uipc_mbufdebug.c revision 1.2.2.2
1 1.2.2.2 pgoyette /* $NetBSD: uipc_mbufdebug.c,v 1.2.2.2 2018/07/28 04:38:08 pgoyette Exp $ */ 2 1.2.2.2 pgoyette 3 1.2.2.2 pgoyette /* 4 1.2.2.2 pgoyette * Copyright (C) 2017 Internet Initiative Japan Inc. 5 1.2.2.2 pgoyette * All rights reserved. 6 1.2.2.2 pgoyette * 7 1.2.2.2 pgoyette * Redistribution and use in source and binary forms, with or without 8 1.2.2.2 pgoyette * modification, are permitted provided that the following conditions 9 1.2.2.2 pgoyette * are met: 10 1.2.2.2 pgoyette * 1. Redistributions of source code must retain the above copyright 11 1.2.2.2 pgoyette * notice, this list of conditions and the following disclaimer. 12 1.2.2.2 pgoyette * 2. Redistributions in binary form must reproduce the above copyright 13 1.2.2.2 pgoyette * notice, this list of conditions and the following disclaimer in the 14 1.2.2.2 pgoyette * documentation and/or other materials provided with the distribution. 15 1.2.2.2 pgoyette * 16 1.2.2.2 pgoyette * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 17 1.2.2.2 pgoyette * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 18 1.2.2.2 pgoyette * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 19 1.2.2.2 pgoyette * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 20 1.2.2.2 pgoyette * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 21 1.2.2.2 pgoyette * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 22 1.2.2.2 pgoyette * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 23 1.2.2.2 pgoyette * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 24 1.2.2.2 pgoyette * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 25 1.2.2.2 pgoyette * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 26 1.2.2.2 pgoyette * POSSIBILITY OF SUCH DAMAGE. 27 1.2.2.2 pgoyette */ 28 1.2.2.2 pgoyette 29 1.2.2.2 pgoyette #include <sys/cdefs.h> 30 1.2.2.2 pgoyette __KERNEL_RCSID(0, "$NetBSD: uipc_mbufdebug.c,v 1.2.2.2 2018/07/28 04:38:08 pgoyette Exp $"); 31 1.2.2.2 pgoyette 32 1.2.2.2 pgoyette #include <sys/param.h> 33 1.2.2.2 pgoyette #include <sys/systm.h> 34 1.2.2.2 pgoyette #include <sys/proc.h> 35 1.2.2.2 pgoyette #include <sys/malloc.h> 36 1.2.2.2 pgoyette #include <sys/mbuf.h> 37 1.2.2.2 pgoyette 38 1.2.2.2 pgoyette #include <net/if.h> 39 1.2.2.2 pgoyette #include <net/if_ether.h> 40 1.2.2.2 pgoyette #include <net/ppp_defs.h> 41 1.2.2.2 pgoyette #include <net/if_arp.h> 42 1.2.2.2 pgoyette 43 1.2.2.2 pgoyette #include <netinet/in.h> 44 1.2.2.2 pgoyette #include <netinet/in_systm.h> 45 1.2.2.2 pgoyette #include <netinet/ip.h> 46 1.2.2.2 pgoyette #include <netinet/ip_icmp.h> 47 1.2.2.2 pgoyette #include <netinet/ip6.h> 48 1.2.2.2 pgoyette #include <netinet/icmp6.h> 49 1.2.2.2 pgoyette #include <netinet/if_inarp.h> 50 1.2.2.2 pgoyette #include <netinet/tcp.h> 51 1.2.2.2 pgoyette #include <netinet/udp.h> 52 1.2.2.2 pgoyette 53 1.2.2.2 pgoyette #define EXAMINE_HEX_LIMIT 128 54 1.2.2.2 pgoyette #define EXAMINE_HEX_COL 4 55 1.2.2.2 pgoyette 56 1.2.2.2 pgoyette /* mbuf operations without change of mbuf chain */ 57 1.2.2.2 pgoyette static int m_peek_data(const struct mbuf *, int, int, void *); 58 1.2.2.2 pgoyette static unsigned int m_peek_len(const struct mbuf *, const char *); 59 1.2.2.2 pgoyette 60 1.2.2.2 pgoyette /* utility */ 61 1.2.2.2 pgoyette static char *str_ethaddr(const uint8_t *); 62 1.2.2.2 pgoyette static char *str_ipaddr(const struct in_addr *); 63 1.2.2.2 pgoyette static char *str_ip6addr(const struct in6_addr *); 64 1.2.2.2 pgoyette static const char *str_ipproto(const uint8_t); 65 1.2.2.2 pgoyette 66 1.2.2.2 pgoyette /* parsers for m_examine() */ 67 1.2.2.2 pgoyette static void m_examine_ether(const struct mbuf *, int, const char *, 68 1.2.2.2 pgoyette void (*)(const char *, ...)); 69 1.2.2.2 pgoyette static void m_examine_pppoe(const struct mbuf *, int, const char *, 70 1.2.2.2 pgoyette void (*)(const char *, ...)); 71 1.2.2.2 pgoyette static void m_examine_ppp(const struct mbuf *, int, const char *, 72 1.2.2.2 pgoyette void (*)(const char *, ...)); 73 1.2.2.2 pgoyette static void m_examine_arp(const struct mbuf *, int, const char *, 74 1.2.2.2 pgoyette void (*)(const char *, ...)); 75 1.2.2.2 pgoyette static void m_examine_ip(const struct mbuf *, int, const char *, 76 1.2.2.2 pgoyette void (*)(const char *, ...)); 77 1.2.2.2 pgoyette static void m_examine_icmp(const struct mbuf *, int, const char *, 78 1.2.2.2 pgoyette void (*)(const char *, ...)); 79 1.2.2.2 pgoyette static void m_examine_ip6(const struct mbuf *, int, const char *, 80 1.2.2.2 pgoyette void (*)(const char *, ...)); 81 1.2.2.2 pgoyette static void m_examine_icmp6(const struct mbuf *, int, const char *, 82 1.2.2.2 pgoyette void (*)(const char *, ...)); 83 1.2.2.2 pgoyette static void m_examine_tcp(const struct mbuf *, int, const char *, 84 1.2.2.2 pgoyette void (*)(const char *, ...)); 85 1.2.2.2 pgoyette static void m_examine_udp(const struct mbuf *, int, const char *, 86 1.2.2.2 pgoyette void (*)(const char *, ...)); 87 1.2.2.2 pgoyette static void m_examine_hex(const struct mbuf *, int, const char *, 88 1.2.2.2 pgoyette void (*)(const char *, ...)); 89 1.2.2.2 pgoyette 90 1.2.2.2 pgoyette /* header structure for some protocol */ 91 1.2.2.2 