build: Add Makefile target for Coverity scanner
[netsniff-ng.git] / proto_ipv4.c
blob303319e4f9427366053f73320ce6d6e6c55c4147
1 /*
2 * netsniff-ng - the packet sniffing beast
3 * Copyright (C) 2009, 2010 Daniel Borkmann
4 * Copyright (C) 2012 Christoph Jaeger <christoph@netsniff-ng.org>
5 * Subject to the GPL, version 2.
6 */
8 #include <stdio.h>
9 #include <stdint.h>
10 #include <netinet/in.h> /* for ntohs() */
11 #include <arpa/inet.h> /* for inet_ntop() */
13 #include "proto.h"
14 #include "protos.h"
15 #include "csum.h"
16 #include "dissector_eth.h"
17 #include "ipv4.h"
18 #include "geoip.h"
19 #include "pkt_buff.h"
20 #include "built_in.h"
22 #define FRAG_OFF_RESERVED_FLAG(x) ((x) & 0x8000)
23 #define FRAG_OFF_NO_FRAGMENT_FLAG(x) ((x) & 0x4000)
24 #define FRAG_OFF_MORE_FRAGMENT_FLAG(x) ((x) & 0x2000)
25 #define FRAG_OFF_FRAGMENT_OFFSET(x) ((x) & 0x1fff)
27 /* IP Option Numbers (http://www.iana.org/assignments/ip-parameters) */
28 #define IP_OPT_EOOL 0x00
29 #define IP_OPT_NOP 0x01
31 #define IP_OPT_COPIED_FLAG(x) ((x) & 0x80)
32 #define IP_OPT_CLASS(x) (((x) & 0x60) >> 5)
33 #define IP_OPT_NUMBER(x) ((x) & 0x1F)
35 static void ipv4(struct pkt_buff *pkt)
37 uint16_t csum, frag_off, h_tot_len;
38 char src_ip[INET_ADDRSTRLEN];
39 char dst_ip[INET_ADDRSTRLEN];
40 struct ipv4hdr *ip = (struct ipv4hdr *) pkt_pull(pkt, sizeof(*ip));
41 uint8_t *opt, *trailer;
42 unsigned int trailer_len = 0;
43 ssize_t opts_len, opt_len;
44 struct sockaddr_in sas, sad;
45 const char *city, *region, *country;
47 if (!ip)
48 return;
50 frag_off = ntohs(ip->h_frag_off);
51 h_tot_len = ntohs(ip->h_tot_len);
52 csum = calc_csum(ip, ip->h_ihl * 4, 0);
54 inet_ntop(AF_INET, &ip->h_saddr, src_ip, sizeof(src_ip));
55 inet_ntop(AF_INET, &ip->h_daddr, dst_ip, sizeof(dst_ip));
57 if ((pkt_len(pkt) + sizeof(*ip)) > h_tot_len) {
58 trailer_len = pkt_len(pkt) + sizeof(*ip) - h_tot_len;
59 trailer = pkt->data + h_tot_len + trailer_len;
62 if (trailer_len) {
63 tprintf(" [ Eth trailer ");
64 while (trailer_len--) {
65 tprintf("%x", *(trailer - trailer_len));
67 tprintf(" ]\n");
70 tprintf(" [ IPv4 ");
71 tprintf("Addr (%s => %s), ", src_ip, dst_ip);
72 tprintf("Proto (%u), ", ip->h_protocol);
73 tprintf("TTL (%u), ", ip->h_ttl);
74 tprintf("TOS (%u), ", ip->h_tos);
75 tprintf("Ver (%u), ", ip->h_version);
76 tprintf("IHL (%u), ", ip->h_ihl);
77 tprintf("Tlen (%u), ", ntohs(ip->h_tot_len));
78 tprintf("ID (%u), ", ntohs(ip->h_id));
79 tprintf("Res (%u), NoFrag (%u), MoreFrag (%u), FragOff (%u), ",
80 FRAG_OFF_RESERVED_FLAG(frag_off) ? 1 : 0,
81 FRAG_OFF_NO_FRAGMENT_FLAG(frag_off) ? 1 : 0,
82 FRAG_OFF_MORE_FRAGMENT_FLAG(frag_off) ? 1 : 0,
83 FRAG_OFF_FRAGMENT_OFFSET(frag_off));
84 tprintf("CSum (0x%.4x) is %s", ntohs(ip->h_check),
85 csum ? colorize_start_full(black, red) "bogus (!)"
