uipc_mbufdebug.c revision 1.2.2.4
1 1.2.2.4 pgoyette /* $NetBSD: uipc_mbufdebug.c,v 1.2.2.4 2018/10/20 06:58:45 pgoyette Exp $ */ 2 1.2.2.2 pgoyette 3 1.2.2.2 pgoyette /* 4 1.2.2.2 pgoyette * Copyright (C) 2017 Internet Initiative Japan Inc. 5 1.2.2.2 pgoyette * All rights reserved. 6 1.2.2.2 pgoyette * 7 1.2.2.2 pgoyette * Redistribution and use in source and binary forms, with or without 8 1.2.2.2 pgoyette * modification, are permitted provided that the following conditions 9 1.2.2.2 pgoyette * are met: 10 1.2.2.2 pgoyette * 1. Redistributions of source code must retain the above copyright 11 1.2.2.2 pgoyette * notice, this list of conditions and the following disclaimer. 12 1.2.2.2 pgoyette * 2. Redistributions in binary form must reproduce the above copyright 13 1.2.2.2 pgoyette * notice, this list of conditions and the following disclaimer in the 14 1.2.2.2 pgoyette * documentation and/or other materials provided with the distribution. 15 1.2.2.2 pgoyette * 16 1.2.2.2 pgoyette * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 17 1.2.2.2 pgoyette * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 18 1.2.2.2 pgoyette * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 19 1.2.2.2 pgoyette * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 20 1.2.2.2 pgoyette * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 21 1.2.2.2 pgoyette * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 22 1.2.2.2 pgoyette * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 23 1.2.2.2 pgoyette * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 24 1.2.2.2 pgoyette * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 25 1.2.2.2 pgoyette * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 26 1.2.2.2 pgoyette * POSSIBILITY OF SUCH DAMAGE. 27 1.2.2.2 pgoyette */ 28 1.2.2.2 pgoyette 29 1.2.2.2 pgoyette #include <sys/cdefs.h> 30 1.2.2.4 pgoyette __KERNEL_RCSID(0, "$NetBSD: uipc_mbufdebug.c,v 1.2.2.4 2018/10/20 06:58:45 pgoyette Exp $"); 31 1.2.2.2 pgoyette 32 1.2.2.2 pgoyette #include <sys/param.h> 33 1.2.2.2 pgoyette #include <sys/systm.h> 34 1.2.2.2 pgoyette #include <sys/proc.h> 35 1.2.2.2 pgoyette #include <sys/malloc.h> 36 1.2.2.2 pgoyette #include <sys/mbuf.h> 37 1.2.2.2 pgoyette 38 1.2.2.2 pgoyette #include <net/if.h> 39 1.2.2.2 pgoyette #include <net/if_ether.h> 40 1.2.2.2 pgoyette #include <net/ppp_defs.h> 41 1.2.2.2 pgoyette #include <net/if_arp.h> 42 1.2.2.2 pgoyette 43 1.2.2.2 pgoyette #include <netinet/in.h> 44 1.2.2.2 pgoyette #include <netinet/in_systm.h> 45 1.2.2.2 pgoyette #include <netinet/ip.h> 46 1.2.2.2 pgoyette #include <netinet/ip_icmp.h> 47 1.2.2.2 pgoyette #include <netinet/ip6.h> 48 1.2.2.2 pgoyette #include <netinet/icmp6.h> 49 1.2.2.2 pgoyette #include <netinet/if_inarp.h> 50 1.2.2.2 pgoyette #include <netinet/tcp.h> 51 1.2.2.2 pgoyette #include <netinet/udp.h> 52 1.2.2.2 pgoyette 53 1.2.2.2 pgoyette #define EXAMINE_HEX_LIMIT 128 54 1.2.2.2 pgoyette #define EXAMINE_HEX_COL 4 55 1.2.2.2 pgoyette 56 1.2.2.2 pgoyette /* mbuf operations without change of mbuf chain */ 57 1.2.2.2 pgoyette static int m_peek_data(const struct mbuf *, int, int, void *); 58 1.2.2.2 pgoyette static unsigned int m_peek_len(const struct mbuf *, const char *); 59 1.2.2.2 pgoyette 60 1.2.2.2 pgoyette /* utility */ 61 1.2.2.2 pgoyette static char *str_ethaddr(const uint8_t *); 62 1.2.2.2 pgoyette static char *str_ipaddr(const struct in_addr *); 63 1.2.2.2 pgoyette static char *str_ip6addr(const struct in6_addr *); 64 1.2.2.2 pgoyette static const char *str_ipproto(const uint8_t); 65 1.2.2.2 pgoyette 66 1.2.2.2 pgoyette /* header structure for some protocol */ 67 1.2.2.2 pgoyette struct pppoehdr { 68 1.2.2.2 pgoyette uint8_t vertype; 69 1.2.2.2 pgoyette uint8_t code; 70 1.2.2.2 pgoyette uint16_t session; 71 1.2.2.2 pgoyette uint16_t plen; 72 1.2.2.2 pgoyette } __attribute__((__packed__)); 73 1.2.2.2 pgoyette 74 1.2.2.2 pgoyette struct pppoetag { 75 1.2.2.2 pgoyette uint16_t tag; 76 1.2.2.2 pgoyette uint16_t len; 77 1.2.2.2 pgoyette } __attribute__((__packed__)); 78 1.2.2.2 pgoyette 79 1.2.2.2 pgoyette #define PPPOE_TAG_EOL 0x0000 80 1.2.2.2 pgoyette #define PPPOE_CODE_PADI 0x09 /* Active Discovery Initiation */ 81 1.2.2.2 pgoyette #define PPPOE_CODE_PADO 0x07 /* Active Discovery Offer */ 82 1.2.2.2 pgoyette #define PPPOE_CODE_PADR 0x19 /* Active Discovery Request */ 83 1.2.2.2 pgoyette #define PPPOE_CODE_PADS 0x65 /* Active Discovery Session confirmation */ 84 1.2.2.2 pgoyette #define PPPOE_CODE_PADT 0xA7 /* Active Discovery Terminate */ 85 1.2.2.2 pgoyette 86 1.2.2.2 pgoyette struct ppp_header { 87 1.2.2.2 pgoyette uint8_t address; 88 1.2.2.2 pgoyette uint8_t control; 89 1.2.2.2 pgoyette uint16_t protocol; 90 1.2.2.2 pgoyette } __attribute__((__packed__)); 91 1.2.2.2 pgoyette 92 1.2.2.2 pgoyette #define CISCO_MULTICAST 0x8f /* Cisco multicast address */ 93 1.2.2.2 pgoyette #define CISCO_UNICAST 0x0f /* Cisco unicast address */ 94 1.2.2.2 pgoyette #define CISCO_KEEPALIVE 0x8035 /* Cisco keepalive protocol */ 95 1.2.2.2 pgoyette 96 1.2.2.2 pgoyette #ifndef NELEMS 97 1.2.2.2 pgoyette #define NELEMS(elem) ((sizeof(elem))/(sizeof((elem)[0]))) 98 1.2.2.2 pgoyette #endif 99 1.2.2.2 pgoyette 100 1.2.2.2 pgoyette static int 101 1.2.2.2 pgoyette m_peek_data(const struct mbuf *m, int off, int len, void *vp) 102 1.2.2.2 pgoyette { 103 1.2.2.2 pgoyette unsigned int count; 104 1.2.2.2 pgoyette char *cp = vp; 105 1.2.2.2 pgoyette 106 1.2.2.2 pgoyette if (off < 0 || len < 0) 107 