pgoyette struct pppoehdr { 92 1.2.2.2 pgoyette uint8_t vertype; 93 1.2.2.2 pgoyette uint8_t code; 94 1.2.2.2 pgoyette uint16_t session; 95 1.2.2.2 pgoyette uint16_t plen; 96 1.2.2.2 pgoyette } __attribute__((__packed__)); 97 1.2.2.2 pgoyette 98 1.2.2.2 pgoyette struct pppoetag { 99 1.2.2.2 pgoyette uint16_t tag; 100 1.2.2.2 pgoyette uint16_t len; 101 1.2.2.2 pgoyette } __attribute__((__packed__)); 102 1.2.2.2 pgoyette 103 1.2.2.2 pgoyette #define PPPOE_TAG_EOL 0x0000 104 1.2.2.2 pgoyette #define PPPOE_CODE_PADI 0x09 /* Active Discovery Initiation */ 105 1.2.2.2 pgoyette #define PPPOE_CODE_PADO 0x07 /* Active Discovery Offer */ 106 1.2.2.2 pgoyette #define PPPOE_CODE_PADR 0x19 /* Active Discovery Request */ 107 1.2.2.2 pgoyette #define PPPOE_CODE_PADS 0x65 /* Active Discovery Session confirmation */ 108 1.2.2.2 pgoyette #define PPPOE_CODE_PADT 0xA7 /* Active Discovery Terminate */ 109 1.2.2.2 pgoyette 110 1.2.2.2 pgoyette struct ppp_header { 111 1.2.2.2 pgoyette uint8_t address; 112 1.2.2.2 pgoyette uint8_t control; 113 1.2.2.2 pgoyette uint16_t protocol; 114 1.2.2.2 pgoyette } __attribute__((__packed__)); 115 1.2.2.2 pgoyette 116 1.2.2.2 pgoyette #define CISCO_MULTICAST 0x8f /* Cisco multicast address */ 117 1.2.2.2 pgoyette #define CISCO_UNICAST 0x0f /* Cisco unicast address */ 118 1.2.2.2 pgoyette #define CISCO_KEEPALIVE 0x8035 /* Cisco keepalive protocol */ 119 1.2.2.2 pgoyette 120 1.2.2.2 pgoyette #ifndef NELEMS 121 1.2.2.2 pgoyette #define NELEMS(elem) ((sizeof(elem))/(sizeof((elem)[0]))) 122 1.2.2.2 pgoyette #endif 123 1.2.2.2 pgoyette 124 1.2.2.2 pgoyette static int 125 1.2.2.2 pgoyette m_peek_data(const struct mbuf *m, int off, int len, void *vp) 126 1.2.2.2 pgoyette { 127 1.2.2.2 pgoyette unsigned int count; 128 1.2.2.2 pgoyette char *cp = vp; 129 1.2.2.2 pgoyette 130 1.2.2.2 pgoyette if (off < 0 || len < 0) 131 1.2.2.2 pgoyette return -1; 132 1.2.2.2 pgoyette 133 1.2.2.2 pgoyette while (off > 0) { 134 1.2.2.2 pgoyette if (m == 0) 135 1.2.2.2 pgoyette return -1; 136 1.2.2.2 pgoyette if (off < m->m_len) 137 1.2.2.2 pgoyette break; 138 1.2.2.2 pgoyette off -= m->m_len; 139 1.2.2.2 pgoyette m = m->m_next; 140 1.2.2.2 pgoyette } 141 1.2.2.2 pgoyette while (len > 0) { 142 1.2.2.2 pgoyette if (m == 0) 143 1.2.2.2 pgoyette return -1; 144 1.2.2.2 pgoyette count = min(m->m_len - off, len); 145 1.2.2.2 pgoyette memcpy(cp, mtod(m, char *) + off, count); 146 1.2.2.2 pgoyette len -= count; 147 1.2.2.2 pgoyette cp += count; 148 1.2.2.2 pgoyette off = 0; 149 1.2.2.2 pgoyette m = m->m_next; 150 1.2.2.2 pgoyette } 151 1.2.2.2 pgoyette 152 1.2.2.2 pgoyette return 0; 153 1.2.2.2 pgoyette } 154 1.2.2.2 pgoyette 155 1.2.2.2 pgoyette static unsigned int 156 1.2.2.2 pgoyette m_peek_len(const struct mbuf *m, const char *modif) 157 1.2.2.2 pgoyette { 158 1.2.2.2 pgoyette const struct mbuf *m0; 159 1.2.2.2 pgoyette unsigned int pktlen; 160 1.2.2.2 pgoyette boolean_t opt_c = FALSE; 161 1.2.2.2 pgoyette unsigned char ch; 162 1.2.2.2 pgoyette 163 1.2.2.2 pgoyette while ( modif && (ch = *(modif++)) != '\0') { 164 1.2.2.2 pgoyette switch (ch) { 165 1.2.2.2 pgoyette case 'c': 166 1.2.2.2 pgoyette opt_c = TRUE; 167 1.2.2.2 pgoyette break; 168 1.2.2.2 pgoyette } 169 1.2.2.2 pgoyette } 170 1.2.2.2 pgoyette 171 1.2.2.2 pgoyette if (opt_c == TRUE) { 172 1.2.2.2 pgoyette return m->m_len; 173 1.2.2.2 pgoyette } 174 1.2.2.2 pgoyette 175 1.2.2.2 pgoyette if ((m->m_flags & M_PKTHDR) != 0) 176 1.2.2.2 pgoyette return m->m_pkthdr.len; 177 1.2.2.2 pgoyette 178 1.2.2.2 pgoyette pktlen = 0; 179 1.2.2.2 pgoyette for (m0 = m; m0 != NULL; m0 = m0->m_next) 180 1.2.2.2 pgoyette pktlen += m0->m_len; 181 1.2.2.2 pgoyette 182 1.2.2.2 pgoyette return pktlen; 183 1.2.2.2 pgoyette } 184 1.2.2.2 pgoyette 185 1.2.2.2 pgoyette static char * 186 1.2.2.2 pgoyette str_ethaddr(const uint8_t *ap) 187 1.2.2.2 pgoyette { 188 1.2.2.2 pgoyette static char buf[3 * ETHER_ADDR_LEN]; 189 1.2.2.2 pgoyette 190 1.2.2.2 pgoyette return ether_snprintf(buf, sizeof(buf), ap); 191 1.2.2.2 pgoyette } 192 1.2.2.2 pgoyette 193 1.2.2.2 pgoyette static char * 194 1.2.2.2 pgoyette str_ipaddr(const struct in_addr *ap) 195 1.2.2.2 pgoyette { 196 1.2.2.2 pgoyette static char buf[INET_ADDRSTRLEN]; 197 1.2.2.2 pgoyette 198 1.2.2.2 pgoyette return IN_PRINT(buf, ap); 199 1.2.2.2 pgoyette } 200 1.2.2.2 pgoyette 201 1.2.2.2 pgoyette static char * 202 1.2.2.2 pgoyette str_ip6addr(const struct in6_addr *ap) 203 1.2.2.2 pgoyette { 204 1.2.2.2 pgoyette static char buf[INET6_ADDRSTRLEN]; 205 1.2.2.2 pgoyette 206 1.2.2.2 pgoyette return IN6_PRINT(buf, ap); 207 1.2.2.2 pgoyette } 208 1.2.2.2 pgoyette 209 1.2.2.2 pgoyette static const char * 210 1.2.2.2 pgoyette str_ipproto(const uint8_t proto) 211 1.2.2.2 pgoyette { 212 1.2.2.2 pgoyette switch (proto) { 213 1.2.2.2 pgoyette case IPPROTO_HOPOPTS: 214 1.2.2.2 pgoyette return ("IPv6 Hop-by-Hop"); 215 1.2.2.2 pgoyette break; 216 1.2.2.2 pgoyette case IPPROTO_TCP: 217 1.2.2.2 pgoyette return("TCP"); 218 1.2.2.2 pgoyette break; 219 1.2.2.2 pgoyette case IPPROTO_UDP: 220 1.2.2.2 pgoyette return("UDP"); 221 1.2.2.2 pgoyette break; 222 1.2.2.2 pgoyette case IPPROTO_ICMP: 223 1.2.2.2 pgoyette return("ICMP"); 224 1.2.2.2 pgoyette break; 225 1.2.2.2 pgoyette case