usr/src/cmd/cmd-inet/usr.sbin/snoop/snoop_rport.c

   1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 /*
  22  * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
  23  * Use is subject to license terms.
  24  */
  25
  26 #include <stdio.h>
  27 #include <stdlib.h>
  28 #include <strings.h>
  29 #include <sys/sysmacros.h>
  30 #include <sys/types.h>
  31 #include <sys/errno.h>
  32 #include <setjmp.h>
  33 #include <sys/socket.h>
  34 #include <net/if.h>
  35 #include <netinet/in_systm.h>
  36 #include <netinet/in.h>
  37 #include <netinet/ip.h>
  38 #include <netinet/if_ether.h>
  39 #include "snoop.h"
  40
  41 struct porttable {
  42         int     pt_num;
  43         char    *pt_short;
  44 };
  45
  46 static const struct porttable pt_udp[] = {
  47         { IPPORT_ECHO,          "ECHO" },
  48         { IPPORT_DISCARD,       "DISCARD" },
  49         { IPPORT_DAYTIME,       "DAYTIME" },
  50         { IPPORT_CHARGEN,       "CHARGEN" },
  51         { IPPORT_TIMESERVER,    "TIME" },
  52         { IPPORT_NAMESERVER,    "NAME" },
  53         { IPPORT_DOMAIN,        "DNS" },
  54         { IPPORT_MDNS,          "MDNS" },
  55         { IPPORT_BOOTPS,        "BOOTPS" },
  56         { IPPORT_BOOTPC,        "BOOTPC" },
  57         { IPPORT_TFTP,          "TFTP" },
  58         { IPPORT_FINGER,        "FINGER" },
  59 /*      { 111,                  "PORTMAP" }, Just Sun RPC */
  60         { IPPORT_NTP,           "NTP" },
  61         { IPPORT_NETBIOS_NS,    "NBNS" },
  62         { IPPORT_NETBIOS_DGM,   "NBDG" },
  63         { IPPORT_LDAP,          "LDAP" },
  64         { IPPORT_SLP,           "SLP" },
  65 /* Mobile IP defines a set of new control messages sent over UDP port 434 */
  66         { IPPORT_MIP,           "Mobile IP" },
  67         { IPPORT_BIFFUDP,       "BIFF" },
  68         { IPPORT_WHOSERVER,     "WHO" },
  69         { IPPORT_SYSLOG,        "SYSLOG" },
  70         { IPPORT_TALK,          "TALK" },
  71         { IPPORT_ROUTESERVER,   "RIP" },
  72         { IPPORT_RIPNG,         "RIPng" },
  73         { IPPORT_DHCPV6C,       "DHCPv6C" },
  74         { IPPORT_DHCPV6S,       "DHCPv6S" },
  75         { 550,                  "NEW-RWHO" },
  76         { 560,                  "RMONITOR" },
  77         { 561,                  "MONITOR" },
  78         { IPPORT_SOCKS,         "SOCKS" },
  79         { 0,                    NULL }
  80 };
  81
  82 static struct porttable pt_tcp[] = {
  83         { 1,                    "TCPMUX" },
  84         { IPPORT_ECHO,          "ECHO" },
  85         { IPPORT_DISCARD,       "DISCARD" },
  86         { IPPORT_SYSTAT,        "SYSTAT" },
  87         { IPPORT_DAYTIME,       "DAYTIME" },
  88         { IPPORT_NETSTAT,       "NETSTAT" },
  89         { IPPORT_CHARGEN,       "CHARGEN" },
  90         { 20,                   "FTP-DATA" },
  91         { IPPORT_FTP,           "FTP" },
  92         { IPPORT_TELNET,        "TELNET" },
  93         { IPPORT_SMTP,          "SMTP" },
  94         { IPPORT_TIMESERVER,    "TIME" },
  95         { 39,                   "RLP" },
  96         { IPPORT_NAMESERVER,    "NAMESERVER" },
  97         { IPPORT_WHOIS,         "NICNAME" },
  98         { IPPORT_DOMAIN,        "DNS" },
  99         { 70,                   "GOPHER" },
 100         { IPPORT_RJE,           "RJE" },
 101         { IPPORT_FINGER,        "FINGER" },
 102         { IPPORT_HTTP,          "HTTP" },
 103         { IPPORT_TTYLINK,       "LINK" },
 104         { IPPORT_SUPDUP,        "SUPDUP" },
 105         { 101,                  "HOSTNAME" },
 106         { 102,                  "ISO-TSAP" },
 107         { 103,                  "X400" },
 108         { 104,                  "X400-SND" },
 109         { 105,                  "CSNET-NS" },
 110         { 109,                  "POP-2" },
 111 /*      { 111,                  "PORTMAP" }, Just Sun RPC */
 112         { 113,                  "AUTH" },
 113         { 117,                  "UUCP-PATH" },
 114         { 119,                  "NNTP" },
 115         { IPPORT_NTP,           "NTP" },
 116         { IPPORT_NETBIOS_SSN,   "NBT" },
 117         { 143,                  "IMAP" },
 118         { 144,                  "NeWS" },