1.2.2.2 pgoyette return -1; 108 1.2.2.2 pgoyette 109 1.2.2.2 pgoyette while (off > 0) { 110 1.2.2.2 pgoyette if (m == 0) 111 1.2.2.2 pgoyette return -1; 112 1.2.2.2 pgoyette if (off < m->m_len) 113 1.2.2.2 pgoyette break; 114 1.2.2.2 pgoyette off -= m->m_len; 115 1.2.2.2 pgoyette m = m->m_next; 116 1.2.2.2 pgoyette } 117 1.2.2.2 pgoyette while (len > 0) { 118 1.2.2.2 pgoyette if (m == 0) 119 1.2.2.2 pgoyette return -1; 120 1.2.2.3 pgoyette count = uimin(m->m_len - off, len); 121 1.2.2.2 pgoyette memcpy(cp, mtod(m, char *) + off, count); 122 1.2.2.2 pgoyette len -= count; 123 1.2.2.2 pgoyette cp += count; 124 1.2.2.2 pgoyette off = 0; 125 1.2.2.2 pgoyette m = m->m_next; 126 1.2.2.2 pgoyette } 127 1.2.2.2 pgoyette 128 1.2.2.2 pgoyette return 0; 129 1.2.2.2 pgoyette } 130 1.2.2.2 pgoyette 131 1.2.2.2 pgoyette static unsigned int 132 1.2.2.2 pgoyette m_peek_len(const struct mbuf *m, const char *modif) 133 1.2.2.2 pgoyette { 134 1.2.2.2 pgoyette const struct mbuf *m0; 135 1.2.2.2 pgoyette unsigned int pktlen; 136 1.2.2.4 pgoyette bool opt_c = false; 137 1.2.2.2 pgoyette unsigned char ch; 138 1.2.2.2 pgoyette 139 1.2.2.4 pgoyette while (modif && (ch = *(modif++)) != '\0') { 140 1.2.2.2 pgoyette switch (ch) { 141 1.2.2.2 pgoyette case 'c': 142 1.2.2.4 pgoyette opt_c = true; 143 1.2.2.2 pgoyette break; 144 1.2.2.2 pgoyette } 145 1.2.2.2 pgoyette } 146 1.2.2.2 pgoyette 147 1.2.2.4 pgoyette if (opt_c == true) 148 1.2.2.2 pgoyette return m->m_len; 149 1.2.2.2 pgoyette 150 1.2.2.2 pgoyette if ((m->m_flags & M_PKTHDR) != 0) 151 1.2.2.2 pgoyette return m->m_pkthdr.len; 152 1.2.2.2 pgoyette 153 1.2.2.2 pgoyette pktlen = 0; 154 1.2.2.2 pgoyette for (m0 = m; m0 != NULL; m0 = m0->m_next) 155 1.2.2.2 pgoyette pktlen += m0->m_len; 156 1.2.2.2 pgoyette 157 1.2.2.2 pgoyette return pktlen; 158 1.2.2.2 pgoyette } 159 1.2.2.2 pgoyette 160 1.2.2.2 pgoyette static char * 161 1.2.2.2 pgoyette str_ethaddr(const uint8_t *ap) 162 1.2.2.2 pgoyette { 163 1.2.2.2 pgoyette static char buf[3 * ETHER_ADDR_LEN]; 164 1.2.2.2 pgoyette 165 1.2.2.2 pgoyette return ether_snprintf(buf, sizeof(buf), ap); 166 1.2.2.2 pgoyette } 167 1.2.2.2 pgoyette 168 1.2.2.2 pgoyette static char * 169 1.2.2.2 pgoyette str_ipaddr(const struct in_addr *ap) 170 1.2.2.2 pgoyette { 171 1.2.2.2 pgoyette static char buf[INET_ADDRSTRLEN]; 172 1.2.2.2 pgoyette 173 1.2.2.2 pgoyette return IN_PRINT(buf, ap); 174 1.2.2.2 pgoyette } 175 1.2.2.2 pgoyette 176 1.2.2.2 pgoyette static char * 177 1.2.2.2 pgoyette str_ip6addr(const struct in6_addr *ap) 178 1.2.2.2 pgoyette { 179 1.2.2.2 pgoyette static char buf[INET6_ADDRSTRLEN]; 180 1.2.2.2 pgoyette 181 1.2.2.2 pgoyette return IN6_PRINT(buf, ap); 182 1.2.2.2 pgoyette } 183 1.2.2.2 pgoyette 184 1.2.2.2 pgoyette static const char * 185 1.2.2.2 pgoyette str_ipproto(const uint8_t proto) 186 1.2.2.2 pgoyette { 187 1.2.2.4 pgoyette 188 1.2.2.2 pgoyette switch (proto) { 189 1.2.2.2 pgoyette case IPPROTO_HOPOPTS: 190 1.2.2.2 pgoyette return ("IPv6 Hop-by-Hop"); 191 1.2.2.2 pgoyette break; 192 1.2.2.2 pgoyette case IPPROTO_TCP: 193 1.2.2.2 pgoyette return("TCP"); 194 1.2.2.2 pgoyette break; 195 1.2.2.2 pgoyette case IPPROTO_UDP: 196 1.2.2.2 pgoyette return("UDP"); 197 1.2.2.2 pgoyette break; 198 1.2.2.2 pgoyette case IPPROTO_ICMP: 199 1.2.2.2 pgoyette return("ICMP"); 200 1.2.2.2 pgoyette break; 201 1.2.2.2 pgoyette case IPPROTO_IGMP: 202 1.2.2.2 pgoyette return("IGMP"); 203 1.2.2.2 pgoyette break; 204 1.2.2.2 pgoyette case IPPROTO_ESP: 205 1.2.2.2 pgoyette return("ESP"); 206 1.2.2.2 pgoyette break; 207 1.2.2.2 pgoyette case IPPROTO_AH: 208 1.2.2.2 pgoyette return("AH"); 209 1.2.2.2 pgoyette break; 210 1.2.2.2 pgoyette case IPPROTO_IPV6_ICMP: 211 1.2.2.2 pgoyette return("ICMP6"); 212 1.2.2.2 pgoyette default: 213 1.2.2.2 pgoyette return("unknown"); 214 1.2.2.2 pgoyette break; 215 1.2.2.2 pgoyette } 216 1.2.2.2 pgoyette 217 1.2.2.2 pgoyette /* not reached */ 218 1.2.2.2 pgoyette return NULL; 219 1.2.2.2 pgoyette } 220 1.2.2.2 pgoyette 221 1.2.2.4 pgoyette void 222 1.2.2.2 pgoyette m_examine_ether(const struct mbuf *m, int off, const char *modif, 223 1.2.2.2 pgoyette void (*pr)(const char *, ...)) 224 1.2.2.2 pgoyette { 225 1.2.2.2 pgoyette struct ether_header eh; 226 1.2.2.2 pgoyette unsigned int pktlen; 227 1.2.2.2 pgoyette 228 1.2.2.2 pgoyette pktlen = m_peek_len(m, modif) - off; 229 1.2.2.2 pgoyette if (pktlen < sizeof(eh)) { 230 1.2.2.4 pgoyette (*pr)("%s: too short mbuf chain (%u < %u)\n", __func__, 231 1.2.2.4 pgoyette pktlen, sizeof(eh)); 232 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 233 1.2.2.2 pgoyette } 234 1.2.2.2 pgoyette 235 1.2.2.2 pgoyette if (m_peek_data(m, off, sizeof(eh), (void *)(&eh)) < 0) { 236 1.2.2.2 pgoyette (*pr)("%s: cannot read header\n", __func__); 237 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 238 1.2.2.2 pgoyette } 239 1.2.2.2 pgoyette off += sizeof(eh); 240 1.2.2.2 pgoyette 241 1.2.2.2 pgoyette (*pr)("ETHER: DST = %s\n", str_ethaddr(eh.ether_dhost)); 242 1.2.2.2 pgoyette (*pr)("ETHER: SRC = %s\n", str_ethaddr(eh.ether_shost)); 243 1.2.2.2 pgoyette 244 1.2.2.2 pgoyette (*pr)("ETHER: TYPE = 0x%04x(", ntohs(eh.ether_type)); 245 1.2.2.2 pgoyette switch (ntohs(eh.ether_type)) { 246 1.2.2.2 pgoyette case ETHERTYPE_PPPOE: 247 1.2.2.2 pgoyette (*pr)("PPPoE)\n"); 248 1.2.2.2 pgoyette return m_examine_pppoe(m, off, modif, pr); 249 1.2.2.2 pgoyette break; 250 1.2.2.2 pgoyette case ETHERTYPE_ARP: 251 1.2.2.2 pgoyette (*pr)("ARP)\n"); 252 1.2.2.2 pgoyette return m_examine_arp(m, off, modif, pr); 253 1.2.2.2 pgoyette break; 254 1.2.2.2 pgoyette case ETHERTYPE_IP: 255 1.2.2.2 pgoyette (*pr)("IPv4)\n"); 256 1.2.2.2 pgoyette return m_examine_ip(m, off, modif, pr); 257 1.2.2.2 pgoyette break; 258 1.2.2.2 pgoyette case ETHERTYPE_IPV6: 259 1.2.2.2 pgoyette (*pr)("IPv6)\n"); 260 1.2.2.2 pgoyette return m_examine_ip6(m, off, modif, pr); 261 1.2.2.2 pgoyette break; 262 1.2.2.2 pgoyette default: 263 1.2.2.2 pgoyette (*pr)("unknown)\n"); 264 1.2.2.2 pgoyette break; 265 1.2.2.2 pgoyette } 266 1.2.2.2 pgoyette 267 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 268 1.2.2.2 pgoyette } 269 1.2.2.2 pgoyette 270 1.2.2.4 pgoyette void 271 1.2.2.2 pgoyette m_examine_pppoe(const struct mbuf *m, int off, const char *modif, 272 1.2.2.2 pgoyette void (*pr)(const char *, ...)) 