IPPROTO_IGMP: 226 1.2.2.2 pgoyette return("IGMP"); 227 1.2.2.2 pgoyette break; 228 1.2.2.2 pgoyette case IPPROTO_ESP: 229 1.2.2.2 pgoyette return("ESP"); 230 1.2.2.2 pgoyette break; 231 1.2.2.2 pgoyette case IPPROTO_AH: 232 1.2.2.2 pgoyette return("AH"); 233 1.2.2.2 pgoyette break; 234 1.2.2.2 pgoyette case IPPROTO_IPV6_ICMP: 235 1.2.2.2 pgoyette return("ICMP6"); 236 1.2.2.2 pgoyette default: 237 1.2.2.2 pgoyette return("unknown"); 238 1.2.2.2 pgoyette break; 239 1.2.2.2 pgoyette } 240 1.2.2.2 pgoyette 241 1.2.2.2 pgoyette /* not reached */ 242 1.2.2.2 pgoyette return NULL; 243 1.2.2.2 pgoyette } 244 1.2.2.2 pgoyette 245 1.2.2.2 pgoyette static void 246 1.2.2.2 pgoyette m_examine_ether(const struct mbuf *m, int off, const char *modif, 247 1.2.2.2 pgoyette void (*pr)(const char *, ...)) 248 1.2.2.2 pgoyette { 249 1.2.2.2 pgoyette struct ether_header eh; 250 1.2.2.2 pgoyette unsigned int pktlen; 251 1.2.2.2 pgoyette 252 1.2.2.2 pgoyette pktlen = m_peek_len(m, modif) - off; 253 1.2.2.2 pgoyette if (pktlen < sizeof(eh)) { 254 1.2.2.2 pgoyette (*pr)("%s: too short mbuf chain\n", __func__); 255 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 256 1.2.2.2 pgoyette } 257 1.2.2.2 pgoyette 258 1.2.2.2 pgoyette if (m_peek_data(m, off, sizeof(eh), (void *)(&eh)) < 0) { 259 1.2.2.2 pgoyette (*pr)("%s: cannot read header\n", __func__); 260 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 261 1.2.2.2 pgoyette } 262 1.2.2.2 pgoyette off += sizeof(eh); 263 1.2.2.2 pgoyette 264 1.2.2.2 pgoyette (*pr)("ETHER: DST = %s\n", str_ethaddr(eh.ether_dhost)); 265 1.2.2.2 pgoyette (*pr)("ETHER: SRC = %s\n", str_ethaddr(eh.ether_shost)); 266 1.2.2.2 pgoyette 267 1.2.2.2 pgoyette (*pr)("ETHER: TYPE = 0x%04x(", ntohs(eh.ether_type)); 268 1.2.2.2 pgoyette switch (ntohs(eh.ether_type)) { 269 1.2.2.2 pgoyette case ETHERTYPE_PPPOE: 270 1.2.2.2 pgoyette (*pr)("PPPoE)\n"); 271 1.2.2.2 pgoyette return m_examine_pppoe(m, off, modif, pr); 272 1.2.2.2 pgoyette break; 273 1.2.2.2 pgoyette case ETHERTYPE_ARP: 274 1.2.2.2 pgoyette (*pr)("ARP)\n"); 275 1.2.2.2 pgoyette return m_examine_arp(m, off, modif, pr); 276 1.2.2.2 pgoyette break; 277 1.2.2.2 pgoyette case ETHERTYPE_IP: 278 1.2.2.2 pgoyette (*pr)("IPv4)\n"); 279 1.2.2.2 pgoyette return m_examine_ip(m, off, modif, pr); 280 1.2.2.2 pgoyette break; 281 1.2.2.2 pgoyette case ETHERTYPE_IPV6: 282 1.2.2.2 pgoyette (*pr)("IPv6)\n"); 283 1.2.2.2 pgoyette return m_examine_ip6(m, off, modif, pr); 284 1.2.2.2 pgoyette break; 285 1.2.2.2 pgoyette default: 286 1.2.2.2 pgoyette (*pr)("unknown)\n"); 287 1.2.2.2 pgoyette break; 288 1.2.2.2 pgoyette } 289 1.2.2.2 pgoyette 290 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 291 1.2.2.2 pgoyette } 292 1.2.2.2 pgoyette 293 1.2.2.2 pgoyette static void 294 1.2.2.2 pgoyette m_examine_pppoe(const struct mbuf *m, int off, const char *modif, 295 1.2.2.2 pgoyette void (*pr)(const char *, ...)) 296 1.2.2.2 pgoyette { 297 1.2.2.2 pgoyette struct pppoehdr ph; 298 1.2.2.2 pgoyette struct pppoetag pt; 299 1.2.2.2 pgoyette unsigned int pktlen; 300 1.2.2.2 pgoyette uint8_t vt; 301 1.2.2.2 pgoyette 302 1.2.2.2 pgoyette pktlen = m_peek_len(m, modif) - off; 303 1.2.2.2 pgoyette if (pktlen < sizeof(ph)) { 304 1.2.2.2 pgoyette (*pr)("%s: too short mbuf chain\n", __func__); 305 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 306 1.2.2.2 pgoyette } 307 1.2.2.2 pgoyette 308 1.2.2.2 pgoyette if (m_peek_data(m, off, sizeof(ph), (void *)(&ph)) < 0) { 309 1.2.2.2 pgoyette (*pr)("%s: cannot read header\n", __func__); 310 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 311 1.2.2.2 pgoyette } 312 1.2.2.2 pgoyette off += sizeof(ph); 313 1.2.2.2 pgoyette 314 1.2.2.2 pgoyette while (off + sizeof(pt) > pktlen) { 315 1.2.2.2 pgoyette if (m_peek_data(m, off, sizeof(pt), (void *)(&pt)) < 0) { 316 1.2.2.2 pgoyette (*pr)("%s: cannot read header\n", __func__); 317 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 318 1.2.2.2 pgoyette } 319 1.2.2.2 pgoyette off += sizeof(pt); 320 1.2.2.2 pgoyette 321 1.2.2.2 pgoyette if (ntohs(pt.tag) == PPPOE_TAG_EOL) 322 1.2.2.2 pgoyette break; 323 1.2.2.2 pgoyette off += ntohs(pt.len); 324 1.2.2.2 pgoyette } 325 1.2.2.2 pgoyette 326 1.2.2.2 pgoyette vt = ph.vertype; 327 1.2.2.2 pgoyette 328 1.2.2.2 pgoyette (*pr)("PPPoE: Version = %u\n", ((vt >> 4) & 0xff)); 329 1.2.2.2 pgoyette (*pr)("PPPoE: Type = %u\n", (vt & 0xff)); 330 1.2.2.2 pgoyette (*pr)("PPPoE: Code = %u(", ph.code); 331 1.2.2.2 pgoyette switch (ph.code) { 332 1.2.2.2 pgoyette case 0: 333 1.2.2.2 pgoyette (*pr)("DATA"); 334 1.2.2.2 pgoyette break; 335 1.2.2.2 pgoyette case PPPOE_CODE_PADI: 336 1.2.2.2 pgoyette (*pr)("PADI"); 337 1.2.2.2 pgoyette break; 338 1.2.2.2 pgoyette case PPPOE_CODE_PADO: 339 1.2.2.2 pgoyette (*pr)("PADO"); 340 1.2.2.2 pgoyette break; 341 1.2.2.2 pgoyette case PPPOE_CODE_PADS: 342 1.2.2.2 pgoyette (*pr)("PADS"); 343 1.2.2.2 pgoyette break; 344 1.2.2.2 pgoyette case PPPOE_CODE_PADT: 345 1.2.2.2 pgoyette (*pr)("PADT"); 346 1.2.2.2 pgoyette break; 347 1.2.2.2 pgoyette default: 348 1.2.2.2 pgoyette (*pr)("unknown"); 349 1.2.2.2 pgoyette break; 350 1.2.2.2 pgoyette } 351 1.2.2.2 pgoyette (*pr)(")\n"); 352 1.2.2.2 pgoyette 353 1.2.2.2 pgoyette (*pr)("PPPoE: Session = 0x%04x\n", ntohs(ph.session)); 354 1.2.2.2 pgoyette (*pr)("PPPoE: Payload Length = %u\n", ntohs(ph.plen)); 355 1.2.2.2 pgoyette 356 1.2.2.2 pgoyette switch (ph.code) { 357 1.2.2.2 pgoyette case PPPOE_CODE_PADI: 358 1.2.2.2 pgoyette case PPPOE_CODE_PADO: 359 1.2.2.2 pgoyette case PPPOE_CODE_PADS: 360 1.2.2.2 pgoyette case PPPOE_CODE_PADT: 361 1.2.2.2 pgoyette (*pr)("No parser for PPPoE control frame.