 119         { IPPORT_LDAP,          "LDAP" },
 120         { IPPORT_SLP,           "SLP" },
 121         { 443,                  "HTTPS" },
 122         { 445,                  "SMB" },
 123         { IPPORT_EXECSERVER,    "EXEC" },
 124         { IPPORT_LOGINSERVER,   "RLOGIN" },
 125         { IPPORT_CMDSERVER,     "RSHELL" },
 126         { IPPORT_PRINTER,       "PRINTER" },
 127         { 530,                  "COURIER" },
 128         { 540,                  "UUCP" },
 129         { 600,                  "PCSERVER" },
 130         { IPPORT_SOCKS,         "SOCKS" },
 131         { 1524,                 "INGRESLOCK" },
 132         { 2904,                 "M2UA" },
 133         { 2905,                 "M3UA" },
 134         { 6000,                 "XWIN" },
 135         { IPPORT_HTTP_ALT,      "HTTP (proxy)" },
 136         { 9900,                 "IUA" },
 137         { 0,                    NULL },
 138 };
 139
 140 char *
 141 getportname(int proto, in_port_t port)
 142 {
 143         const struct porttable *p, *pt;
 144
 145         switch (proto) {
 146         case IPPROTO_SCTP: /* fallthru */
 147         case IPPROTO_TCP: pt = pt_tcp; break;
 148         case IPPROTO_UDP: pt = pt_udp; break;
 149         default: return (NULL);
 150         }
 151
 152         for (p = pt; p->pt_num; p++) {
 153                 if (port == p->pt_num)
 154                         return (p->pt_short);
 155         }
 156         return (NULL);
 157 }
 158
 159 int
 160 reservedport(int proto, int port)
 161 {
 162         const struct porttable *p, *pt;
 163
 164         switch (proto) {
 165         case IPPROTO_TCP: pt = pt_tcp; break;
 166         case IPPROTO_UDP: pt = pt_udp; break;
 167         default: return (0);
 168         }
 169         for (p = pt; p->pt_num; p++) {
 170                 if (port == p->pt_num)
 171                         return (1);
 172         }
 173         return (0);
 174 }
 175
 176 /*
 177  * Need to be able to register an
 178  * interpreter for transient ports.
 179  * See TFTP interpreter.
 180  */
 181 #define MAXTRANS 64
 182 static struct ttable transients [MAXTRANS];
 183
 184 int
 185 add_transient(int port, int (*proc)(int, void *, int))
 186 {
 187         static struct ttable *next = transients;
 188
 189         next->t_port = port;
 190         next->t_proc = proc;
 191
 192         if (++next >= &transients[MAXTRANS])
 193                 next = transients;
 194
 195         return (1);
 196 }
 197
 198 struct ttable *
 199 is_transient(int port)
 200 {
 201         struct ttable *p;
 202
 203         for (p = transients; p->t_port && p < &transients[MAXTRANS]; p++) {
 204                 if (port == p->t_port)
 205                         return (p);
 206         }
 207
 208         return (NULL);
 209 }
 210
 211 void
 212 del_transient(int port)
 213 {
 214         struct ttable *p;
 215
 216         for (p = transients; p->t_port && p < &transients[MAXTRANS]; p++) {
 217                 if (port == p->t_port)
 218                         p->t_port = -1;
 219         }
 220 }
 221
 222 static void
 223 interpret_syslog(int flags, char dir, int port, const char *syslogstr,
 224     int dlen)
 225 {
 226         static const char *pris[] = {
 227             "emerg", "alert", "crit", "error", "warn", "notice", "info", "debug"
 228         };
 229         static const char *facs[] = {
 230             "kern", "user", "mail", "daemon", "auth", "syslog", "lpr", "news",
 231             "uucp", NULL, NULL, NULL, NULL, "audit", NULL, "cron", "local0",
 232             "local1", "local2", "local3", "local4", "local5", "local6", "local7"
 233         };
 234
 235         int composit;
 236         int pri = -1;
 237         int facil = -1;
 238         boolean_t bogus = B_TRUE;
 239         int priostrlen = 0;
 240         int datalen = dlen;
 241         char unknown[4];        /* for unrecognized ones */
 242         const char *facilstr = "BAD";
 243         const char *pristr = "FMT";
 244         const char *data = syslogstr;
 245
 246         /*
 247          * Is there enough data to interpret (left bracket + at least 3 chars
 248          * which could be digits, right bracket, or space)?
