summaryrefslogtreecommitdiff
path: root/usr.sbin/tcpdump
AgeCommit message (Collapse)Author
2021-09-16tcpdump: Fix data alignment issue in WireGuard printerVisa Hankala
Access 8-byte nonce as unaligned data to avoid a crash on strict alignment architectures. With IP and UDP, payload alignment is guaranteed to 4-byte boundary only. Reported and tested by Peter J. Philipp OK deraadt@
2021-09-16Add EXTRACT_LE_64BITS().Visa Hankala
OK deraadt@
2021-09-07synchronize tcpdump.8 and pcap-filter.5 primitives documentationDenis Fondras
reads ok to jmc@ good enough start for deraadt@
2021-07-12Change the error reporting pattern throughout the tree when unveilBob Beck
fails to report the path that the failure occured on. Suggested by deraadt@ after some tech discussion. Work done and verified by Ashton Fagg <ashton@fagg.id.au> ok deraadt@ semarie@ claudio@
2021-06-28Have tcpdump split the 802.11 sequence number field into its sequence numberStefan Sperling
and fragment number components instead of printing the whole field in decimal. ok sthen@ kn@ jca@
2021-06-17Add simple BGP Enhanced Route Refresh Message decodingjob
seems OK claudio@
2021-04-14On powerpc64 tcpdump(8) could not parse wireguard packets.Alexander Bluhm
EXTRACT_LE_32BITS() converts the type from little endian to host endian. So we need the constants in host endianess. This fixes regress/sys/net/wg. OK deraadt@ sthen@
2021-03-02off by one in bounds testJonathan Gray
ok sthen@ millert@
2021-01-20Print rewritten addresses in tcpdump(8) logged with pflog(4) forAlexander Bluhm
rdr-to, nat-to, af-to rules. The kernel uses the information from the packet description and fills it into the fields in the pflog header. While doing this, it is trival to figure out whether the packet has been rewritten. OK sashan@
2020-12-04Don't link tcpdump(8) with libl and remove reference to `yydebug'.mvs
From Martin Vahlensieck.
2020-12-03Kill unused `ch' variable within safeputs routine. Also use putchar(3)mvs
instead of printf(3) to output printable characters. Pointed by Martin Vahlensieck. ok gnezdo@
2020-11-05Send print-skip.c to the atticTheo Buehler
This was unhooked from the build in a code sync in 1996 and didn't make it into the upstream revision history. Prompted by a diff from Neeraj Pal that showed that this file wasn't compiled. ok jca kn
2020-10-26Fix parsing GTP packets with invalid extended headers.Jeremie Courreges-Anglas
In GTP a zero extended header length is invalid, deal with this instead of looping forever. Report and fix by Peter J. Philipp, tweaked by me, ok kn@
2020-08-17add geneve option printing.David Gwynne
mostly modelled on the nsh md2 printing.
2020-08-17don't need to shift the vxlan vni twice.David Gwynne
2020-08-17add initial support for handling geneve packets.David Gwynne
it's like vxlan, but different. the most interesting difference to vxlan is that the protocol adds support for adding optional metadata to packets (like nsh). this diff currently just skips that stuff and just handles the payload. for now.
2020-07-21Avoid integer underflow due to tiny snaplenkn
For DLT_NULL and DLT_LOOP interfaces, print-null.c passes `caplen - NULL_HDRLEN' as length to default_print() which takes an unsigned integer, hence if caplen is smaller than the header itself (four octets), this difference wraps around. Exit early in such cases and print the expected truncation marker "[|null]" instead. Feedback OK dlg
2020-07-20Remove unused variable "caplen"kn
No object change.
2020-06-21Add RCS markerTheo Buehler
2020-06-21wire the wireguard packet printer into tcpdump.David Gwynne
from Matt Dunwoodie and Jason A. Donenfeld
2020-06-21don't claim packets as wg if there's not enough captured bytes to read.David Gwynne
2020-06-21cope with a truncated capture of a packet. this avoids reading invalid mem.David Gwynne
2020-06-21add a printer for wireguard messages, but not hooked up just yet.David Gwynne
from Matt Dunwoodie and Jason A. Donenfeld
2020-05-20properly pass the number of strings in an array to gtp_print_str.David Gwynne
from miod
2020-04-15add support for printing RfC 2332 NBMA Next Hop Resolution Protocol (NHRP)remi
ok dlg@
2020-03-23Spell "status" correctly.Patrick Wildt
ok jasper@ mpi@
2020-02-24extend decoding of control transfers:Jasper Lievisse Adriaanse
- print the stage name - print additional information about the request for Setup packets - GET_DESCRIPTOR requests are further decoded tweaks and ok mpi@
2020-02-22fix a crash when printing the contents of a malformed packet where the packetJasper Lievisse Adriaanse
length was smaller than the sizeof the usbpcap header. we'd end up passing a negative value as the length to default_print(). found with afl-fuzz ok mpi@
2020-02-12- print 'dlen=' to make it more clear what that number indicatesJasper Lievisse Adriaanse
- add missing rcs id - use 'goto trunc' as is common with other printers ok mpi@
2020-01-24- (void)printf() -> printf(); the cast adds clutter for little value.Richard Procter
- fprintf(stdout, ...) -> printf() - fputs(x, stdout) -> printf(); for consistency. fputs is twice as fast on atom x5-Z8300@1.44GHz but Amdahl sees a pure printf tcpdump only 2% slower than a pure fputs (for constant strings) tcpdump to /dev/null across a 20MB/~170k packet pcap file. ok dlg@ for fputs and ok tedu@ krw@ deraadt@ a2k19 for the rest
2019-12-03add support for printing RFC 8300 Network Service Header (NSH)David Gwynne
ok deraadt@
2019-12-02add support for VXLAN-GPE as per draft-ietf-nvo3-vxlan-gpe-08.David Gwynne
it's nicely backwards compatible, so we can use the same code for both vxlan and vxlan-gpe.