\n"); 362 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 363 1.2.2.2 pgoyette break; 364 1.2.2.2 pgoyette } 365 1.2.2.2 pgoyette 366 1.2.2.2 pgoyette if (ph.code != 0) { 367 1.2.2.2 pgoyette (*pr)("Unknown PPPoE code.\n"); 368 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 369 1.2.2.2 pgoyette } 370 1.2.2.2 pgoyette 371 1.2.2.2 pgoyette return m_examine_ppp(m, off, modif, pr); 372 1.2.2.2 pgoyette } 373 1.2.2.2 pgoyette 374 1.2.2.2 pgoyette static void 375 1.2.2.2 pgoyette m_examine_ppp(const struct mbuf *m, int off, const char *modif, 376 1.2.2.2 pgoyette void (*pr)(const char *, ...)) 377 1.2.2.2 pgoyette { 378 1.2.2.2 pgoyette struct ppp_header h; 379 1.2.2.2 pgoyette unsigned int pktlen; 380 1.2.2.2 pgoyette uint16_t protocol; 381 1.2.2.2 pgoyette 382 1.2.2.2 pgoyette pktlen = m_peek_len(m, modif) - off; 383 1.2.2.2 pgoyette if (pktlen < sizeof(h)) { 384 1.2.2.2 pgoyette (*pr)("%s: too short mbuf chain\n", __func__); 385 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 386 1.2.2.2 pgoyette } 387 1.2.2.2 pgoyette 388 1.2.2.2 pgoyette if (m_peek_data(m, off, sizeof(h), (void *)(&h)) < 0) { 389 1.2.2.2 pgoyette (*pr)("%s: cannot read header\n", __func__); 390 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 391 1.2.2.2 pgoyette } 392 1.2.2.2 pgoyette off += sizeof(h); 393 1.2.2.2 pgoyette 394 1.2.2.2 pgoyette protocol = ntohs(h.protocol); 395 1.2.2.2 pgoyette 396 1.2.2.2 pgoyette (*pr)("SPPP: Address = %d(", h.address); 397 1.2.2.2 pgoyette switch (h.address) { 398 1.2.2.2 pgoyette case PPP_ALLSTATIONS: 399 1.2.2.2 pgoyette (*pr)("ALLSTATIONS)\n"); 400 1.2.2.2 pgoyette (*pr)("SPPP: Protocol = %d(", protocol); 401 1.2.2.2 pgoyette switch (protocol) { 402 1.2.2.2 pgoyette case PPP_LCP: 403 1.2.2.2 pgoyette (*pr)("LCP)\n"); 404 1.2.2.2 pgoyette break; 405 1.2.2.2 pgoyette case PPP_PAP: 406 1.2.2.2 pgoyette (*pr)("PAP)\n"); 407 1.2.2.2 pgoyette break; 408 1.2.2.2 pgoyette case PPP_CHAP: 409 1.2.2.2 pgoyette (*pr)("CHAP)\n"); 410 1.2.2.2 pgoyette break; 411 1.2.2.2 pgoyette case PPP_IPCP: 412 1.2.2.2 pgoyette (*pr)("IPCP)\n"); 413 1.2.2.2 pgoyette break; 414 1.2.2.2 pgoyette case PPP_IPV6CP: 415 1.2.2.2 pgoyette (*pr)("IPV6CP)\n"); 416 1.2.2.2 pgoyette break; 417 1.2.2.2 pgoyette case PPP_IP: 418 1.2.2.2 pgoyette (*pr)("IP)\n"); 419 1.2.2.2 pgoyette return m_examine_ip(m, off, modif, pr); 420 1.2.2.2 pgoyette break; 421 1.2.2.2 pgoyette case PPP_IPV6: 422 1.2.2.2 pgoyette (*pr)("IPv6)\n"); 423 1.2.2.2 pgoyette return m_examine_ip6(m, off, modif, pr); 424 1.2.2.2 pgoyette break; 425 1.2.2.2 pgoyette default: 426 1.2.2.2 pgoyette (*pr)("unknown)\n"); 427 1.2.2.2 pgoyette break; 428 1.2.2.2 pgoyette } 429 1.2.2.2 pgoyette break; 430 1.2.2.2 pgoyette case CISCO_MULTICAST: 431 1.2.2.2 pgoyette case CISCO_UNICAST: 432 1.2.2.2 pgoyette if (h.address == CISCO_MULTICAST) { 433 1.2.2.2 pgoyette (*pr)("MULTICAST)\n"); 434 1.2.2.2 pgoyette } 435 1.2.2.2 pgoyette else { 436 1.2.2.2 pgoyette (*pr)("UNICAST)\n"); 437 1.2.2.2 pgoyette } 438 1.2.2.2 pgoyette (*pr)("SPPP: Protocol = %d(", protocol); 439 1.2.2.2 pgoyette switch (protocol) { 440 1.2.2.2 pgoyette case CISCO_KEEPALIVE: 441 1.2.2.2 pgoyette (*pr)("Keepalive)\n"); 442 1.2.2.2 pgoyette break; 443 1.2.2.2 pgoyette case ETHERTYPE_IP: 444 1.2.2.2 pgoyette (*pr)("IP)\n"); 445 1.2.2.2 pgoyette return m_examine_ip(m, off, modif, pr); 446 1.2.2.2 pgoyette break; 447 1.2.2.2 pgoyette case ETHERTYPE_IPV6: 448 1.2.2.2 pgoyette (*pr)("IPv6)\n"); 449 1.2.2.2 pgoyette return m_examine_ip6(m, off, modif, pr); 450 1.2.2.2 pgoyette break; 451 1.2.2.2 pgoyette default: 452 1.2.2.2 pgoyette (*pr)("unknown)\n"); 453 1.2.2.2 pgoyette break; 454 1.2.2.2 pgoyette } 455 1.2.2.2 pgoyette break; 456 1.2.2.2 pgoyette default: 457 1.2.2.2 pgoyette (*pr)("unknown)\n", h.address); 458 1.2.2.2 pgoyette break; 459 1.2.2.2 pgoyette } 460 1.2.2.2 pgoyette 461 1.2.2.2 pgoyette (*pr)("No parser for address %d, protocol %d\n", h.address, protocol); 462 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 463 1.2.2.2 pgoyette } 464 1.2.2.2 pgoyette 465 1.2.2.2 pgoyette static void 466 1.2.2.2 pgoyette m_examine_arp(const struct mbuf *m, int off, const char *modif, 467 1.2.2.2 pgoyette void (*pr)(const char *, ...)) 