 249          */
 250         if (datalen >= 4 && data != NULL) {
 251                 if (*data == '<') {
 252                         const int FACS_LEN = sizeof (facs) / sizeof (facs[0]);
 253                         char buffer[4];
 254                         char *end;
 255
 256                         data++;
 257                         datalen--;
 258
 259                         (void) strlcpy(buffer, data, sizeof (buffer));
 260                         composit = strtoul(buffer, &end, 0);
 261                         data += end - buffer;
 262                         if (*data == '>') {
 263                                 data++;
 264                                 datalen -= end - buffer + 1;
 265
 266                                 pri = composit & 0x7;
 267                                 facil = (composit & 0xF8) >> 3;
 268
 269                                 if ((facil >= FACS_LEN) ||
 270                                     (facs[facil] == NULL)) {
 271                                         snprintf(unknown, sizeof (unknown),
 272                                             "%d", facil);
 273                                         facilstr = unknown;
 274                                 } else {
 275                                         facilstr = facs[facil];
 276                                 }
 277                                 pristr = pris[pri];
 278                                 priostrlen = dlen - datalen;
 279                                 bogus = B_FALSE;
 280                         } else {
 281                                 data = syslogstr;
 282                                 datalen = dlen;
 283                         }
 284                 }
 285         }
 286
 287         if (flags & F_SUM) {
 288                 (void) snprintf(get_sum_line(), MAXLINE,
 289                     "SYSLOG %c port=%d %s.%s: %s",
 290                     dir, port, facilstr, pristr,
 291                     show_string(syslogstr, dlen, 20));
 292
 293         }
 294
 295         if (flags & F_DTAIL) {
 296                 static char syslog[] = "SYSLOG:  ";
 297                 show_header(syslog, syslog, dlen);
 298                 show_space();
 299                 (void) snprintf(get_detail_line(0, 0), MAXLINE,
 300                     "%s%sPriority: %.*s%s(%s.%s)", prot_nest_prefix, syslog,
 301                     priostrlen, syslogstr, bogus ? "" : " ",
 302                     facilstr, pristr);
 303                 (void) snprintf(get_line(0, 0), get_line_remain(),
 304                     "\"%s\"",
 305                     show_string(syslogstr, dlen, 60));
 306                 show_trailer();
 307         }
 308 }
 309
 310 int src_port, dst_port, curr_proto;
 311
 312 int
 313 interpret_reserved(int flags, int proto, in_port_t src, in_port_t dst,
 314     char *data, int dlen)
 315 {
 316         const char *pn;
 317         int dir, port, which;
 318         char pbuff[16], hbuff[32];
 319         struct ttable *ttabp;
 320
 321         src_port = src;
 322         dst_port = dst;
 323         curr_proto = proto;
 324
 325         pn = getportname(proto, src);
 326         if (pn != NULL) {
 327                 dir = 'R';
 328                 port = dst;
 329                 which = src;
 330         } else {
 331                 pn = getportname(proto, dst);
 332                 if (pn == NULL) {
 333                         ttabp = is_transient(src);
 334                         if (ttabp) {
 335                                 (ttabp->t_proc)(flags, data, dlen);
 336                                 return (1);
 337                         }
 338                         ttabp = is_transient(dst);
 339                         if (ttabp) {
 340                                 (ttabp->t_proc)(flags, data, dlen);
 341                                 return (1);
 342                         }
 343                         return (0);
 344                 }
 345
 346                 dir = 'C';
 347                 port = src;
 348                 which = dst;
 349         }
 350
 351         if ((dst == IPPORT_DOMAIN || src == IPPORT_DOMAIN ||
 352             dst == IPPORT_MDNS || src == IPPORT_MDNS) &&
 353             proto != IPPROTO_TCP) {
 354                 interpret_dns(flags, proto, (uchar_t *)data, dlen, which);
 355                 return (1);
 356         }
 357
 358         if (dst == IPPORT_SYSLOG && proto != IPPROTO_TCP) {
 359                 /*
 360                  * TCP port 514 is rshell.  UDP port 514 is syslog.
