tcp: display calculated checksum

While debugging a network issue, I found incorrect TCP checksums. These
are shown in the packet details, but are not available as column. This
patch adds the "tcp.checksum_calculated" field which is only available
if a checksum can be calculated (i.e., checksumming is enabled and the
full segment is available).

The fields are added separately for each checksum case to make it appear
before "Checksum Bad/Good" and to avoid calculating the expected field
value for the "good" cases.

Change-Id: I36af7894d526382ef636c5fa51e74871212b2909
Reviewed-on: https://code.wireshark.org/review/1627
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>

diff --git a/epan/dissectors/packet-tcp.c b/epan/dissectors/packet-tcp.c
index cafce5f2ad3fd4e86de24a5babd7d3ff72c59262..df55ff5adbdd61579efb246bc8edfce4406d9a49 100644 (file)
--- a/epan/dissectors/packet-tcp.c
+++ b/epan/dissectors/packet-tcp.c
@@ -118,6 +118,7 @@ static int hf_tcp_window_size_scalefactor = -1;
 static int hf_tcp_checksum = -1;
 static int hf_tcp_checksum_bad = -1;
 static int hf_tcp_checksum_good = -1;
+static int hf_tcp_checksum_calculated = -1;
 static int hf_tcp_len = -1;
 static int hf_tcp_urgent_pointer = -1;
 static int hf_tcp_analysis = -1;
@@ -4120,6 +4121,7 @@ dissect_tcp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
     vec_t      cksum_vec[4];
     guint32    phdr[2];
     guint16    computed_cksum;
+    guint16    expected_cksum;
     guint16    real_window;
     guint      captured_length_remaining;
     gboolean   desegment_ok;
@@ -4521,6 +4523,9 @@ dissect_tcp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
                                                   "0x%04x [should be 0x0000 (see RFC 1624)]", th_sum);
 
                 checksum_tree = proto_item_add_subtree(item, ett_tcp_checksum);
+                item = proto_tree_add_uint(checksum_tree, hf_tcp_checksum_calculated, tvb,
+                                              offset + 16, 2, 0x0000);
+                PROTO_ITEM_SET_GENERATED(item);
                 item = proto_tree_add_boolean(checksum_tree, hf_tcp_checksum_good, tvb,
                                               offset + 16, 2, FALSE);
                 PROTO_ITEM_SET_GENERATED(item);
@@ -4538,6 +4543,9 @@ dissect_tcp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
                                                   offset + 16, 2, th_sum, "0x%04x [correct]", th_sum);
 
                 checksum_tree = proto_item_add_subtree(item, ett_tcp_checksum);
+                item = proto_tree_add_uint(checksum_tree, hf_tcp_checksum_calculated, tvb,
+                                              offset + 16, 2, th_sum);
+                PROTO_ITEM_SET_GENERATED(item);
                 item = proto_tree_add_boolean(checksum_tree, hf_tcp_checksum_good, tvb,
                                               offset + 16, 2, TRUE);
                 PROTO_ITEM_SET_GENERATED(item);
@@ -4548,12 +4556,17 @@ dissect_tcp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
                 /* Checksum is valid, so we're willing to desegment it. */
                 desegment_ok = TRUE;
             } else {
+                expected_cksum = in_cksum_shouldbe(th_sum, computed_cksum);
+
                 item = proto_tree_add_uint_format_value(tcp_tree, hf_tcp_checksum, tvb,
                                                   offset + 16, 2, th_sum,
                                                   "0x%04x [incorrect, should be 0x%04x (maybe caused by \"TCP checksum offload\"?)]", th_sum,
-                                                  in_cksum_shouldbe(th_sum, computed_cksum));
+                                                  expected_cksum);
 
                 checksum_tree = proto_item_add_subtree(item, ett_tcp_checksum);
+                item = proto_tree_add_uint(checksum_tree, hf_tcp_checksum_calculated, tvb,
+                                              offset + 16, 2, expected_cksum);
+                PROTO_ITEM_SET_GENERATED(item);
                 item = proto_tree_add_boolean(checksum_tree, hf_tcp_checksum_good, tvb,
                                               offset + 16, 2, FALSE);
                 PROTO_ITEM_SET_GENERATED(item);
@@ -4966,6 +4979,10 @@ proto_register_tcp(void)
         { "Bad Checksum",       "tcp.checksum_bad", FT_BOOLEAN, BASE_NONE, NULL, 0x0,
             "True: checksum doesn't match packet content; False: matches content or not checked", HFILL }},
 
+        { &hf_tcp_checksum_calculated,
+        { "Calculated Checksum", "tcp.checksum_calculated", FT_UINT16, BASE_HEX, NULL, 0x0,
+            "The expected TCP checksum field as calculated from the TCP segment", HFILL }},
+
         { &hf_tcp_analysis,
         { "SEQ/ACK analysis",   "tcp.analysis", FT_NONE, BASE_NONE, NULL, 0x0,
             "This frame has some of the TCP analysis shown", HFILL }},