468 1.2.2.2 pgoyette { 469 1.2.2.2 pgoyette unsigned int pktlen; 470 1.2.2.2 pgoyette struct arphdr ar; 471 1.2.2.2 pgoyette uint16_t hrd, op; 472 1.2.2.2 pgoyette struct in_addr isaddr, itaddr; 473 1.2.2.2 pgoyette uint8_t esaddr[ETHER_ADDR_LEN], etaddr[ETHER_ADDR_LEN]; 474 1.2.2.2 pgoyette 475 1.2.2.2 pgoyette pktlen = m_peek_len(m, modif) - off; 476 1.2.2.2 pgoyette if (pktlen < sizeof(ar)) { 477 1.2.2.2 pgoyette (*pr)("%s: too short mbuf chain\n", __func__); 478 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 479 1.2.2.2 pgoyette } 480 1.2.2.2 pgoyette 481 1.2.2.2 pgoyette if (m_peek_data(m, off, sizeof(ar), (void *)(&ar)) < 0) { 482 1.2.2.2 pgoyette (*pr)("%s: cannot read header\n", __func__); 483 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 484 1.2.2.2 pgoyette } 485 1.2.2.2 pgoyette off += sizeof(ar); 486 1.2.2.2 pgoyette 487 1.2.2.2 pgoyette hrd = ntohs(ar.ar_hrd); 488 1.2.2.2 pgoyette (*pr)("ARP: AddressType = %u(", hrd); 489 1.2.2.2 pgoyette switch (hrd) { 490 1.2.2.2 pgoyette case ARPHRD_ETHER: 491 1.2.2.2 pgoyette (*pr)("ETHER)\n"); 492 1.2.2.2 pgoyette break; 493 1.2.2.2 pgoyette case ARPHRD_IEEE802: 494 1.2.2.2 pgoyette (*pr)("IEEE802)\n"); 495 1.2.2.2 pgoyette break; 496 1.2.2.2 pgoyette default: 497 1.2.2.2 pgoyette (*pr)("unknown)\n"); 498 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 499 1.2.2.2 pgoyette break; 500 1.2.2.2 pgoyette } 501 1.2.2.2 pgoyette (*pr)("ARP: Protocol Address Format = %u\n", ntohs(ar.ar_pro)); 502 1.2.2.2 pgoyette (*pr)("ARP: Protocol Address Length = %u\n", ar.ar_pln); 503 1.2.2.2 pgoyette (*pr)("ARP: H/W Address Length = %u\n", ar.ar_hln); 504 1.2.2.2 pgoyette op = ntohs(ar.ar_op); 505 1.2.2.2 pgoyette (*pr)("ARP: Operation = %u(", op); 506 1.2.2.2 pgoyette switch (op) { 507 1.2.2.2 pgoyette case ARPOP_REQUEST: 508 1.2.2.2 pgoyette (*pr)("REQUEST)\n"); 509 1.2.2.2 pgoyette break; 510 1.2.2.2 pgoyette case ARPOP_REPLY: 511 1.2.2.2 pgoyette (*pr)("REPLY)\n"); 512 1.2.2.2 pgoyette break; 513 1.2.2.2 pgoyette case ARPOP_REVREQUEST: 514 1.2.2.2 pgoyette (*pr)("REVREQUEST)\n"); 515 1.2.2.2 pgoyette break; 516 1.2.2.2 pgoyette case ARPOP_REVREPLY: 517 1.2.2.2 pgoyette (*pr)("REVREPLY)\n"); 518 1.2.2.2 pgoyette break; 519 1.2.2.2 pgoyette case ARPOP_INVREQUEST: 520 1.2.2.2 pgoyette (*pr)("INVREQUEST)\n"); 521 1.2.2.2 pgoyette break; 522 1.2.2.2 pgoyette case ARPOP_INVREPLY: 523 1.2.2.2 pgoyette (*pr)("INVREPLY)\n"); 524 1.2.2.2 pgoyette break; 525 1.2.2.2 pgoyette } 526 1.2.2.2 pgoyette 527 1.2.2.2 pgoyette if (ar.ar_hln == 0 || ar.ar_pln == 0 || 528 1.2.2.2 pgoyette ar.ar_hln != sizeof(esaddr) || ar.ar_pln != sizeof(isaddr)) { 529 1.2.2.2 pgoyette (*pr)("Cannot parse.\n"); 530 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 531 1.2.2.2 pgoyette } 532 1.2.2.2 pgoyette 533 1.2.2.2 pgoyette if (m_peek_data(m, off, sizeof(esaddr), (void *)(esaddr)) < 0) { 534 1.2.2.2 pgoyette (*pr)("Cannot read payload\n"); 535 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 536 1.2.2.2 pgoyette } 537 1.2.2.2 pgoyette off += sizeof(esaddr); 538 1.2.2.2 pgoyette (*pr)("ARP: Ether Src = %s\n", str_ethaddr(esaddr)); 539 1.2.2.2 pgoyette 540 1.2.2.2 pgoyette if (m_peek_data(m, off, sizeof(isaddr), (void *)(&isaddr)) < 0) { 541 1.2.2.2 pgoyette (*pr)("Cannot read payload\n"); 542 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 543 1.2.2.2 pgoyette } 544 1.2.2.2 pgoyette off += sizeof(isaddr); 545 1.2.2.2 pgoyette (*pr)("ARP: IP Src = %s\n", str_ipaddr(&isaddr)); 546 1.2.2.2 pgoyette 547 1.2.2.2 pgoyette if (m_peek_data(m, off, sizeof(etaddr), (void *)(etaddr)) < 0) { 548 1.2.2.2 pgoyette (*pr)("Cannot read payload\n"); 549 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 550 1.2.2.2 pgoyette } 551 1.2.2.2 pgoyette off += sizeof(etaddr); 552 1.2.2.2 pgoyette (*pr)("ARP: Ether Tgt = %s\n", str_ethaddr(etaddr)); 553 1.2.2.2 pgoyette 554 1.2.2.2 pgoyette if (m_peek_data(m, off, sizeof(itaddr), (void *)(&itaddr)) < 0) { 555 1.2.2.2 pgoyette (*pr)("Cannot read payload\n"); 556 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 557 1.2.2.2 pgoyette } 558 1.2.2.2 pgoyette off += sizeof(itaddr); 559 1.2.2.2 pgoyette (*pr)("ARP: IP Tgt = %s\n", str_ipaddr(&itaddr)); 560 1.2.2.2 pgoyette 561 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 562 1.2.2.2 pgoyette } 563 1.2.2.2 pgoyette 564 1.2.2.2 pgoyette static void 565 1.2.2.2 pgoyette m_examine_ip(const struct mbuf *m, int off, const char *modif, 566 1.2.2.2 pgoyette void (*pr)(const char *, ...)) 567 1.2.2.2 pgoyette { 568 1.2.2.2 pgoyette unsigned int pktlen; 569 1.2.2.2 pgoyette struct ip ip; 570 1.2.2.2 pgoyette uint16_t offset; 571 1.2.2.2 pgoyette 572 1.2.2.2 pgoyette pktlen = m_peek_len(m, modif) - off; 573 1.2.2.2 pgoyette if (pktlen < sizeof(ip)) { 574 1.2.2.2 pgoyette (*pr)("%s: too short mbuf chain\n", __func__); 575 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 576 1.2.2.2 pgoyette } 577 1.2.2.2 pgoyette 578 1.2.2.2 pgoyette if (m_peek_data(m, off, sizeof(ip), (void *)(&ip)) < 0) { 579 1.2.2.2 pgoyette (*pr)("%s: cannot read header\n", __func__); 580 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 581 1.2.2.2 pgoyette } 582 1.2.2.2 pgoyette off += sizeof(ip); 583 1.2.2.2 pgoyette 584 1.2.2.2 pgoyette (*pr)("IP: Version = %u\n", ip.ip_v); 585 1.2.2.2 pgoyette (*pr)("IP: Header Length = %u\n", (ip.ip_hl << 2)); 586 1.2.2.2 pgoyette (*pr)("IP: ToS = 0x%02x\n", ip.ip_tos); 587 1.2.2.2 pgoyette (*pr)("IP: Packet Length = %u\n", ntohs(ip.ip_len)); 588 1.2.2.2 pgoyette (*pr)("IP: ID = %u\n", ntohs(ip.ip_id)); 589 1.2.2.2 pgoyette offset = ntohs(ip.ip_off); 590 1.2.2.2 pgoyette (*pr)("IP: Offset = %u\n", (offset & IP_OFFMASK)); 591 1.2.2.2 pgoyette if (offset & IP_RF) { 592 1.2.2.2 pgoyette (*pr)("IP: Flag 0x%04x (reserved)\n", IP_RF); 593 1.2.2.2 pgoyette } 