86 colorize_end() : "ok");
87 if (csum)
88 tprintf("%s should be 0x%.4x%s", colorize_start_full(black, red),
89 csum_expected(ip->h_check, csum), colorize_end());
90 tprintf(" ]\n");
92 memset(&sas, 0, sizeof(sas));
93 sas.sin_family = PF_INET;
94 sas.sin_addr.s_addr = ip->h_saddr;
96 memset(&sad, 0, sizeof(sad));
97 sad.sin_family = PF_INET;
98 sad.sin_addr.s_addr = ip->h_daddr;
100 if (geoip_working()) {
101 tprintf("\t[ Geo (");
102 if ((country = geoip4_country_name(sas))) {
103 tprintf("%s", country);
104 if ((region = geoip4_region_name(sas)))
105 tprintf(" / %s", region);
106 if ((city = geoip4_city_name(sas)))
107 tprintf(" / %s", city);
108 } else {
109 tprintf("local");
111 tprintf(" => ");
112 if ((country = geoip4_country_name(sad))) {
113 tprintf("%s", country);
114 if ((region = geoip4_region_name(sad)))
115 tprintf(" / %s", region);
116 if ((city = geoip4_city_name(sad)))
117 tprintf(" / %s", city);
118 } else {
119 tprintf("local");
121 tprintf(") ]\n");
124 opts_len = max_t(uint8_t, ip->h_ihl, sizeof(*ip) / sizeof(uint32_t)) *
125 sizeof(uint32_t) - sizeof(*ip);
127 for (opt = pkt_pull(pkt, opts_len); opt && opts_len > 0; opt++) {
128 tprintf(" [ Option Copied (%u), Class (%u), Number (%u)",
129 IP_OPT_COPIED_FLAG(*opt) ? 1 : 0, IP_OPT_CLASS(*opt),
130 IP_OPT_NUMBER(*opt));
132 switch (*opt) {
133 case IP_OPT_EOOL:
134 case IP_OPT_NOP:
135 tprintf(" ]\n");
136 opts_len--;
137 break;
138 default:
140 * Assuming that EOOL and NOP are the only single-byte
141 * options, treat all other options as variable in
142 * length with a minimum of 2.
144 * TODO: option length might be incorrect in malformed packets,
145 * check and handle that
147 opt_len = *(++opt);
148 if (opt_len > opts_len) {
149 tprintf(", Len (%zd, invalid) ]\n", opt_len);
150 goto out;
151 } else
152 tprintf(", Len (%zd) ]\n", opt_len);
153 opts_len -= opt_len;
154 tprintf(" [ Data hex ");
155 for (opt_len -= 2; opt_len > 0; opt_len--)
156 tprintf(" %.2x", *(++opt));
157 tprintf(" ]\n");
158 break;
161 out:
162 /* cut off everything that is not part of IPv4 payload */
163 /* XXX there could still be an Ethernet trailer included or others */
165 pkt_trim(pkt, pkt_len(pkt) - min(pkt_len(pkt),
166 (ntohs(ip->h_tot_len) - ip->h_ihl * sizeof(uint32_t))));
168 pkt_set_proto(pkt, &eth_lay3, ip->h_protocol);
171 static void ipv4_less(struct pkt_buff *pkt)
173 char src_ip[INET_ADDRSTRLEN];
174 char dst_ip[INET_ADDRSTRLEN];
175 struct ipv4hdr *ip = (struct ipv4hdr *) pkt_pull(pkt, sizeof(*ip));
177 if (!ip)
178 return;
180 inet_ntop(AF_INET, &ip->h_saddr, src_ip, sizeof(src_ip));
181 inet_ntop(AF_INET, &ip->h_daddr, dst_ip, sizeof(dst_ip));
183 tprintf(" %s/%s Len %u", src_ip, dst_ip,
184 ntohs(ip->h_tot_len));
186 /* cut off IP options and everything that is not part of IPv4 payload */
187 pkt_pull(pkt, max_t(uint8_t, ip->h_ihl, sizeof(*ip) / sizeof(uint32_t))
188 * sizeof(uint32_t) - sizeof(*ip));
189 /* XXX there coul still be an Ethernet trailer included or others */
190 #if 0
191 pkt_trim(pkt, pkt_len(pkt) - min(pkt_len(pkt),
192 (ntohs(ip->h_tot_len) - ip->h_ihl * sizeof(uint32_t))));
193 #endif
194 pkt_set_proto(pkt, &eth_lay3, ip->h_protocol);
197 struct protocol ipv4_ops = {
198 .key = 0x0800,
199 .print_full = ipv4,
200 .print_less = ipv4_less,