src/proto_ipv4.c

   1 /*
   2  * netsniff-ng - the packet sniffing beast
   3  * By Daniel Borkmann <daniel@netsniff-ng.org>.
   4  * Copyright (C) 2009, 2010 Daniel Borkmann
   5  * Copyright (C) 2012 Christoph Jaeger <christoph@netsniff-ng.org>
   6  * Subject to the GPL, version 2.
   7  */
   8
   9 #include <stdio.h>
  10 #include <stdint.h>
  11 #include <netinet/in.h>    /* for ntohs() */
  12 #include <arpa/inet.h>     /* for inet_ntop() */
  13 #include <asm/byteorder.h>
  14
  15 #include "proto.h"
  16 #include "protos.h"
  17 #include "csum.h"
  18 #include "dissector_eth.h"
  19 #include "pkt_buff.h"
  20 #include "built_in.h"
  21
  22 struct ipv4hdr {
  23 #if defined(__LITTLE_ENDIAN_BITFIELD)
  24         __extension__ uint8_t h_ihl:4,
  25                               h_version:4;
  26 #elif defined (__BIG_ENDIAN_BITFIELD)
  27         __extension__ uint8_t h_version:4,
  28                               h_ihl:4;
  29 #else
  30 # error "Please fix <asm/byteorder.h>"
  31 #endif
  32         uint8_t h_tos;
  33         uint16_t h_tot_len;
  34         uint16_t h_id;
  35         uint16_t h_frag_off;
  36         uint8_t h_ttl;
  37         uint8_t h_protocol;
  38         uint16_t h_check;
  39         uint32_t h_saddr;
  40         uint32_t h_daddr;
  41 } __packed;
  42
  43 #define FRAG_OFF_RESERVED_FLAG(x)      ((x) & 0x8000)
  44 #define FRAG_OFF_NO_FRAGMENT_FLAG(x)   ((x) & 0x4000)
  45 #define FRAG_OFF_MORE_FRAGMENT_FLAG(x) ((x) & 0x2000)
  46 #define FRAG_OFF_FRAGMENT_OFFSET(x)    ((x) & 0x1fff)
  47
  48 /* IP Option Numbers (http://www.iana.org/assignments/ip-parameters) */
  49 #define IP_OPT_EOOL 0x00
  50 #define IP_OPT_NOP  0x01
  51
  52 #define IP_OPT_COPIED_FLAG(x)  ((x) & 0x80)
  53 #define IP_OPT_CLASS(x)       (((x) & 0x60) >> 5)
  54 #define IP_OPT_NUMBER(x)       ((x) & 0x1F)
  55
  56 static void ipv4(struct pkt_buff *pkt)
  57 {
  58         uint16_t csum, frag_off, h_tot_len;
  59         char src_ip[INET_ADDRSTRLEN];
  60         char dst_ip[INET_ADDRSTRLEN];
  61         struct ipv4hdr *ip = (struct ipv4hdr *) pkt_pull(pkt, sizeof(*ip));
  62         uint8_t *opt, *trailer;
  63         unsigned int trailer_len = 0;
  64         ssize_t opts_len, opt_len;
  65
  66         if (!ip)
  67                 return;
  68
  69         frag_off = ntohs(ip->h_frag_off);
  70         h_tot_len = ntohs(ip->h_tot_len);
  71         csum = calc_csum(ip, ip->h_ihl * 4, 0);
  72
  73         inet_ntop(AF_INET, &ip->h_saddr, src_ip, sizeof(src_ip));
  74         inet_ntop(AF_INET, &ip->h_daddr, dst_ip, sizeof(dst_ip));
  75
  76         if ((pkt_len(pkt) + sizeof(*ip)) > h_tot_len) {
  77                 trailer_len = pkt_len(pkt) + sizeof(*ip) - h_tot_len;
  78                 trailer = pkt->data + h_tot_len + trailer_len;
  79         }
  80
  81         if (trailer_len) {
  82                  tprintf(" [ Eth trailer ");
  83                  while (trailer_len--) {
  84                         tprintf("%x", *(trailer - trailer_len));
  85                  }
  86                  tprintf(" ]\n");
  87         }
  88
  89         tprintf(" [ IPv4 ");
  90         tprintf("Addr (%s => %s), ", src_ip, dst_ip);
  91         tprintf("Proto (%u), ", ip->h_protocol);
  92         tprintf("TTL (%u), ", ip->h_ttl);
  93         tprintf("TOS (%u), ", ip->h_tos);
  94         tprintf("Ver (%u), ", ip->h_version);
  95         tprintf("IHL (%u), ", ip->h_ihl);
  96         tprintf("Tlen (%u), ", ntohs(ip->h_tot_len));
  97         tprintf("ID (%u), ", ntohs(ip->h_id));
  98         tprintf("Res (%u), NoFrag (%u), MoreFrag (%u), FragOff (%u), ",
  99                 FRAG_OFF_RESERVED_FLAG(frag_off) ? 1 : 0,
 100                 FRAG_OFF_NO_FRAGMENT_FLAG(frag_off) ? 1 : 0,
 101                 FRAG_OFF_MORE_FRAGMENT_FLAG(frag_off) ? 1 : 0,
 102                 FRAG_OFF_FRAGMENT_OFFSET(frag_off));
 103         tprintf("CSum (0x%.4x) is %s", ntohs(ip->h_check),
 104                 csum ? colorize_start_full(black, red) "bogus (!)"