594 1.2.2.2 pgoyette if (offset & IP_EF) { 595 1.2.2.2 pgoyette (*pr)("IP: Flag 0x%04x (evil flag)\n", IP_EF); 596 1.2.2.2 pgoyette } 597 1.2.2.2 pgoyette if (offset & IP_DF) { 598 1.2.2.2 pgoyette (*pr)("IP: Flag 0x%04x (don't fragment)\n", IP_DF); 599 1.2.2.2 pgoyette } 600 1.2.2.2 pgoyette if (offset & IP_MF) { 601 1.2.2.2 pgoyette (*pr)("IP: Flag 0x%04x (more fragment)\n", IP_MF); 602 1.2.2.2 pgoyette } 603 1.2.2.2 pgoyette (*pr)("IP: TTL = %u\n", ip.ip_ttl); 604 1.2.2.2 pgoyette (*pr)("IP: protocol = %u(%s)\n", ip.ip_p, str_ipproto(ip.ip_p)); 605 1.2.2.2 pgoyette (*pr)("IP: Src = %s\n", str_ipaddr(&ip.ip_src)); 606 1.2.2.2 pgoyette (*pr)("IP: Dst = %s\n", str_ipaddr(&ip.ip_dst)); 607 1.2.2.2 pgoyette 608 1.2.2.2 pgoyette 609 1.2.2.2 pgoyette switch (ip.ip_p) { 610 1.2.2.2 pgoyette case IPPROTO_ICMP: 611 1.2.2.2 pgoyette return m_examine_icmp(m, off, modif, pr); 612 1.2.2.2 pgoyette break; 613 1.2.2.2 pgoyette case IPPROTO_TCP: 614 1.2.2.2 pgoyette return m_examine_tcp(m, off, modif, pr); 615 1.2.2.2 pgoyette break; 616 1.2.2.2 pgoyette case IPPROTO_UDP: 617 1.2.2.2 pgoyette return m_examine_udp(m, off, modif, pr); 618 1.2.2.2 pgoyette break; 619 1.2.2.2 pgoyette default: 620 1.2.2.2 pgoyette break; 621 1.2.2.2 pgoyette } 622 1.2.2.2 pgoyette 623 1.2.2.2 pgoyette 624 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 625 1.2.2.2 pgoyette } 626 1.2.2.2 pgoyette 627 1.2.2.2 pgoyette static void 628 1.2.2.2 pgoyette m_examine_icmp(const struct mbuf *m, int off, const char *modif, 629 1.2.2.2 pgoyette void (*pr)(const char *, ...)) 630 1.2.2.2 pgoyette { 631 1.2.2.2 pgoyette unsigned int pktlen; 632 1.2.2.2 pgoyette struct icmp icmphdr; 633 1.2.2.2 pgoyette 634 1.2.2.2 pgoyette pktlen = m_peek_len(m, modif) - off; 635 1.2.2.2 pgoyette if (pktlen < sizeof(icmphdr)) { 636 1.2.2.2 pgoyette (*pr)("%s: too short mbuf chain\n", __func__); 637 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 638 1.2.2.2 pgoyette } 639 1.2.2.2 pgoyette 640 1.2.2.2 pgoyette if (m_peek_data(m, off, sizeof(icmphdr), (void *)(&icmphdr)) < 0) { 641 1.2.2.2 pgoyette (*pr)("%s: cannot read header\n", __func__); 642 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 643 1.2.2.2 pgoyette } 644 1.2.2.2 pgoyette off += sizeof(icmphdr); 645 1.2.2.2 pgoyette 646 1.2.2.2 pgoyette (*pr)("ICMP: Type = %u(", icmphdr.icmp_type); 647 1.2.2.2 pgoyette switch (icmphdr.icmp_type) { 648 1.2.2.2 pgoyette case ICMP_ECHOREPLY: 649 1.2.2.2 pgoyette (*pr)("Echo Reply)\n"); 650 1.2.2.2 pgoyette break; 651 1.2.2.2 pgoyette case ICMP_UNREACH: 652 1.2.2.2 pgoyette (*pr)("Destination Unreachable)\n"); 653 1.2.2.2 pgoyette break; 654 1.2.2.2 pgoyette case ICMP_SOURCEQUENCH: 655 1.2.2.2 pgoyette (*pr)("Source Quench)\n"); 656 1.2.2.2 pgoyette break; 657 1.2.2.2 pgoyette case ICMP_REDIRECT: 658 1.2.2.2 pgoyette (*pr)("Redirect)\n"); 659 1.2.2.2 pgoyette break; 660 1.2.2.2 pgoyette case ICMP_TIMXCEED: 661 1.2.2.2 pgoyette (*pr)("Time Exceeded)\n"); 662 1.2.2.2 pgoyette break; 663 1.2.2.2 pgoyette default: 664 1.2.2.2 pgoyette (*pr)("unknown)\n"); 665 1.2.2.2 pgoyette break; 666 1.2.2.2 pgoyette } 667 1.2.2.2 pgoyette (*pr)("ICMP: Code = %d\n", icmphdr.icmp_code); 668 1.2.2.2 pgoyette 669 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 670 1.2.2.2 pgoyette } 671 1.2.2.2 pgoyette 672 1.2.2.2 pgoyette static void 673 1.2.2.2 pgoyette m_examine_ip6(const struct mbuf *m, int off, const char *modif, 674 1.2.2.2 pgoyette void (*pr)(const char *, ...)) 675 1.2.2.2 pgoyette { 676 1.2.2.2 pgoyette unsigned int pktlen; 677 1.2.2.2 pgoyette struct ip6_hdr ip6; 678 1.2.2.2 pgoyette struct ip6_hbh hbh; 679 1.2.2.2 pgoyette int hbhlen; 680 1.2.2.2 pgoyette uint32_t flow; 681 1.2.2.2 pgoyette uint8_t vfc; 682 1.2.2.2 pgoyette uint8_t nxt; 683 1.2.2.2 pgoyette 684 1.2.2.2 pgoyette pktlen = m_peek_len(m, modif) - off; 685 1.2.2.2 pgoyette if (pktlen < sizeof(ip6)) { 686 1.2.2.2 pgoyette (*pr)("%s: too short mbuf chain\n", __func__); 687 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 688 1.2.2.2 pgoyette } 689 1.2.2.2 pgoyette 690 1.2.2.2 pgoyette if (m_peek_data(m, off, sizeof(ip6), (void *)(&ip6)) < 0) { 691 1.2.2.2 pgoyette (*pr)("%s: cannot read header\n", __func__); 692 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 693 1.2.2.2 pgoyette } 694 1.2.2.2 pgoyette off += sizeof(ip6); 695 1.2.2.2 pgoyette 696 1.2.2.2 pgoyette vfc = ip6.ip6_vfc; 697 1.2.2.2 pgoyette (*pr)("IPv6: Version = %u\n", (vfc & IPV6_VERSION_MASK) >> 4); 698 1.2.2.2 pgoyette flow = ntohl(ip6.ip6_flow); 699 1.2.2.2 pgoyette (*pr)("IPv6: Flow INFO = 0x%07x\n", flow & IPV6_FLOWINFO_MASK); 700 1.2.2.2 pgoyette (*pr)("IPv6: Payload Length = %u\n", ip6.ip6_plen); 701 1.2.2.2 pgoyette nxt = ip6.ip6_nxt; 702 1.2.2.2 pgoyette (*pr)("IPv6: Next Header = %u(%s)\n", nxt, str_ipproto(nxt)); 703 1.2.2.2 pgoyette (*pr)("IPv6: Hop Limit = %u\n", ip6.ip6_hlim); 704 1.2.2.2 pgoyette (*pr)("IPv6: Src = %s\n", str_ip6addr(&ip6.ip6_src)); 705 1.2.2.2 pgoyette (*pr)("IPv6: Dst = %s\n", str_ip6addr(&ip6.ip6_dst)); 706 1.2.2.2 pgoyette 707 1.2.2.2 pgoyette /* Strip Hop-by-Hop options */ 708 1.2.2.2 pgoyette if (nxt == IPPROTO_HOPOPTS) { 709 1.2.2.2 pgoyette if (m_peek_data(m, off, sizeof(hbh), (void *)(&hbh)) < 