset (&phu, 0, sizeof(phu));
  phu.ph.ph_src = ip6->ip6_src;
  phu.ph.ph_dst = ip6->ip6_dst;
  phu.ph.ph_len = htonl (tlen);
  phu.ph.ph_nxt = IPPROTO_TCP;

  sum = 0;
  for (i = 0; i < sizeof(phu.pa) / sizeof(phu.pa[0]); i++)
    sum += phu.pa[i];

  sp = (const u_int16_t *) tp;

  for (i = 0; i < (tlen & ~1); i += 2)
    sum += *sp++;

  if (tlen & 1)
    sum += htons ((*(const u_int8_t *) sp) << 8);

  while (sum > 0xffff)
    sum = (sum & 0xffff) + (sum >> 16);
  sum = ~sum & 0xffff;

  return (sum);
}
#endif

void tcp_print (const u_char *bp, u_int length, const u_char *bp2, int fragmented)
{
  struct tcp_seq_hash *th = NULL;

  const struct tcphdr *tp;
  const struct ip     *ip;
#ifdef USE_INET6
  const struct ip6_hdr *ip6;
#endif

  u_char    flags;
  u_int     hlen;
  char      ch;
  u_short   sport, dport, win, urp;
  u_int32_t seq, ack;
  u_int32_t thseq = 0;
  u_int32_t thack = 0;
  int       threv = 0;

  tp = (struct tcphdr *) bp;
  ip = (struct ip *) bp2;
  ch = '\0';
#ifdef USE_INET6
  if (IP_V (ip) == 6)
       ip6 = (struct ip6_hdr *) bp2;
  else ip6 = NULL;
#endif

  if (!TTEST (tp->th_dport))
  {
    PRINTF ("%s > %s: [|tcp]",
            ipaddr_string (&ip->ip_src),
            ipaddr_string (&ip->ip_dst));
    return;
  }

  sport = ntohs (tp->th_sport);
  dport = ntohs (tp->th_dport);

  hlen = TH_OFF (tp) * 4;

  /*
   * If data present and NFS port used, assume NFS.
   * Pass offset of data plus 4 bytes for RPC TCP msg length
   * to NFS print routines.
   */
  if (!qflag)
  {
    if ((u_char*)tp + 4 + sizeof(struct rpc_msg) <= snapend &&
        dport == NFS_PORT)
    {
      nfsreq_print ((u_char*)tp + hlen + 4, length, (u_char*)ip);
      return;
    }
    if (snapend >= (u_char*)tp+4+sizeof(struct rpc_msg) && sport == NFS_PORT)
    {
      nfsreply_print ((u_char*)tp + hlen + 4, length, (u_char*)ip);
      return;
    }
  }

#ifdef USE_INET6
  if (ip6)
  {
    if (ip6->ip6_nxt == IPPROTO_TCP)
         PRINTF ("%s.%s > %s.%s: ",
                 ip6addr_string (&ip6->ip6_src),
                 tcpport_string (sport),
                 ip6addr_string (&ip6->ip6_dst),
                 tcpport_string (dport));

    else PRINTF ("%s > %s: ", tcpport_string (sport), tcpport_string (dport));
  }
  else
#endif
  {
    if (ip->ip_p == IPPROTO_TCP)
         PRINTF ("%s.%s > %s.%s: ",
                 ipaddr_string (&ip->ip_src),
                 tcpport_string (sport),
                 ipaddr_string (&ip->ip_dst),
                 tcpport_string (dport));

    else PRINTF ("%s > %s: ", tcpport_string (sport), tcpport_string (dport));
  }

  TCHECK (*tp);

  seq = (u_int32_t) ntohl (tp->th_seq);
  ack = (u_int32_t) ntohl (tp->th_ack);
  win = ntohs (tp->th_win);
  urp = ntohs (tp->th_urp);

  if (packettype == PT_CORBA)
     print_corba (bp, length + hlen, bp2);


  /* Ultra-quiet now means print only corba, res 3-Nov-98
   */
  if (qflag > 1)
     return;

  if (qflag)
  {
    PRINTF ("tcp %d", length);
    return;
  }


  flags = tp->th_flags;
  if (flags & (TH_SYN | TH_FIN | TH_RST | TH_PUSH | TH_ECNECHO | TH_CWR))
  {
    if (flags & TH_SYN)
       PUTCHAR ('S');
    if (flags & TH_FIN)
       PUTCHAR ('F');
    if (flags & TH_RST)
       PUTCHAR ('R');
    if (flags & TH_PUSH)
       PUTCHAR ('P');
    if (flags & TH_CWR)
       PUTCHAR ('W');            /* congestion _W_indow reduced (ECN) */
    if (flags & TH_ECNECHO)
       PUTCHAR ('E');            /* ecn _E_cho sent (ECN) */
  }
  else
    PUTCHAR ('.');

  if (!Sflag && (flags & TH_ACK))
  {
    struct tha tha;
    int    rev;

    /*
     * Find (or record) the initial sequence numbers for
     * this conversation.  (we pick an arbitrary
     * collating order so there's only one entry for
     * both directions).
     */
#ifdef USE_INET6
    memset (&tha, 0, sizeof(tha));
    rev = 0;
    if (ip6)
    {
      if (sport > dport)
      {
        rev = 1;
      }
      else if (sport == dport)
      {
        int i;

        for (i = 0; i < 4; i++)
        {
          if (((u_int32_t*)(&ip6->ip6_src))[i] > ((u_int32_t*)(&ip6->ip6_dst))[i])
          {
            rev = 1;
            break;
          }
        }
      }
      if (rev)
      {
        tha.src  = ip6->ip6_dst;
        tha.dst  = ip6->ip6_src;
        tha.port = dport << 16 | sport;
      }
      else
      {
        tha.dst  = ip6->ip6_dst;
        tha.src  = ip6->ip6_src;
        tha.port = sport << 16 | dport;
      }
    }
    else
    {
      if (sport > dport || (sport == dport && ip->ip_src.s_addr > ip->ip_dst.s_addr))
      {
        rev = 1;
      }
      if (rev)
      {
        *(struct in_addr *) &tha.src = ip->ip_dst;
        *(struct in_addr *) &tha.dst = ip->ip_src;
        tha.port = dport << 16 | sport;