2019-12-02the dhcp6 printing doesn't need these files anymore.David Gwynne
they were based on draft-ietf-dhc-dhcpv6-14, which was not what ended up in the dhcpv6 rfc(s). the current printing code is a lot smaller and self contained. ok deraadt@
2019-12-02rewrite dhcpv6 parsing so it follows the rfc, not an incompat draft.David Gwynne
it looks like this code was using draft-ietf-dhc-dhcpv6-14 from 1999. there were 27 drafts, and by the time it got to draft 23 and the rfc it was significantly different. this code for draft 14 cannot handle actual dhcpv6 messages. im kind of surprised (disappointed?) that noone noticed before. i only noticed cos the code was segfaulting on sparc64, and when i tried to fix it the resulting messages looked nothing like what stock tcpdump produced. the main difference between the early drafts and what ended up in the rfc is that the base dhcpv6 messages in early drafts were large structure with a lot of fixed fields, while the rfc settled on a 4 byte header that contains a 1 byte message type and a 3 byte transaction id. the rest of the messages are built from dhcp options fields. this cuts all the old handling out, and fixes the fault in the options handling by using EXTRACT_16BITS to get at the code and length fields instead of using ntohs. dhcpv6 explicitly states that it does not align options, so this is necessary to avoid faults on strict alignment archs anyway. no options are pretty printed at the moment, you just get a numeric type, a length, and a hexdump of the value. this is still better than the garbage that the draft parsing produced. if someone is interested in making this easier to read, it would be a straightforward and well contained project to better handle option printing. ok deraadt@
2019-11-27OpenFlow 1.3 defines packet header patterns of interest using TLVs (OXMs)akoshibe
that represent various header fields. One place where OXMs are used is in the sef_field action, which contains one OXM representing the header field to set, followed by padding to align the action in the OpenFlow message to 64 bits. Currently, we assume that a set_field action can contain multiple OXMs and that they do not need to be padded. This matches the way we handle OpenFlow messages that contain set_field actions so that we follow the specs. OK ori claudio
2019-11-06mention in tcpdump(8) description of -i that one can use either a networkStuart Henderson
or a USB device. ok mpi
2019-10-31fix inconsistency; from tim kuijstenJason McIntyre
agreed by deraadt
2019-09-25pcap-filter now section 5: adjust XrJason McIntyre
2019-09-19print the IPs on ESP packets.David Gwynne
this was lost when tcpdump learnt to look inside udpencap. found by, and ok markus@
2019-09-11CDP's Native-VLAN-ID does not need a substraction.Martijn van Duren
While here add a link to the documentation. OK sthen@
2019-09-03pcap-filter is now section 7;Jason McIntyre
2019-08-30one more ethers.3 -> ether_aton.3;Jason McIntyre
2019-08-30catch up to ethers(3)->ether_aton(3) renamingTheo de Raadt
2019-08-30mop up for the pcap.3 rename;Jason McIntyre
help/ok deraadt
2019-07-03snprintf/vsnprintf return < 0 on error, rather than -1.Theo de Raadt
2019-06-28When system calls indicate an error they return -1, not some arbitraryTheo de Raadt
value < 0. errno is only updated in this case. Change all (most?) callers of syscalls to follow this better, and let's see if this strictness helps us in the future.
2019-05-26support -T erspan so arbitrary gre protocols can be seen as erspanDavid Gwynne
this lets me configure a custom gre protocol on a dell s4810 or s5048 and see what's inside it when it lands on an openbsd box. ok lteo@
2019-05-17handle ERSPAN type IDavid Gwynne
type I and II share their GRE protocol, but you tell them apart by checking if a sequence number is used. type I does not use a sequence number and contains a bare ethernet frame. type II contains a sequence number and a shim header that is already handled by the code. tested with a Dell S5048F-ON and an encapsulated remote port mirror setup.
2019-05-11Support extended shutdown communications in tcpdump as well.Claudio Jeker
OK sthen@ deraadt@
2019-04-14md5 auth has useful information on the wire that helps when fixing issuesDavid Gwynne
print at least the key-id, and seq when -v is set, and the offset and len when -vv is set. ok sthen@ bluhm@
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-04 01:35:40 +0000