0) { 710 1.2.2.2 pgoyette (*pr)("Cannot read option\n"); 711 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 712 1.2.2.2 pgoyette } 713 1.2.2.2 pgoyette hbhlen = (hbh.ip6h_len + 1) << 3; 714 1.2.2.2 pgoyette nxt = hbh.ip6h_nxt; 715 1.2.2.2 pgoyette off += hbhlen; 716 1.2.2.2 pgoyette 717 1.2.2.2 pgoyette (*pr)("IPv6: Stripped Hop-by-Hop\n"); 718 1.2.2.2 pgoyette (*pr)("IPv6: Next Header = %u(%s)\n", nxt, str_ipproto(nxt)); 719 1.2.2.2 pgoyette } 720 1.2.2.2 pgoyette 721 1.2.2.2 pgoyette switch (nxt) { 722 1.2.2.2 pgoyette case IPPROTO_IPV6_ICMP: 723 1.2.2.2 pgoyette return m_examine_icmp6(m, off, modif, pr); 724 1.2.2.2 pgoyette break; 725 1.2.2.2 pgoyette case IPPROTO_TCP: 726 1.2.2.2 pgoyette return m_examine_tcp(m, off, modif, pr); 727 1.2.2.2 pgoyette break; 728 1.2.2.2 pgoyette case IPPROTO_UDP: 729 1.2.2.2 pgoyette return m_examine_udp(m, off, modif, pr); 730 1.2.2.2 pgoyette break; 731 1.2.2.2 pgoyette default: 732 1.2.2.2 pgoyette break; 733 1.2.2.2 pgoyette } 734 1.2.2.2 pgoyette 735 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 736 1.2.2.2 pgoyette } 737 1.2.2.2 pgoyette 738 1.2.2.2 pgoyette static void 739 1.2.2.2 pgoyette m_examine_icmp6(const struct mbuf *m, int off, const char *modif, 740 1.2.2.2 pgoyette void (*pr)(const char *, ...)) 741 1.2.2.2 pgoyette { 742 1.2.2.2 pgoyette unsigned int pktlen; 743 1.2.2.2 pgoyette struct icmp6_hdr icmp6; 744 1.2.2.2 pgoyette 745 1.2.2.2 pgoyette pktlen = m_peek_len(m, modif) - off; 746 1.2.2.2 pgoyette if (pktlen < sizeof(icmp6)) { 747 1.2.2.2 pgoyette (*pr)("%s: too short mbuf chain\n", __func__); 748 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 749 1.2.2.2 pgoyette } 750 1.2.2.2 pgoyette 751 1.2.2.2 pgoyette if (m_peek_data(m, off, sizeof(icmp6), (void *)(&icmp6)) < 0) { 752 1.2.2.2 pgoyette (*pr)("%s: cannot read header\n", __func__); 753 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 754 1.2.2.2 pgoyette } 755 1.2.2.2 pgoyette off += sizeof(icmp6); 756 1.2.2.2 pgoyette 757 1.2.2.2 pgoyette (*pr)("ICMP6: Type = %u(", icmp6.icmp6_type); 758 1.2.2.2 pgoyette switch (icmp6.icmp6_type) { 759 1.2.2.2 pgoyette case ICMP6_DST_UNREACH: 760 1.2.2.2 pgoyette (*pr)("Destination Unreachable)\n"); 761 1.2.2.2 pgoyette break; 762 1.2.2.2 pgoyette case ICMP6_PACKET_TOO_BIG: 763 1.2.2.2 pgoyette (*pr)("Packet Too Big)\n"); 764 1.2.2.2 pgoyette break; 765 1.2.2.2 pgoyette case ICMP6_TIME_EXCEEDED: 766 1.2.2.2 pgoyette (*pr)("Time Exceeded)\n"); 767 1.2.2.2 pgoyette break; 768 1.2.2.2 pgoyette case ICMP6_PARAM_PROB: 769 1.2.2.2 pgoyette (*pr)("Parameter Problem)\n"); 770 1.2.2.2 pgoyette break; 771 1.2.2.2 pgoyette case ICMP6_ECHO_REQUEST: 772 1.2.2.2 pgoyette (*pr)("Echo Request)\n"); 773 1.2.2.2 pgoyette break; 774 1.2.2.2 pgoyette case ICMP6_ECHO_REPLY: 775 1.2.2.2 pgoyette (*pr)("Echo Reply)\n"); 776 1.2.2.2 pgoyette break; 777 1.2.2.2 pgoyette 778 1.2.2.2 pgoyette case MLD_LISTENER_QUERY: 779 1.2.2.2 pgoyette (*pr)("MLD Listener Query)\n"); 780 1.2.2.2 pgoyette break; 781 1.2.2.2 pgoyette case MLD_LISTENER_REPORT: 782 1.2.2.2 pgoyette (*pr)("MLD Listener Report)\n"); 783 1.2.2.2 pgoyette break; 784 1.2.2.2 pgoyette case MLD_LISTENER_DONE: 785 1.2.2.2 pgoyette (*pr)("MLD Listener Done)\n"); 786 1.2.2.2 pgoyette break; 787 1.2.2.2 pgoyette 788 1.2.2.2 pgoyette case ND_ROUTER_SOLICIT: 789 1.2.2.2 pgoyette (*pr)("Router Solicitation)\n"); 790 1.2.2.2 pgoyette break; 791 1.2.2.2 pgoyette case ND_ROUTER_ADVERT: 792 1.2.2.2 pgoyette (*pr)("Router Advertizement)\n"); 793 1.2.2.2 pgoyette break; 794 1.2.2.2 pgoyette case ND_NEIGHBOR_SOLICIT: 795 1.2.2.2 pgoyette (*pr)("Neighbor Solicitation)\n"); 796 1.2.2.2 pgoyette break; 797 1.2.2.2 pgoyette case ND_NEIGHBOR_ADVERT: 798 1.2.2.2 pgoyette (*pr)("Neighbor Advertizement)\n"); 799 1.2.2.2 pgoyette break; 800 1.2.2.2 pgoyette case ND_REDIRECT: 801 1.2.2.2 pgoyette (*pr)("Redirect)\n"); 802 1.2.2.2 pgoyette break; 803 1.2.2.2 pgoyette 804 1.2.2.2 pgoyette default: 805 1.2.2.2 pgoyette (*pr)("unknown)\n"); 806 1.2.2.2 pgoyette break; 807 1.2.2.2 pgoyette } 808 1.2.2.2 pgoyette (*pr)("ICMP6: Code = %u\n", icmp6.icmp6_code); 809 1.2.2.2 pgoyette 810 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 811 1.2.2.2 pgoyette } 812 1.2.2.2 pgoyette 813 1.2.2.2 pgoyette static void 814 1.2.2.2 pgoyette m_examine_tcp(const struct mbuf *m, int off, const char *modif, 815 1.2.2.2 pgoyette void (*pr)(const char *, ...)) 816 1.2.2.2 pgoyette { 817 1.2.2.2 pgoyette unsigned int pktlen; 818 1.2.2.2 pgoyette struct tcphdr tcp; 819 1.2.2.2 pgoyette 820 1.2.2.2 pgoyette pktlen = m_peek_len(m, modif) - off; 821 1.2.2.2 pgoyette if (pktlen < sizeof(tcp)) { 822 1.2.2.2 pgoyette (*pr)("%s: too short mbuf chain\n", __func__); 823 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 824 1.2.2.2 pgoyette } 825 1.2.2.2 pgoyette 826 1.2.2.2 pgoyette if (m_peek_data(m, off, sizeof(tcp), (void *)(&tcp)) < 0) { 827 1.2.2.2 pgoyette (*pr)("%s: cannot read header\n", __func__); 828 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 829 1.2.2.2 pgoyette } 830 1.2.2.2 pgoyette off += sizeof(tcp); 831 1.2.2.2 pgoyette 832 1.2.2.2 pgoyette (*pr)("TCP: Src = %u\n", ntohs(tcp.th_sport)); 833 1.2.2.2 pgoyette (*pr)("TCP: Dst = %u\n", ntohs(tcp.th_dport)); 834 1.2.2.2 pgoyette (*pr)("TCP: Seq. = %u\n", ntohl(tcp.th_seq)); 835 1.2.2.2 pgoyette (*pr)("TCP: Ack. = %u\n", ntohl(tcp.th_ack)); 836 1.2.2.2 pgoyette (*pr)("TCP: Header Length = %u\n", ntohl(tcp.th_off) << 2); 837 1.2.2.2 pgoyette if (tcp.th_flags) { 838 1.2.2.2 pgoyette (*pr)("TCP: Flags 0x%02x : ", tcp.th_flags); 839 1.2.2.2 pgoyette if (tcp.th_flags & TH_FIN) 840 1.2.2.2 pgoyette (*pr)("FIN "); 841 1.2.2.2 pgoyette if (tcp.th_flags & TH_SYN) 842 1.2.2.2 pgoyette (*pr)("SYN "); 843 1.2.2.2 pgoyette if (tcp.th_flags & TH_RST) 844 1.2.2.2 pgoyette (*pr)("RST "); 845 1.2.2.2 pgoyette if (tcp.th_flags & TH_PUSH) 846 1.2.2.2 pgoyette (*pr)("PUSH "); 847 1.2.2.2 pgoyette if (tcp.th_flags & TH_URG) 848 1.2.2.2 pgoyette (*pr)("URG "); 849 1.2.2.2 pgoyette if (tcp.th_flags & TH_ECE) 850 1.2.2.2 pgoyette (*pr)("ECE "); 851 1.2.2.2 pgoyette if (tcp.th_flags & TH_CWR) 852 1.2.2.2 pgoyette (*pr)("CWR "); 853 1.2.2.2 pgoyette (*pr)("\n"); 854 1.2.2.2 pgoyette } 855 1.2.2.2 pgoyette (*pr)("TCP: Windows Size = %u\n", ntohs(tcp.th_win)); 856 1.2.2.2 pgoyette (*pr)("TCP: Urgent Pointer = %u\n", ntohs(tcp.th_urp)); 857 1.2.2.2 pgoyette 858 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 859 1.2.2.2 pgoyette } 860 1.2.2.2 pgoyette 861 1.2.2.2 pgoyette static void 862 1.2.2.2 pgoyette m_examine_udp(const struct mbuf *m, int off, const char *modif, 863 1.2.2.2 pgoyette void (*pr)(const char *, ...)) 864 1.2.2.2 pgoyette { 865 1.2.2.2 pgoyette unsigned int pktlen; 866 1.2.2.2 pgoyette struct udphdr udp; 867 1.2.2.2 pgoyette 868 1.2.2.2 pgoyette pktlen = m_peek_len(m, modif) - off; 869 1.2.2.2 pgoyette if (pktlen < sizeof(udp)) { 870 1.2.2.2 pgoyette (*pr)("%s: too short mbuf chain\n", __func__); 871 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 872 1.2.2.2 pgoyette } 873 1.2.2.2 pgoyette 874 1.2.2.2 pgoyette if (m_peek_data(m, off, sizeof(udp), (void *)(&udp)) < 0) { 875 1.2.2.2 pgoyette (*pr)("%s: cannot read header\n", __func__); 876 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 877 1.2.2.2 pgoyette } 878 1.2.2.2 pgoyette off += sizeof(udp); 879 1.2.2.2 pgoyette 880 1.2.2.2 pgoyette (*pr)("UDP: Src = %u\n", ntohs(udp.uh_sport)); 881 1.2.2.2 pgoyette (*pr)("UDP: Dst = %u\n", ntohs(udp.uh_dport)); 882 1.2.2.2 pgoyette (*pr)("UDP: Length = %u\n", ntohs(udp.uh_ulen)); 883 1.2.2.2 pgoyette 884 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 885 1.2.2.2 pgoyette } 886 1.2.2.2 pgoyette 887 1.2.2.2 pgoyette static void 888 1.2.2.2 pgoyette m_examine_hex(const struct mbuf *m, int off, const char *modif, 889 1.2.2.2 pgoyette void (*pr)(const char *, ...)) 890 1.2.2.2 pgoyette { 891 1.2.2.2 pgoyette unsigned int pktlen; 892 1.2.2.2 pgoyette int newline = 0; 893 1.2.2.2 pgoyette uint8_t v; 894 1.2.2.2 pgoyette 895 1.2.2.2 pgoyette pktlen = m_peek_len(m, modif) - off; 896 1.2.2.2 pgoyette if (pktlen > EXAMINE_HEX_LIMIT) 897 1.2.2.2 pgoyette pktlen = EXAMINE_HEX_LIMIT; 898 1.2.2.2 pgoyette 899 1.2.2.2 pgoyette if (pktlen == 0) 900 1.2.2.2 pgoyette return; 901 1.2.2.2 pgoyette 902 1.2.2.2 pgoyette (*pr)("offset %04d: ", off); 903 1.2.2.2 pgoyette while (pktlen > 0) { 904 1.2.2.2 pgoyette if (m_peek_data(m, off, sizeof(v), (void *)(&v)) < 0) 905 1.2.2.2 pgoyette break; 906 1.2.2.2 pgoyette pktlen --; 907 1.2.2.2 pgoyette off++; 908 1.2.2.2 pgoyette newline++; 909 1.2.2.2 pgoyette 910 1.2.2.2 pgoyette (*pr)("%02x", v); 911 1.2.2.2 pgoyette if (pktlen == 0) 912 1.2.2.2 pgoyette break; 913 1.2.2.2 pgoyette 914 1.2.2.2 pgoyette if ((newline % EXAMINE_HEX_COL) == 0) { 915 1.2.2.2 pgoyette (*pr)("\n"); 916 1.2.2.2 pgoyette (*pr)("offset %04d: ", off); 917 1.2.2.2 pgoyette } 918 1.2.2.2 pgoyette else { 919 1.2.2.2 pgoyette (*pr)(" "); 920 1.2.2.2 pgoyette } 921 1.2.2.2 pgoyette } 922 1.2.2.2 pgoyette (*pr)("\n"); 923 1.2.2.2 pgoyette } 924 1.2.2.2 pgoyette 925 1.2.2.2 pgoyette void 926 1.2.2.2 pgoyette m_examine(const struct mbuf *m, int af, const char *modif, 927 1.2.2.2 pgoyette void (*pr)(const char *, ...)) 928 1.2.2.2 pgoyette { 929 1.2.2.2 pgoyette if (m == NULL) 930 1.2.2.2 pgoyette return; 931 1.2.2.2 pgoyette 932 1.2.2.2 pgoyette if (pr == NULL) 933 1.2.2.2 pgoyette return; 934 1.2.2.2 pgoyette 935 1.2.2.2 pgoyette switch (af) { 936 1.2.2.2 pgoyette case AF_UNSPEC: 937 1.2.2.2 pgoyette return m_examine_hex(m, 0, modif, pr); 938 1.2.2.2 pgoyette break; 939 1.2.2.2 pgoyette case AF_ETHER: 940 1.2.2.2 pgoyette return m_examine_ether(m, 0, modif, pr); 941 1.2.2.2 pgoyette break; 942 1.2.2.2 pgoyette case AF_ARP: 943 1.2.2.2 pgoyette return m_examine_arp(m, 0, modif, pr); 944 1.2.2.2 pgoyette break; 945 1.2.2.2 pgoyette case AF_INET: 946 1.2.2.2 pgoyette return m_examine_ip(m, 0, modif, pr); 947 1.2.2.2 pgoyette break; 948 1.2.2.2 pgoyette case AF_INET6: 949 1.2.2.2 pgoyette return m_examine_ip6(m, 0, modif, pr); 950 1.2.2.2 pgoyette break; 951 1.2.2.2 pgoyette default: 952 1.2.2.2 pgoyette (*pr)("No parser for AF %d\n", af); 953 1.2.2.2 pgoyette return m_examine_hex(m, 0, modif, pr); 954 1.2.2.2 pgoyette break; 955 1.2.2.2 pgoyette } 956 1.2.2.2 pgoyette 957 1.2.2.2 pgoyette /* not reached */ 958 1.2.2.2 pgoyette return; 959 1.2.2.2 pgoyette } 960
Indexes created Tue Sep 30 06:09:59 GMT 2025