273 1.2.2.2 pgoyette { 274 1.2.2.2 pgoyette struct pppoehdr ph; 275 1.2.2.2 pgoyette struct pppoetag pt; 276 1.2.2.2 pgoyette unsigned int pktlen; 277 1.2.2.2 pgoyette uint8_t vt; 278 1.2.2.2 pgoyette 279 1.2.2.2 pgoyette pktlen = m_peek_len(m, modif) - off; 280 1.2.2.2 pgoyette if (pktlen < sizeof(ph)) { 281 1.2.2.4 pgoyette (*pr)("%s: too short mbuf chain (%u, %u)\n", __func__, 282 1.2.2.4 pgoyette pktlen, sizeof(ph)); 283 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 284 1.2.2.2 pgoyette } 285 1.2.2.2 pgoyette 286 1.2.2.2 pgoyette if (m_peek_data(m, off, sizeof(ph), (void *)(&ph)) < 0) { 287 1.2.2.2 pgoyette (*pr)("%s: cannot read header\n", __func__); 288 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 289 1.2.2.2 pgoyette } 290 1.2.2.2 pgoyette off += sizeof(ph); 291 1.2.2.2 pgoyette 292 1.2.2.2 pgoyette while (off + sizeof(pt) > pktlen) { 293 1.2.2.2 pgoyette if (m_peek_data(m, off, sizeof(pt), (void *)(&pt)) < 0) { 294 1.2.2.2 pgoyette (*pr)("%s: cannot read header\n", __func__); 295 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 296 1.2.2.2 pgoyette } 297 1.2.2.2 pgoyette off += sizeof(pt); 298 1.2.2.2 pgoyette 299 1.2.2.2 pgoyette if (ntohs(pt.tag) == PPPOE_TAG_EOL) 300 1.2.2.2 pgoyette break; 301 1.2.2.2 pgoyette off += ntohs(pt.len); 302 1.2.2.2 pgoyette } 303 1.2.2.2 pgoyette 304 1.2.2.2 pgoyette vt = ph.vertype; 305 1.2.2.2 pgoyette 306 1.2.2.2 pgoyette (*pr)("PPPoE: Version = %u\n", ((vt >> 4) & 0xff)); 307 1.2.2.2 pgoyette (*pr)("PPPoE: Type = %u\n", (vt & 0xff)); 308 1.2.2.2 pgoyette (*pr)("PPPoE: Code = %u(", ph.code); 309 1.2.2.2 pgoyette switch (ph.code) { 310 1.2.2.2 pgoyette case 0: 311 1.2.2.2 pgoyette (*pr)("DATA"); 312 1.2.2.2 pgoyette break; 313 1.2.2.2 pgoyette case PPPOE_CODE_PADI: 314 1.2.2.2 pgoyette (*pr)("PADI"); 315 1.2.2.2 pgoyette break; 316 1.2.2.2 pgoyette case PPPOE_CODE_PADO: 317 1.2.2.2 pgoyette (*pr)("PADO"); 318 1.2.2.2 pgoyette break; 319 1.2.2.2 pgoyette case PPPOE_CODE_PADS: 320 1.2.2.2 pgoyette (*pr)("PADS"); 321 1.2.2.2 pgoyette break; 322 1.2.2.2 pgoyette case PPPOE_CODE_PADT: 323 1.2.2.2 pgoyette (*pr)("PADT"); 324 1.2.2.2 pgoyette break; 325 1.2.2.2 pgoyette default: 326 1.2.2.2 pgoyette (*pr)("unknown"); 327 1.2.2.2 pgoyette break; 328 1.2.2.2 pgoyette } 329 1.2.2.2 pgoyette (*pr)(")\n"); 330 1.2.2.2 pgoyette 331 1.2.2.2 pgoyette (*pr)("PPPoE: Session = 0x%04x\n", ntohs(ph.session)); 332 1.2.2.2 pgoyette (*pr)("PPPoE: Payload Length = %u\n", ntohs(ph.plen)); 333 1.2.2.2 pgoyette 334 1.2.2.2 pgoyette switch (ph.code) { 335 1.2.2.2 pgoyette case PPPOE_CODE_PADI: 336 1.2.2.2 pgoyette case PPPOE_CODE_PADO: 337 1.2.2.2 pgoyette case PPPOE_CODE_PADS: 338 1.2.2.2 pgoyette case PPPOE_CODE_PADT: 339 1.2.2.2 pgoyette (*pr)("No parser for PPPoE control frame.\n"); 340 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 341 1.2.2.2 pgoyette break; 342 1.2.2.2 pgoyette } 343 1.2.2.2 pgoyette 344 1.2.2.2 pgoyette if (ph.code != 0) { 345 1.2.2.2 pgoyette (*pr)("Unknown PPPoE code.\n"); 346 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 347 1.2.2.2 pgoyette } 348 1.2.2.2 pgoyette 349 1.2.2.2 pgoyette return m_examine_ppp(m, off, modif, pr); 350 1.2.2.2 pgoyette } 351 1.2.2.2 pgoyette 352 1.2.2.4 pgoyette void 353 1.2.2.2 pgoyette m_examine_ppp(const struct mbuf *m, int off, const char *modif, 354 1.2.2.2 pgoyette void (*pr)(const char *, ...)) 355 1.2.2.2 pgoyette { 356 1.2.2.2 pgoyette struct ppp_header h; 357 1.2.2.2 pgoyette unsigned int pktlen; 358 1.2.2.2 pgoyette uint16_t protocol; 359 1.2.2.2 pgoyette 360 1.2.2.2 pgoyette pktlen = m_peek_len(m, modif) - off; 361 1.2.2.2 pgoyette if (pktlen < sizeof(h)) { 362 1.2.2.4 pgoyette (*pr)("%s: too short mbuf chain (%u < %u)\n", __func__, 363 1.2.2.4 pgoyette pktlen, sizeof(h)); 364 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 365 1.2.2.2 pgoyette } 366 1.2.2.2 pgoyette 367 1.2.2.2 pgoyette if (m_peek_data(m, off, sizeof(h), (void *)(&h)) < 0) { 368 1.2.2.2 pgoyette (*pr)("%s: cannot read header\n", __func__); 369 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 370 1.2.2.2 pgoyette } 371 1.2.2.2 pgoyette off += sizeof(h); 372 1.2.2.2 pgoyette 373 1.2.2.2 pgoyette protocol = ntohs(h.protocol); 374 1.2.2.2 pgoyette 375 1.2.2.2 pgoyette (*pr)("SPPP: Address = %d(", h.address); 376 1.2.2.2 pgoyette switch (h.address) { 377 1.2.2.2 pgoyette case PPP_ALLSTATIONS: 378 1.2.2.2 pgoyette (*pr)("ALLSTATIONS)\n"); 379 1.2.2.2 pgoyette (*pr)("SPPP: Protocol = %d(", protocol); 380 1.2.2.2 pgoyette switch (protocol) { 381 1.2.2.2 pgoyette case PPP_LCP: 382 1.2.2.2 pgoyette (*pr)("LCP)\n"); 383 1.2.2.2 pgoyette break; 384 1.2.2.2 pgoyette case PPP_PAP: 385 1.2.2.2 