proto_tcp.c

   1 /*
   2  * netsniff-ng - the packet sniffing beast
   3  * Copyright 2009, 2010 Daniel Borkmann.
   4  * Subject to the GPL, version 2.
   5  */
   6
   7 #include <stdio.h>
   8 #include <stdint.h>
   9 #include <endian.h>
  10 #include <netinet/in.h>    /* for ntohs() */
  11 #include <asm/byteorder.h>
  12
  13 #include "proto.h"
  14 #include "lookup.h"
  15 #include "built_in.h"
  16 #include "pkt_buff.h"
  17
  18 struct tcphdr {
  19         uint16_t source;
  20         uint16_t dest;
  21         uint32_t seq;
  22         uint32_t ack_seq;
  23 #if defined(__LITTLE_ENDIAN_BITFIELD)
  24         __extension__ uint16_t res1:4,
  25                                doff:4,
  26                                fin:1,
  27                                syn:1,
  28                                rst:1,
  29                                psh:1,
  30                                ack:1,
  31                                urg:1,
  32                                ece:1,
  33                                cwr:1;
  34 #elif defined(__BIG_ENDIAN_BITFIELD)
  35         __extension__ uint16_t doff:4,
  36                                res1:4,
  37                                cwr:1,
  38                                ece:1,
  39                                urg:1,
  40                                ack:1,
  41                                psh:1,
  42                                rst:1,
  43                                syn:1,
  44                                fin:1;
  45 #else
  46 # error  "Adjust your <asm/byteorder.h> defines"
  47 #endif
  48         uint16_t window;
  49         uint16_t check;
  50         uint16_t urg_ptr;
  51 } __packed;
  52
  53 static void tcp(struct pkt_buff *pkt)
  54 {
  55         struct tcphdr *tcp = (struct tcphdr *) pkt_pull(pkt, sizeof(*tcp));
  56         uint16_t src, dest;
  57         char *src_name, *dest_name;
  58
  59         if (tcp == NULL)
  60                 return;
  61
  62         src = ntohs(tcp->source);
  63         dest = ntohs(tcp->dest);
  64
  65         src_name = lookup_port_tcp(src);
  66         dest_name = lookup_port_tcp(dest);
  67
  68         tprintf(" [ TCP ");
  69         tprintf("Port (%u", src);
  70         if (src_name)
  71                 tprintf(" (%s%s%s)", colorize_start(bold), src_name,
  72                         colorize_end());
  73         tprintf(" => %u", dest);
  74         if (dest_name)
  75                 tprintf(" (%s%s%s)", colorize_start(bold), dest_name,
  76                         colorize_end());
  77         tprintf("), ");
  78         tprintf("SN (0x%x), ", ntohl(tcp->seq));
  79         tprintf("AN (0x%x), ", ntohl(tcp->ack_seq));
  80         tprintf("DataOff (%u), ", tcp->doff);
  81         tprintf("Res (%u), ", tcp->res1);
  82         tprintf("Flags (");
  83         if (tcp->fin)
  84                 tprintf("FIN ");
  85         if (tcp->syn)
  86                 tprintf("SYN ");
  87         if (tcp->rst)
  88                 tprintf("RST ");
  89         if (tcp->psh)
  90                 tprintf("PSH ");
  91         if (tcp->ack)
  92                 tprintf("ACK ");
  93         if (tcp->urg)
  94                 tprintf("URG ");
  95         if (tcp->ece)
  96                 tprintf("ECE ");
  97         if (tcp->cwr)
  98                 tprintf("CWR ");
  99         tprintf("), ");
 100         tprintf("Window (%u), ", ntohs(tcp->window));
 101         tprintf("CSum (0x%.4x), ", ntohs(tcp->check));
 102         tprintf("UrgPtr (%u)", ntohs(tcp->urg_ptr));
 103         tprintf(" ]\n");
 104 }
 105
 106 static void tcp_less(struct pkt_buff *pkt)
 107 {
 108         struct tcphdr *tcp = (struct tcphdr *) pkt_pull(pkt, sizeof(*tcp));
 109         uint16_t src, dest;
 110         char *src_name, *dest_name;
 111
 112         if (tcp == NULL)
 113                 return;
 114
 115         src = ntohs(tcp->source);
 116         dest = ntohs(tcp->dest);
 117
 118         src_name = lookup_port_tcp(src);
 119         dest_name = lookup_port_tcp(dest);
 120
 121         tprintf(" TCP %u", src);
 122         if(src_name)
 123                 tprintf("(%s%s%s)", colorize_start(bold), src_name,
 124                         colorize_end());
 125         tprintf("/%u", dest);
 126         if(dest_name)
 127                 tprintf("(%s%s%s)", colorize_start(bold), dest_name,
 128                         colorize_end());
 129         tprintf(" F%s",colorize_start(bold));
 130         if (tcp->fin)
 131                 tprintf(" FIN");
 132         if (tcp->syn)
 133                 tprintf(" SYN");
 134         if (tcp->rst)
 135                 tprintf(" RST");
 136         if (tcp->psh)
 137                 tprintf(" PSH");
 138         if (tcp->ack)
 139                 tprintf(" ACK");
 140         if (tcp->urg)
 141                 tprintf(" URG");
 142         if (tcp->ece)
 143                 tprintf(" ECE");
 144         if (tcp->cwr)
 145                 tprintf(" CWR");
 146         tprintf("%s Win %u S/A 0x%x/0x%x", colorize_end(),
 147                 ntohs(tcp->window), ntohl(tcp->seq), ntohl(tcp->ack_seq));
 148 }
 149
 150 struct protocol tcp_ops = {
 151         .key = 0x06,
 152         .print_full = tcp,
 153         .print_less = tcp_less,
 154 };