 361                  */
 362                 interpret_syslog(flags, dir, port, (const char *)data, dlen);
 363                 return (1);
 364         }
 365
 366         if (dlen > 0) {
 367                 switch (which) {
 368                 case  IPPORT_BOOTPS:
 369                 case  IPPORT_BOOTPC:
 370                         (void) interpret_dhcp(flags, (struct dhcp *)data,
 371                             dlen);
 372                         return (1);
 373                 case IPPORT_DHCPV6S:
 374                 case IPPORT_DHCPV6C:
 375                         (void) interpret_dhcpv6(flags, (uint8_t *)data, dlen);
 376                         return (1);
 377                 case  IPPORT_TFTP:
 378                         (void) interpret_tftp(flags, (struct tftphdr *)data,
 379                             dlen);
 380                         return (1);
 381                 case  IPPORT_HTTP:
 382                 case  IPPORT_HTTP_ALT:
 383                         (void) interpret_http(flags, data, dlen);
 384                         return (1);
 385                 case IPPORT_NTP:
 386                         (void) interpret_ntp(flags, (struct ntpdata *)data,
 387                             dlen);
 388                         return (1);
 389                 case IPPORT_NETBIOS_NS:
 390                         interpret_netbios_ns(flags, (uchar_t *)data, dlen);
 391                         return (1);
 392                 case IPPORT_NETBIOS_DGM:
 393                         interpret_netbios_datagram(flags, (uchar_t *)data,
 394                             dlen);
 395                         return (1);
 396                 case IPPORT_NETBIOS_SSN:
 397                 case 445:
 398                         /*
 399                          * SMB on port 445 is a subset of NetBIOS SMB
 400                          * on port 139.  The same interpreter can be used
 401                          * for both.
 402                          */
 403                         interpret_netbios_ses(flags, (uchar_t *)data, dlen);
 404                         return (1);
 405                 case IPPORT_LDAP:
 406                         interpret_ldap(flags, data, dlen, src, dst);
 407                         return (1);
 408                 case IPPORT_SLP:
 409                         interpret_slp(flags, data, dlen);
 410                         return (1);
 411                 case IPPORT_MIP:
 412                         interpret_mip_cntrlmsg(flags, (uchar_t *)data, dlen);
 413                         return (1);
 414                 case IPPORT_ROUTESERVER:
 415                         (void) interpret_rip(flags, (struct rip *)data, dlen);
 416                         return (1);
 417                 case IPPORT_RIPNG:
 418                         (void) interpret_rip6(flags, (struct rip6 *)data,
 419                             dlen);
 420                         return (1);
 421                 case IPPORT_SOCKS:
 422                         if (dir == 'C')
 423                                 (void) interpret_socks_call(flags, data, dlen);
 424                         else
 425                                 (void) interpret_socks_reply(flags, data,
 426                                     dlen);
 427                         return (1);
 428                 }
 429         }
 430
 431         if (flags & F_SUM) {
 432                 (void) snprintf(get_sum_line(), MAXLINE,
 433                     "%s %c port=%d %s",
 434                     pn, dir, port,
 435                     show_string(data, dlen, 20));
 436         }
 437
 438         if (flags & F_DTAIL) {
 439                 (void) snprintf(pbuff, sizeof (pbuff), "%s:  ", pn);
 440                 (void) snprintf(hbuff, sizeof (hbuff), "%s:  ", pn);
 441                 show_header(pbuff, hbuff, dlen);
 442                 show_space();
 443                 (void) snprintf(get_line(0, 0), get_line_remain(),
 444                     "\"%s\"",
 445                     show_string(data, dlen, 60));
 446                 show_trailer();
 447         }
 448         return (1);
 449 }