pgoyette (*pr)("PAP)\n"); 386 1.2.2.2 pgoyette break; 387 1.2.2.2 pgoyette case PPP_CHAP: 388 1.2.2.2 pgoyette (*pr)("CHAP)\n"); 389 1.2.2.2 pgoyette break; 390 1.2.2.2 pgoyette case PPP_IPCP: 391 1.2.2.2 pgoyette (*pr)("IPCP)\n"); 392 1.2.2.2 pgoyette break; 393 1.2.2.2 pgoyette case PPP_IPV6CP: 394 1.2.2.2 pgoyette (*pr)("IPV6CP)\n"); 395 1.2.2.2 pgoyette break; 396 1.2.2.2 pgoyette case PPP_IP: 397 1.2.2.2 pgoyette (*pr)("IP)\n"); 398 1.2.2.2 pgoyette return m_examine_ip(m, off, modif, pr); 399 1.2.2.2 pgoyette break; 400 1.2.2.2 pgoyette case PPP_IPV6: 401 1.2.2.2 pgoyette (*pr)("IPv6)\n"); 402 1.2.2.2 pgoyette return m_examine_ip6(m, off, modif, pr); 403 1.2.2.2 pgoyette break; 404 1.2.2.2 pgoyette default: 405 1.2.2.2 pgoyette (*pr)("unknown)\n"); 406 1.2.2.2 pgoyette break; 407 1.2.2.2 pgoyette } 408 1.2.2.2 pgoyette break; 409 1.2.2.2 pgoyette case CISCO_MULTICAST: 410 1.2.2.2 pgoyette case CISCO_UNICAST: 411 1.2.2.4 pgoyette if (h.address == CISCO_MULTICAST) 412 1.2.2.2 pgoyette (*pr)("MULTICAST)\n"); 413 1.2.2.4 pgoyette else 414 1.2.2.2 pgoyette (*pr)("UNICAST)\n"); 415 1.2.2.4 pgoyette 416 1.2.2.2 pgoyette (*pr)("SPPP: Protocol = %d(", protocol); 417 1.2.2.2 pgoyette switch (protocol) { 418 1.2.2.2 pgoyette case CISCO_KEEPALIVE: 419 1.2.2.2 pgoyette (*pr)("Keepalive)\n"); 420 1.2.2.2 pgoyette break; 421 1.2.2.2 pgoyette case ETHERTYPE_IP: 422 1.2.2.2 pgoyette (*pr)("IP)\n"); 423 1.2.2.2 pgoyette return m_examine_ip(m, off, modif, pr); 424 1.2.2.2 pgoyette break; 425 1.2.2.2 pgoyette case ETHERTYPE_IPV6: 426 1.2.2.2 pgoyette (*pr)("IPv6)\n"); 427 1.2.2.2 pgoyette return m_examine_ip6(m, off, modif, pr); 428 1.2.2.2 pgoyette break; 429 1.2.2.2 pgoyette default: 430 1.2.2.2 pgoyette (*pr)("unknown)\n"); 431 1.2.2.2 pgoyette break; 432 1.2.2.2 pgoyette } 433 1.2.2.2 pgoyette break; 434 1.2.2.2 pgoyette default: 435 1.2.2.2 pgoyette (*pr)("unknown)\n", h.address); 436 1.2.2.2 pgoyette break; 437 1.2.2.2 pgoyette } 438 1.2.2.2 pgoyette 439 1.2.2.2 pgoyette (*pr)("No parser for address %d, protocol %d\n", h.address, protocol); 440 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 441 1.2.2.2 pgoyette } 442 1.2.2.2 pgoyette 443 1.2.2.4 pgoyette void 444 1.2.2.2 pgoyette m_examine_arp(const struct mbuf *m, int off, const char *modif, 445 1.2.2.2 pgoyette void (*pr)(const char *, ...)) 446 1.2.2.2 pgoyette { 447 1.2.2.2 pgoyette unsigned int pktlen; 448 1.2.2.2 pgoyette struct arphdr ar; 449 1.2.2.2 pgoyette uint16_t hrd, op; 450 1.2.2.2 pgoyette struct in_addr isaddr, itaddr; 451 1.2.2.2 pgoyette uint8_t esaddr[ETHER_ADDR_LEN], etaddr[ETHER_ADDR_LEN]; 452 1.2.2.2 pgoyette 453 1.2.2.2 pgoyette pktlen = m_peek_len(m, modif) - off; 454 1.2.2.2 pgoyette if (pktlen < sizeof(ar)) { 455 1.2.2.4 pgoyette (*pr)("%s: too short mbuf chain (%u < %u)\n", __func__, 456 1.2.2.4 pgoyette pktlen, sizeof(ar)); 457 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 458 1.2.2.2 pgoyette } 459 1.2.2.2 pgoyette 460 1.2.2.2 pgoyette if (m_peek_data(m, off, sizeof(ar), (void *)(&ar)) < 0) { 461 1.2.2.2 pgoyette (*pr)("%s: cannot read header\n", __func__); 462 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 463 1.2.2.2 pgoyette } 464 1.2.2.2 pgoyette off += sizeof(ar); 465 1.2.2.2 pgoyette 466 1.2.2.2 pgoyette hrd = ntohs(ar.ar_hrd); 467 1.2.2.2 pgoyette (*pr)("ARP: AddressType = %u(", hrd); 468 1.2.2.2 pgoyette switch (hrd) { 469 1.2.2.2 pgoyette case ARPHRD_ETHER: 470 1.2.2.2 pgoyette (*pr)("ETHER)\n"); 471 1.2.2.2 pgoyette break; 472 1.2.2.2 pgoyette case ARPHRD_IEEE802: 473 1.2.2.2 pgoyette (*pr)("IEEE802)\n"); 474 1.2.2.2 pgoyette break; 475 1.2.2.2 pgoyette default: 476 1.2.2.2 pgoyette (*pr)("unknown)\n"); 477 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 478 1.2.2.2 pgoyette break; 479 1.2.2.2 pgoyette } 480 1.2.2.2 pgoyette (*pr)("ARP: Protocol Address Format = %u\n", ntohs(ar.ar_pro)); 481 1.2.2.2 pgoyette (*pr)("ARP: Protocol Address Length = %u\n", ar.ar_pln); 482 1.2.2.2 pgoyette (*pr)("ARP: H/W Address Length = %u\n", ar.ar_hln); 483 1.2.2.2 pgoyette op = ntohs(ar.ar_op); 484 1.2.2.2 pgoyette (*pr)("ARP: Operation = %u(", op); 485 1.2.2.2 pgoyette switch (op) { 486 1.2.2.2 pgoyette case ARPOP_REQUEST: 487 1.2.2.2 pgoyette (*pr)("REQUEST)\n"); 488 1.2.2.2 pgoyette break; 489 1.2.2.2 pgoyette case ARPOP_REPLY: 490 1.2.2.2 pgoyette (*pr)("REPLY)\n"); 491 1.2.2.2 pgoyette break; 492 1.2.2.2 pgoyette case ARPOP_REVREQUEST: 493 1.2.2.2 pgoyette (*pr)("REVREQUEST)\n"); 494 1.2.2.2 pgoyette break; 495 1.2.2.2 pgoyette case ARPOP_REVREPLY: 496 1.2.2.2 pgoyette (*pr)("REVREPLY)\n"); 497 1.2.2.2 pgoyette break; 498 1.2.2.2 pgoyette case ARPOP_INVREQUEST: 499 1.2.2.2 pgoyette (*pr)("INVREQUEST)\n"); 500 1.2.2.2 pgoyette break; 501 1.2.2.2 pgoyette case ARPOP_INVREPLY: 502 1.2.2.2 pgoyette (*pr)("INVREPLY)\n"); 503 1.2.2.2 pgoyette break; 504 1.2.2.2 pgoyette } 505 1.2.2.2 pgoyette 506 1.2.2.2 pgoyette if (ar.ar_hln == 0 || ar.ar_pln == 0 || 507 1.2.2.2 pgoyette ar.ar_hln != sizeof(esaddr) || ar.ar_pln != sizeof(isaddr)) { 508 1.2.2.2 pgoyette (*pr)("Cannot parse.