 105                        colorize_end() : "ok");
 106         if (csum)
 107                 tprintf("%s should be 0x%.4x%s", colorize_start_full(black, red),
 108                         csum_expected(ip->h_check, csum), colorize_end());
 109         tprintf(" ]\n");
 110
 111         opts_len = max((uint8_t) ip->h_ihl, sizeof(*ip) / sizeof(uint32_t)) *
 112                    sizeof(uint32_t) - sizeof(*ip);
 113
 114         for (opt = pkt_pull(pkt, opts_len); opt && opts_len > 0; opt++) {
 115                 tprintf("   [ Option  Copied (%u), Class (%u), Number (%u)",
 116                         IP_OPT_COPIED_FLAG(*opt) ? 1 : 0, IP_OPT_CLASS(*opt),
 117                         IP_OPT_NUMBER(*opt));
 118
 119                 switch (*opt) {
 120                 case IP_OPT_EOOL:
 121                 case IP_OPT_NOP:
 122                         tprintf(" ]\n");
 123                         opts_len--;
 124                         break;
 125                 default:
 126                         /*
 127                          * Assuming that EOOL and NOP are the only single-byte
 128                          * options, treat all other options as variable in
 129                          * length with a minimum of 2.
 130                          *
 131                          * TODO: option length might be incorrect in malformed packets,
 132                          *       check and handle that
 133                          */
 134                         opt_len = *(++opt);
 135                         if (opt_len > opts_len) {
 136                                 tprintf(", Len (%u, invalid) ]\n", opt_len);
 137                                 goto out;
 138                         } else
 139                                 tprintf(", Len (%u) ]\n", opt_len);
 140                         opts_len -= opt_len;
 141                         tprintf("     [ Data hex ");
 142                         for (opt_len -= 2; opt_len > 0; opt_len--)
 143                                 tprintf(" %.2x", *(++opt));
 144                         tprintf(" ]\n");
 145                         break;
 146                 }
 147         }
 148 out:
 149         /* cut off everything that is not part of IPv4 payload */
 150         /* XXX there could still be an Ethernet trailer included or others */
 151
 152         pkt_trim(pkt, pkt_len(pkt) - min(pkt_len(pkt),
 153                  (ntohs(ip->h_tot_len) - ip->h_ihl * sizeof(uint32_t))));
 154
 155         pkt_set_proto(pkt, &eth_lay3, ip->h_protocol);
 156 }
 157
 158 static void ipv4_less(struct pkt_buff *pkt)
 159 {
 160         char src_ip[INET_ADDRSTRLEN];
 161         char dst_ip[INET_ADDRSTRLEN];
 162         struct ipv4hdr *ip = (struct ipv4hdr *) pkt_pull(pkt, sizeof(*ip));
 163
 164         if (!ip)
 165                 return;
 166
 167         inet_ntop(AF_INET, &ip->h_saddr, src_ip, sizeof(src_ip));
 168         inet_ntop(AF_INET, &ip->h_daddr, dst_ip, sizeof(dst_ip));
 169
 170         tprintf(" %s/%s Len %u", src_ip, dst_ip,
 171                 ntohs(ip->h_tot_len));
 172
 173         /* cut off IP options and everything that is not part of IPv4 payload */
 174         pkt_pull(pkt, max((uint8_t) ip->h_ihl, sizeof(*ip) / sizeof(uint32_t))
 175                 * sizeof(uint32_t) - sizeof(*ip));
 176         /* XXX there coul still be an Ethernet trailer included or others */
 177 #if 0
 178         pkt_trim(pkt, pkt_len(pkt) - min(pkt_len(pkt),
 179                  (ntohs(ip->h_tot_len) - ip->h_ihl * sizeof(uint32_t))));
 180 #endif
 181         pkt_set_proto(pkt, &eth_lay3, ip->h_protocol);
 182 }
 183
 184 struct protocol ipv4_ops = {
 185         .key = 0x0800,
 186         .print_full = ipv4,
 187         .print_less = ipv4_less,
 188 };
 189
 190 EXPORT_SYMBOL(ipv4_ops);