\n"); 509 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 510 1.2.2.2 pgoyette } 511 1.2.2.2 pgoyette 512 1.2.2.2 pgoyette if (m_peek_data(m, off, sizeof(esaddr), (void *)(esaddr)) < 0) { 513 1.2.2.2 pgoyette (*pr)("Cannot read payload\n"); 514 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 515 1.2.2.2 pgoyette } 516 1.2.2.2 pgoyette off += sizeof(esaddr); 517 1.2.2.2 pgoyette (*pr)("ARP: Ether Src = %s\n", str_ethaddr(esaddr)); 518 1.2.2.2 pgoyette 519 1.2.2.2 pgoyette if (m_peek_data(m, off, sizeof(isaddr), (void *)(&isaddr)) < 0) { 520 1.2.2.2 pgoyette (*pr)("Cannot read payload\n"); 521 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 522 1.2.2.2 pgoyette } 523 1.2.2.2 pgoyette off += sizeof(isaddr); 524 1.2.2.2 pgoyette (*pr)("ARP: IP Src = %s\n", str_ipaddr(&isaddr)); 525 1.2.2.2 pgoyette 526 1.2.2.2 pgoyette if (m_peek_data(m, off, sizeof(etaddr), (void *)(etaddr)) < 0) { 527 1.2.2.2 pgoyette (*pr)("Cannot read payload\n"); 528 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 529 1.2.2.2 pgoyette } 530 1.2.2.2 pgoyette off += sizeof(etaddr); 531 1.2.2.2 pgoyette (*pr)("ARP: Ether Tgt = %s\n", str_ethaddr(etaddr)); 532 1.2.2.2 pgoyette 533 1.2.2.2 pgoyette if (m_peek_data(m, off, sizeof(itaddr), (void *)(&itaddr)) < 0) { 534 1.2.2.2 pgoyette (*pr)("Cannot read payload\n"); 535 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 536 1.2.2.2 pgoyette } 537 1.2.2.2 pgoyette off += sizeof(itaddr); 538 1.2.2.2 pgoyette (*pr)("ARP: IP Tgt = %s\n", str_ipaddr(&itaddr)); 539 1.2.2.2 pgoyette 540 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 541 1.2.2.2 pgoyette } 542 1.2.2.2 pgoyette 543 1.2.2.4 pgoyette void 544 1.2.2.2 pgoyette m_examine_ip(const struct mbuf *m, int off, const char *modif, 545 1.2.2.2 pgoyette void (*pr)(const char *, ...)) 546 1.2.2.2 pgoyette { 547 1.2.2.2 pgoyette unsigned int pktlen; 548 1.2.2.2 pgoyette struct ip ip; 549 1.2.2.2 pgoyette uint16_t offset; 550 1.2.2.2 pgoyette 551 1.2.2.2 pgoyette pktlen = m_peek_len(m, modif) - off; 552 1.2.2.2 pgoyette if (pktlen < sizeof(ip)) { 553 1.2.2.4 pgoyette (*pr)("%s: too short mbuf chain (%u < %u)\n", __func__, 554 1.2.2.4 pgoyette pktlen, sizeof(ip)); 555 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 556 1.2.2.2 pgoyette } 557 1.2.2.2 pgoyette 558 1.2.2.2 pgoyette if (m_peek_data(m, off, sizeof(ip), (void *)(&ip)) < 0) { 559 1.2.2.2 pgoyette (*pr)("%s: cannot read header\n", __func__); 560 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 561 1.2.2.2 pgoyette } 562 1.2.2.2 pgoyette off += sizeof(ip); 563 1.2.2.2 pgoyette 564 1.2.2.2 pgoyette (*pr)("IP: Version = %u\n", ip.ip_v); 565 1.2.2.2 pgoyette (*pr)("IP: Header Length = %u\n", (ip.ip_hl << 2)); 566 1.2.2.2 pgoyette (*pr)("IP: ToS = 0x%02x\n", ip.ip_tos); 567 1.2.2.2 pgoyette (*pr)("IP: Packet Length = %u\n", ntohs(ip.ip_len)); 568 1.2.2.2 pgoyette (*pr)("IP: ID = %u\n", ntohs(ip.ip_id)); 569 1.2.2.2 pgoyette offset = ntohs(ip.ip_off); 570 1.2.2.2 pgoyette (*pr)("IP: Offset = %u\n", (offset & IP_OFFMASK)); 571 1.2.2.4 pgoyette if (offset & IP_RF) 572 1.2.2.2 pgoyette (*pr)("IP: Flag 0x%04x (reserved)\n", IP_RF); 573 1.2.2.4 pgoyette if (offset & IP_EF) 574 1.2.2.2 pgoyette (*pr)("IP: Flag 0x%04x (evil flag)\n", IP_EF); 575 1.2.2.4 pgoyette if (offset & IP_DF) 576 1.2.2.2 pgoyette (*pr)("IP: Flag 0x%04x (don't fragment)\n", IP_DF); 577 1.2.2.4 pgoyette if (offset & IP_MF) 578 1.2.2.2 pgoyette (*pr)("IP: Flag 0x%04x (more fragment)\n", IP_MF); 579 1.2.2.2 pgoyette (*pr)("IP: TTL = %u\n", ip.ip_ttl); 580 1.2.2.2 pgoyette (*pr)("IP: protocol = %u(%s)\n", ip.ip_p, str_ipproto(ip.ip_p)); 581 1.2.2.4 pgoyette (*pr)("IP: checksum = 0x%04x\n", ntohs(ip.ip_sum)); 582 1.2.2.2 pgoyette (*pr)("IP: Src = %s\n", str_ipaddr(&ip.ip_src)); 583 1.2.2.2 pgoyette (*pr)("IP: Dst = %s\n", str_ipaddr(&ip.ip_dst)); 584 1.2.2.2 pgoyette 585 1.2.2.2 pgoyette switch (ip.ip_p) { 586 1.2.2.2 pgoyette case IPPROTO_ICMP: 587 1.2.2.2 pgoyette return m_examine_icmp(m, off, modif, pr); 588 1.2.2.2 pgoyette break; 589 1.2.2.2 pgoyette case IPPROTO_TCP: 590 1.2.2.2 pgoyette return m_examine_tcp(m, off, modif, pr); 591 1.2.2.2 pgoyette break; 592 1.2.2.2 pgoyette case IPPROTO_UDP: 593 1.2.2.2 pgoyette return m_examine_udp(m, off, modif, pr); 594 1.2.2.2 pgoyette break; 595 1.2.2.2 pgoyette default: 596 1.2.2.2 pgoyette break; 597 1.2.2.2 pgoyette } 598 1.2.2.2 pgoyette 599 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 600 1.2.2.2 pgoyette } 601 1.2.2.2 pgoyette 602 1.2.2.4 pgoyette void 603 1.2.2.2 pgoyette m_examine_icmp(const struct mbuf *m, int off, const char *modif, 604 1.2.2.2 pgoyette void (*pr)(const char *, ...)) 605 1.2.2.2 pgoyette { 606 1.2.2.2 pgoyette unsigned int pktlen; 607 1.2.2.2 pgoyette struct icmp icmphdr; 608 1.2.2.2 pgoyette 609 1.2.2.2 pgoyette pktlen = m_peek_len(m, modif) - off; 610 1.2.2.2 pgoyette if (pktlen < sizeof(icmphdr)) { 611 1.2.2.4 pgoyette (*pr)("%s: too short mbuf chain (%u < %u)\n", __func__, 612 1.2.2.4 pgoyette pktlen, sizeof(icmphdr)); 613 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 614 1.2.2.2 pgoyette } 615 1.2.2.2 pgoyette 616 1.2.2.2 pgoyette if (m_peek_data(m, off, sizeof(icmphdr), (void *)(&icmphdr)) < 0) { 617 1.2.2.2 pgoyette (*pr)("%s: cannot read header\n", __func__); 618 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 619 1.2.2.2 pgoyette } 620 1.2.2.2 pgoyette off += sizeof(icmphdr); 621 1.2.2.2 pgoyette 622 1.2.2.2 pgoyette (*pr)("ICMP: Type = %u(", icmphdr.icmp_type); 623 1.2.2.2 pgoyette switch (icmphdr.icmp_type) { 624 1.2.2.2 pgoyette case ICMP_ECHOREPLY: 625 1.2.2.2 pgoyette (*pr)("Echo Reply)\n"); 626 1.2.2.2 pgoyette break; 627 1.2.2.2 pgoyette case ICMP_UNREACH: 628 1.2.2.2 pgoyette (*pr)("Destination Unreachable)\n"); 629 1.2.2.2 pgoyette break; 630 1.2.2.2 pgoyette case ICMP_SOURCEQUENCH: 631 1.2.2.2 pgoyette (*pr)("Source Quench)\n"); 632 1.2.2.2 pgoyette break; 633 1.2.2.2 pgoyette case ICMP_REDIRECT: 634 1.2.2.2 pgoyette (*pr)("Redirect)\n"); 635 1.2.2.2 pgoyette break; 636 1.2.2.2 pgoyette case ICMP_TIMXCEED: 637 1.2.2.2 pgoyette (*pr)("Time Exceeded)\n"); 638 1.2.2.2 pgoyette break; 639 1.2.2.2 pgoyette default: 640 1.2.2.2 pgoyette (*pr)("unknown)\n"); 641 1.2.2.2 pgoyette break; 642 1.2.2.2 pgoyette } 643 1.2.2.2 pgoyette (*pr)("ICMP: Code = %d\n", icmphdr.icmp_code); 644 1.2.2.2 pgoyette 645 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 646 1.2.2.2 pgoyette } 647 1.2.2.2 pgoyette 648 1.2.2.4 pgoyette void 649 1.2.2.2 pgoyette m_examine_ip6(const struct mbuf *m, int off, const char *modif, 650 1.2.2.2 pgoyette void (*pr)(const char *, ...)) 651 1.2.2.2 pgoyette { 652 1.2.2.2 pgoyette unsigned int pktlen; 653 1.2.2.2 pgoyette struct ip6_hdr ip6; 654 1.2.2.2 pgoyette struct ip6_hbh hbh; 655 1.2.2.2 pgoyette int hbhlen; 656 1.2.2.2 pgoyette uint32_t flow; 657 1.2.2.2 pgoyette uint8_t vfc; 658 1.2.2.2 pgoyette uint8_t nxt; 659 1.2.2.2 pgoyette 660 1.2.2.2 pgoyette pktlen = m_peek_len(m, modif) - off; 661 1.2.2.2 pgoyette if (pktlen < sizeof(ip6)) { 662 1.2.2.4 pgoyette (*pr)("%s: too short mbuf chain (%u < %u)\n", __func__, 663 1.2.2.4 pgoyette pktlen, sizeof(ip6)); 664 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 665 1.2.2.2 pgoyette } 666 1.2.2.2 pgoyette 667 1.2.2.2 pgoyette if (m_peek_data(m, off, sizeof(ip6), (void *)(&ip6)) < 0) { 668 1.2.2.2 pgoyette (*pr)("%s: cannot read header\n", __func__); 669 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 670 1.2.2.2 pgoyette } 671 1.2.2.2 pgoyette off += sizeof(ip6); 672 1.2.2.2 pgoyette 673 1.2.2.2 pgoyette vfc = ip6.ip6_vfc; 674 1.2.2.2 pgoyette (*pr)("IPv6: Version = %u\n", (vfc & IPV6_VERSION_MASK) >> 4); 675 1.2.2.2 pgoyette flow = ntohl(ip6.ip6_flow); 676 1.2.2.2 pgoyette (*pr)("IPv6: Flow INFO = 0x%07x\n", flow & IPV6_FLOWINFO_MASK); 677 1.2.2.4 pgoyette (*pr)("IPv6: Payload Length = %u\n", ntohs(ip6.ip6_plen)); 678 1.2.2.2 pgoyette nxt = ip6.ip6_nxt; 679 1.2.2.2 pgoyette (*pr)("IPv6: Next Header = %u(%s)\n", nxt, str_ipproto(nxt)); 680 1.2.2.2 pgoyette (*pr)("IPv6: Hop Limit = %u\n", ip6.ip6_hlim); 681 1.2.2.2 pgoyette (*pr)("IPv6: Src = %s\n", str_ip6addr(&ip6.ip6_src)); 682 1.2.2.2 pgoyette (*pr)("IPv6: Dst = %s\n", str_ip6addr(&ip6.ip6_dst)); 683 1.2.2.2 pgoyette 684 1.2.2.2 pgoyette /* Strip Hop-by-Hop options */ 685 1.2.2.2 pgoyette if (nxt == IPPROTO_HOPOPTS) { 686 1.2.2.2 pgoyette if (m_peek_data(m, off, sizeof(hbh), (void *)(&hbh)) < 0) { 687 1.2.2.2 pgoyette (*pr)("Cannot read option\n"); 688 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 689 1.2.2.2 pgoyette } 690 1.2.2.2 pgoyette hbhlen = (hbh.ip6h_len + 1) << 3; 691 1.2.2.2 pgoyette nxt = hbh.ip6h_nxt; 692 1.2.2.2 pgoyette off += hbhlen; 693 1.2.2.2 pgoyette 694 1.2.2.2 pgoyette (*pr)("IPv6: Stripped Hop-by-Hop\n"); 695 1.2.2.2 pgoyette (*pr)("IPv6: Next Header = %u(%s)\n", nxt, str_ipproto(nxt)); 696 1.2.2.2 pgoyette } 697 1.2.2.2 pgoyette 698 1.2.2.2 pgoyette switch (nxt) { 699 1.2.2.2 pgoyette case IPPROTO_IPV6_ICMP: 700 1.2.2.2 pgoyette return m_examine_icmp6(m, off, modif, pr); 701 1.2.2.2 pgoyette break; 702 1.2.2.2 pgoyette case IPPROTO_TCP: 703 1.2.2.2 pgoyette return m_examine_tcp(m, off, modif, pr); 704 1.2.2.2 pgoyette break; 705 1.2.2.2 pgoyette case IPPROTO_UDP: 706 1.2.2.2 pgoyette return m_examine_udp(m, off, modif, pr); 707 1.2.2.2 pgoyette break; 708 1.2.2.2 pgoyette default: 709 1.2.2.2 pgoyette break; 710 1.2.2.2 pgoyette } 711 1.2.2.2 pgoyette 712 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 713 1.2.2.2 pgoyette } 714 1.2.2.2 pgoyette 715 1.2.2.4 pgoyette void 716 1.2.2.2 pgoyette m_examine_icmp6(const struct mbuf *m, int off, const char *modif, 717 1.2.2.2 pgoyette void (*pr)(const char *, ...)) 718 1.2.2.2 pgoyette { 719 1.2.2.2 pgoyette unsigned int pktlen; 720 1.2.2.2 pgoyette struct icmp6_hdr icmp6; 721 1.2.2.2 pgoyette 722 1.2.2.2 pgoyette pktlen = m_peek_len(m, modif) - off; 723 1.2.2.2 pgoyette if (pktlen < sizeof(icmp6)) { 724 1.2.2.4 pgoyette (*pr)("%s: too short mbuf chain (%u < %u)\n", __func__, 725 1.2.2.4 pgoyette pktlen, sizeof(icmp6)); 726 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 727 1.2.2.2 pgoyette } 728 1.2.2.2 pgoyette 729 1.2.2.2 pgoyette if (m_peek_data(m, off, sizeof(icmp6), (void *)(&icmp6)) < 0) { 730 1.2.2.2 pgoyette (*pr)("%s: cannot read header\n", __func__); 731 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 732 1.2.2.2 pgoyette } 733 1.2.2.2 pgoyette off += sizeof(icmp6); 734 1.2.2.2 pgoyette 735 1.2.2.2 pgoyette (*pr)("ICMP6: Type = %u(", icmp6.icmp6_type); 736 1.2.2.2 pgoyette switch (icmp6.icmp6_type) { 737 1.2.2.2 pgoyette case ICMP6_DST_UNREACH: 738 1.2.2.2 pgoyette (*pr)("Destination Unreachable)\n"); 739 1.2.2.2 pgoyette break; 740 1.2.2.2 pgoyette case ICMP6_PACKET_TOO_BIG: 741 1.2.2.2 pgoyette (*pr)("Packet Too Big)\n"); 742 1.2.2.2 pgoyette break; 743 1.2.2.2 pgoyette case ICMP6_TIME_EXCEEDED: 744 1.2.2.2 pgoyette (*pr)("Time Exceeded)\n"); 745 1.2.2.2 pgoyette break; 746 1.2.2.2 pgoyette case ICMP6_PARAM_PROB: 747 1.2.2.2 pgoyette (*pr)("Parameter Problem)\n"); 748 1.2.2.2 pgoyette break; 749 1.2.2.2 pgoyette case ICMP6_ECHO_REQUEST: 750 1.2.2.2 pgoyette (*pr)("Echo Request)\n"); 751 1.2.2.2 pgoyette break; 752 1.2.2.2 pgoyette case ICMP6_ECHO_REPLY: 753 1.2.2.2 pgoyette (*pr)("Echo Reply)\n"); 754 1.2.2.2 pgoyette break; 755 1.2.2.2 pgoyette 756 1.2.2.2 pgoyette case MLD_LISTENER_QUERY: 757 1.2.2.2 pgoyette (*pr)("MLD Listener Query)\n"); 758 1.2.2.2 pgoyette break; 759 1.2.2.2 pgoyette case MLD_LISTENER_REPORT: 760 1.2.2.2 pgoyette (*pr)("MLD Listener Report)\n"); 761 1.2.2.2 pgoyette break; 762 1.2.2.2 pgoyette case MLD_LISTENER_DONE: 763 1.2.2.2 pgoyette (*pr)("MLD Listener Done)\n"); 764 1.2.2.2 pgoyette break; 765 1.2.2.2 pgoyette 766 1.2.2.2 pgoyette case ND_ROUTER_SOLICIT: 767 1.2.2.2 pgoyette (*pr)("Router Solicitation)\n"); 768 1.2.2.2 pgoyette break; 769 1.2.2.2 pgoyette case ND_ROUTER_ADVERT: 770 1.2.2.2 pgoyette (*pr)("Router Advertizement)\n"); 771 1.2.2.2 pgoyette break; 772 1.2.2.2 pgoyette case ND_NEIGHBOR_SOLICIT: 773 1.2.2.2 pgoyette (*pr)("Neighbor Solicitation)\n"); 774 1.2.2.2 pgoyette break; 775 1.2.2.2 pgoyette case ND_NEIGHBOR_ADVERT: 776 1.2.2.2 pgoyette (*pr)("Neighbor Advertizement)\n"); 777 1.2.2.2 pgoyette break; 778 1.2.2.2 pgoyette case ND_REDIRECT: 779 1.2.2.2 pgoyette (*pr)("Redirect)\n"); 780 1.2.2.2 pgoyette break; 781 1.2.2.2 pgoyette 782 1.2.2.2 pgoyette default: 783 1.2.2.2 pgoyette (*pr)("unknown)\n"); 784 1.2.2.2 pgoyette break; 785 1.2.2.2 pgoyette } 786 1.2.2.2 pgoyette (*pr)("ICMP6: Code = %u\n", icmp6.icmp6_code); 787 1.2.2.2 pgoyette 788 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 789 1.2.2.2 pgoyette } 790 1.2.2.2 pgoyette 791 1.2.2.4 pgoyette void 792 1.2.2.2 pgoyette m_examine_tcp(const struct mbuf *m, int off, const char *modif, 793 1.2.2.2 pgoyette void (*pr)(const char *, ...)) 794 1.2.2.2 pgoyette { 795 1.2.2.2 pgoyette unsigned int pktlen; 796 1.2.2.2 pgoyette struct tcphdr tcp; 797 1.2.2.2 pgoyette 798 1.2.2.2 pgoyette pktlen = m_peek_len(m, modif) - off; 799 1.2.2.2 pgoyette if (pktlen < sizeof(tcp)) { 800 1.2.2.4 pgoyette (*pr)("%s: too short mbuf chain (%u < %u)\n", __func__, 801 1.2.2.4 pgoyette pktlen, sizeof(tcp)); 802 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 803 1.2.2.2 pgoyette } 804 1.2.2.2 pgoyette 805 1.2.2.2 pgoyette if (m_peek_data(m, off, sizeof(tcp), (void *)(&tcp)) < 0) { 806 1.2.2.2 pgoyette (*pr)("%s: cannot read header\n", __func__); 807 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 808 1.2.2.2 pgoyette } 809 1.2.2.2 pgoyette off += sizeof(tcp); 810 1.2.2.2 pgoyette 811 1.2.2.2 pgoyette (*pr)("TCP: Src = %u\n", ntohs(tcp.th_sport)); 812 1.2.2.2 pgoyette (*pr)("TCP: Dst = %u\n", ntohs(tcp.th_dport)); 813 1.2.2.2 pgoyette (*pr)("TCP: Seq. = %u\n", ntohl(tcp.th_seq)); 814 1.2.2.2 pgoyette (*pr)("TCP: Ack. = %u\n", ntohl(tcp.th_ack)); 815 1.2.2.4 pgoyette (*pr)("TCP: Header Length = %u\n", tcp.th_off << 2); 816 1.2.2.2 pgoyette if (tcp.th_flags) { 817 1.2.2.2 pgoyette (*pr)("TCP: Flags 0x%02x : ", tcp.th_flags); 818 1.2.2.2 pgoyette if (tcp.th_flags & TH_FIN) 819 1.2.2.2 pgoyette (*pr)("FIN "); 820 1.2.2.2 pgoyette if (tcp.th_flags & TH_SYN) 821 1.2.2.2 pgoyette (*pr)("SYN "); 822 1.2.2.2 pgoyette if (tcp.th_flags & TH_RST) 823 1.2.2.2 pgoyette (*pr)("RST "); 824 1.2.2.2 pgoyette if (tcp.th_flags & TH_PUSH) 825 1.2.2.2 pgoyette (*pr)("PUSH "); 826 1.2.2.2 pgoyette if (tcp.th_flags & TH_URG) 827 1.2.2.2 pgoyette (*pr)("URG "); 828 1.2.2.2 pgoyette if (tcp.th_flags & TH_ECE) 829 1.2.2.2 pgoyette (*pr)("ECE "); 830 1.2.2.2 pgoyette if (tcp.th_flags & TH_CWR) 831 1.2.2.2 pgoyette (*pr)("CWR "); 832 1.2.2.2 pgoyette (*pr)("\n"); 833 1.2.2.2 pgoyette } 834 1.2.2.2 pgoyette (*pr)("TCP: Windows Size = %u\n", ntohs(tcp.th_win)); 835 1.2.2.4 pgoyette (*pr)("TCP: checksum = 0x%04x\n", ntohs(tcp.th_sum)); 836 1.2.2.2 pgoyette (*pr)("TCP: Urgent Pointer = %u\n", ntohs(tcp.th_urp)); 837 1.2.2.2 pgoyette 838 1.2.2.4 pgoyette int len; 839 1.2.2.4 pgoyette len = (tcp.th_off << 2) - sizeof(struct tcphdr); 840 1.2.2.4 pgoyette if (len > 0) { 841 1.2.2.4 pgoyette uint8_t *bufp, *op, opt, optlen; 842 1.2.2.4 pgoyette 843 1.2.2.4 pgoyette bufp = malloc(len, M_TEMP, M_DONTWAIT); 844 1.2.2.4 pgoyette if ((bufp == NULL) || (m_peek_data(m, off, len, bufp) < 0)) { 845 1.2.2.4 pgoyette (*pr)("%s: cannot read TCP option\n", __func__); 846 1.2.2.4 pgoyette if (bufp != NULL) 847 1.2.2.4 pgoyette free(bufp, M_TEMP); 848 1.2.2.4 pgoyette return m_examine_hex(m, off, modif, pr); 849 1.2.2.4 pgoyette } 850 1.2.2.4 pgoyette off += len; 851 1.2.2.4 pgoyette op = bufp; 852 1.2.2.4 pgoyette 853 1.2.2.4 pgoyette while (len > 0) { 854 1.2.2.4 pgoyette opt = op[0]; 855 1.2.2.4 pgoyette if (opt == TCPOPT_EOL) 856 1.2.2.4 pgoyette break; 857 1.2.2.4 pgoyette if (opt == TCPOPT_NOP) { 858 1.2.2.4 pgoyette (*pr)("TCP: OPTION: NOP\n"); 859 1.2.2.4 pgoyette op++; 860 1.2.2.4 pgoyette len--; 861 1.2.2.4 pgoyette continue; 862 1.2.2.4 pgoyette } 863 1.2.2.4 pgoyette if (opt == TCPOPT_PAD) { 864 1.2.2.4 pgoyette (*pr)("TCP: OPTION: PAD\n"); 865 1.2.2.4 pgoyette op++; 866 1.2.2.4 pgoyette len--; 867 1.2.2.4 pgoyette continue; 868 1.2.2.4 pgoyette } 869 1.2.2.4 pgoyette optlen = op[1]; 870 1.2.2.4 pgoyette if (optlen == 0) 871 1.2.2.4 pgoyette break; 872 1.2.2.4 pgoyette 873 1.2.2.4 pgoyette if (opt == TCPOPT_MAXSEG && optlen == TCPOLEN_MAXSEG) { 874 1.2.2.4 pgoyette uint16_t mss; 875 1.2.2.4 pgoyette 876 1.2.2.4 pgoyette bcopy(op + 2, &mss, sizeof(mss)); 877 1.2.2.4 pgoyette (*pr)("TCP: OPTION: MSS = %d\n", 878 1.2.2.4 pgoyette ntohs(mss)); 879 1.2.2.4 pgoyette 880 1.2.2.4 pgoyette op += optlen; 881 1.2.2.4 pgoyette len -= optlen; 882 1.2.2.4 pgoyette continue; 883 1.2.2.4 pgoyette } else if (opt == TCPOPT_WINDOW 884 1.2.2.4 pgoyette && optlen == TCPOLEN_WINDOW) { 885 1.2.2.4 pgoyette (*pr)("TCP: OPTION: wscale = %d\n", op[2]); 886 1.2.2.4 pgoyette op += optlen; 887 1.2.2.4 pgoyette len -= optlen; 888 1.2.2.4 pgoyette continue; 889 1.2.2.4 pgoyette } else if (opt == TCPOPT_SACK_PERMITTED 890 1.2.2.4 pgoyette && optlen == TCPOLEN_SACK_PERMITTED) { 891 1.2.2.4 pgoyette (*pr)("TCP: OPTION: SACK OK\n"); 892 1.2.2.4 pgoyette op += optlen; 893 1.2.2.4 pgoyette len -= optlen; 894 1.2.2.4 pgoyette continue; 895 1.2.2.4 pgoyette } else if (opt == TCPOPT_TIMESTAMP 896 1.2.2.4 pgoyette && optlen == TCPOLEN_TIMESTAMP) { 897 1.2.2.4 pgoyette uint32_t ts_val, ts_ecr; 898 1.2.2.4 pgoyette 899 1.2.2.4 pgoyette memcpy(&ts_val, op + 2, sizeof(ts_val)); 900 1.2.2.4 pgoyette memcpy(&ts_ecr, op + 6, sizeof(ts_ecr)); 901 1.2.2.4 pgoyette (*pr)("TCP: OPTION: TIMESTAMP = %u, " 902 1.2.2.4 pgoyette "ECR = %u\n", 903 1.2.2.4 pgoyette ntohl(ts_val), ntohl(ts_ecr)); 904 1.2.2.4 pgoyette op += optlen; 905 1.2.2.4 pgoyette len -= optlen; 906 1.2.2.4 pgoyette continue; 907 1.2.2.4 pgoyette } else { 908 1.2.2.4 pgoyette (*pr)("TCP: OPTION: unknown (%d, len = %d)\n", 909 1.2.2.4 pgoyette opt, optlen); 910 1.2.2.4 pgoyette op += optlen; 911 1.2.2.4 pgoyette len -= optlen; 912 1.2.2.4 pgoyette continue; 913 1.2.2.4 pgoyette } 914 1.2.2.4 pgoyette } 915 1.2.2.4 pgoyette free(bufp, M_TEMP); 916 1.2.2.4 pgoyette } 917 1.2.2.4 pgoyette 918 1.2.2.4 pgoyette if (off < pktlen) 919 1.2.2.4 pgoyette m_examine_hex(m, off, modif, pr); 920 1.2.2.4 pgoyette 921 1.2.2.4 pgoyette return; 922 1.2.2.2 pgoyette } 923 1.2.2.2 pgoyette 924 1.2.2.4 pgoyette void 925 1.2.2.2 pgoyette m_examine_udp(const struct mbuf *m, int off, const char *modif, 926 1.2.2.2 pgoyette void (*pr)(const char *, ...)) 927 1.2.2.2 pgoyette { 928 1.2.2.2 pgoyette unsigned int pktlen; 929 1.2.2.2 pgoyette struct udphdr udp; 930 1.2.2.2 pgoyette 931 1.2.2.2 pgoyette pktlen = m_peek_len(m, modif) - off; 932 1.2.2.2 pgoyette if (pktlen < sizeof(udp)) { 933 1.2.2.4 pgoyette (*pr)("%s: too short mbuf chain (%u < %u)\n", __func__, 934 1.2.2.4 pgoyette pktlen, sizeof(udp)); 935 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 936 1.2.2.2 pgoyette } 937 1.2.2.2 pgoyette 938 1.2.2.2 pgoyette if (m_peek_data(m, off, sizeof(udp), (void *)(&udp)) < 0) { 939 1.2.2.2 pgoyette (*pr)("%s: cannot read header\n", __func__); 940 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 941 1.2.2.2 pgoyette } 942 1.2.2.2 pgoyette off += sizeof(udp); 943 1.2.2.2 pgoyette 944 1.2.2.2 pgoyette (*pr)("UDP: Src = %u\n", ntohs(udp.uh_sport)); 945 1.2.2.2 pgoyette (*pr)("UDP: Dst = %u\n", ntohs(udp.uh_dport)); 946 1.2.2.2 pgoyette (*pr)("UDP: Length = %u\n", ntohs(udp.uh_ulen)); 947 1.2.2.2 pgoyette 948 1.2.2.2 pgoyette return m_examine_hex(m, off, modif, pr); 949 1.2.2.2 pgoyette } 950 1.2.2.2 pgoyette 951 1.2.2.4 pgoyette void 952 1.2.2.2 pgoyette m_examine_hex(const struct mbuf *m, int off, const char *modif, 953 1.2.2.2 pgoyette void (*pr)(const char *, ...)) 954 1.2.2.2 pgoyette { 955 1.2.2.2 pgoyette unsigned int pktlen; 956 1.2.2.2 pgoyette int newline = 0; 957 1.2.2.2 pgoyette uint8_t v; 958 1.2.2.2 pgoyette 959 1.2.2.2 pgoyette pktlen = m_peek_len(m, modif) - off; 960 1.2.2.2 pgoyette if (pktlen > EXAMINE_HEX_LIMIT) 961 1.2.2.2 pgoyette pktlen = EXAMINE_HEX_LIMIT; 962 1.2.2.2 pgoyette 963 1.2.2.2 pgoyette if (pktlen == 0) 964 1.2.2.2 pgoyette return; 965 1.2.2.2 pgoyette 966 1.2.2.2 pgoyette (*pr)("offset %04d: ", off); 967 1.2.2.2 pgoyette while (pktlen > 0) { 968 1.2.2.2 pgoyette if (m_peek_data(m, off, sizeof(v), (void *)(&v)) < 0) 969 1.2.2.2 pgoyette break; 970 1.2.2.2 pgoyette pktlen --; 971 1.2.2.2 pgoyette off++; 972 1.2.2.2 pgoyette newline++; 973 1.2.2.2 pgoyette 974 1.2.2.2 pgoyette (*pr)("%02x", v); 975 1.2.2.2 pgoyette if (pktlen == 0) 976 1.2.2.2 pgoyette break; 977 1.2.2.2 pgoyette 978 1.2.2.2 pgoyette if ((newline % EXAMINE_HEX_COL) == 0) { 979 1.2.2.2 pgoyette (*pr)("\n"); 980 1.2.2.2 pgoyette (*pr)("offset %04d: ", off); 981 1.2.2.4 pgoyette } else 982 1.2.2.2 pgoyette (*pr)(" "); 983 1.2.2.2 pgoyette } 984 1.2.2.2 pgoyette (*pr)("\n"); 985 1.2.2.2 pgoyette } 986 1.2.2.2 pgoyette 987 1.2.2.2 pgoyette void 988 1.2.2.2 pgoyette m_examine(const struct mbuf *m, int af, const char *modif, 989 1.2.2.2 pgoyette void (*pr)(const char *, ...)) 990 1.2.2.2 pgoyette { 991 1.2.2.2 pgoyette if (m == NULL) 992 1.2.2.2 pgoyette return; 993 1.2.2.2 pgoyette 994 1.2.2.2 pgoyette if (pr == NULL) 995 1.2.2.2 pgoyette return; 996 1.2.2.2 pgoyette 997 1.2.2.2 pgoyette switch (af) { 998 1.2.2.2 pgoyette case AF_UNSPEC: 999 1.2.2.2 pgoyette return m_examine_hex(m, 0, modif, pr); 1000 1.2.2.2 pgoyette break; 1001 1.2.2.2 pgoyette case AF_ETHER: 1002 1.2.2.2 pgoyette return m_examine_ether(m, 0, modif, pr); 1003 1.2.2.2 pgoyette break; 1004 1.2.2.2 pgoyette case AF_ARP: 1005 1.2.2.2 pgoyette return m_examine_arp(m, 0, modif, pr); 1006 1.2.2.2 pgoyette break; 1007 1.2.2.2 pgoyette case AF_INET: 1008 1.2.2.2 pgoyette return m_examine_ip(m, 0, modif, pr); 1009 1.2.2.2 pgoyette break; 1010 1.2.2.2 pgoyette case AF_INET6: 1011 1.2.2.2 pgoyette return m_examine_ip6(m, 0, modif, pr); 1012 1.2.2.2 pgoyette break; 1013 1.2.2.2 pgoyette default: 1014 1.2.2.2 pgoyette (*pr)("No parser for AF %d\n", af); 1015 1.2.2.2 pgoyette return m_examine_hex(m, 0, modif, pr); 1016 1.2.2.2 pgoyette break; 1017 1.2.2.2 pgoyette } 1018 1.2.2.2 pgoyette 1019 1.2.2.2 pgoyette /* not reached */ 1020 1.2.2.2 pgoyette return; 1021 1.2.2.2 pgoyette } 1022
Indexes created Mon Sep 29 21:09:56 GMT 2025