2 * Copyright (c) 1990, 1991, 1993, 1994, 1995, 1996, 1997
3 * The Regents of the University of California. All rights reserved.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
23 * txtproto_print() derived from original code by Hannes Gredler
24 * (hannes@juniper.net):
26 * Redistribution and use in source and binary forms, with or without
27 * modification, are permitted provided that: (1) source code
28 * distributions retain the above copyright notice and this paragraph
29 * in its entirety, and (2) distributions including binary code include
30 * the above copyright notice and this paragraph in its entirety in
31 * the documentation or other materials provided with the distribution.
32 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND
33 * WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, WITHOUT
34 * LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
35 * FOR A PARTICULAR PURPOSE.
42 #include <netdissect-stdinc.h>
55 #include "netdissect.h"
56 #include "ascii_strcasecmp.h"
57 #include "timeval-operations.h"
59 int32_t thiszone
; /* seconds offset from gmt to local time */
62 * timestamp display buffer size, the biggest size of both formats is needed
63 * sizeof("0000000000.000000000") > sizeof("00:00:00.000000000")
65 #define TS_BUF_SIZE sizeof("0000000000.000000000")
67 #define TOKBUFSIZE 128
70 * Print out a null-terminated filename (or other ascii string).
71 * If ep is NULL, assume no truncation check is needed.
72 * Return true if truncated.
73 * Stop at ep (if given) or before the null char, whichever is first.
76 fn_print(netdissect_options
*ndo
,
77 register const u_char
*s
, register const u_char
*ep
)
82 ret
= 1; /* assume truncated */
83 while (ep
== NULL
|| s
< ep
) {
91 ND_PRINT((ndo
, "M-"));
94 c
^= 0x40; /* DEL to ?, others to alpha */
97 ND_PRINT((ndo
, "%c", c
));
103 * Print out a counted filename (or other ascii string).
104 * If ep is NULL, assume no truncation check is needed.
105 * Return true if truncated.
106 * Stop at ep (if given) or after n bytes, whichever is first.
109 fn_printn(netdissect_options
*ndo
,
110 register const u_char
*s
, register u_int n
, register const u_char
*ep
)
114 while (n
> 0 && (ep
== NULL
|| s
< ep
)) {
117 if (!ND_ISASCII(c
)) {
119 ND_PRINT((ndo
, "M-"));
121 if (!ND_ISPRINT(c
)) {
122 c
^= 0x40; /* DEL to ?, others to alpha */
123 ND_PRINT((ndo
, "^"));
125 ND_PRINT((ndo
, "%c", c
));
127 return (n
== 0) ? 0 : 1;
131 * Print out a null-padded filename (or other ascii string).
132 * If ep is NULL, assume no truncation check is needed.
133 * Return true if truncated.
134 * Stop at ep (if given) or after n bytes or before the null char,
135 * whichever is first.
138 fn_printzp(netdissect_options
*ndo
,
139 register const u_char
*s
, register u_int n
,
140 register const u_char
*ep
)
145 ret
= 1; /* assume truncated */
146 while (n
> 0 && (ep
== NULL
|| s
< ep
)) {
153 if (!ND_ISASCII(c
)) {
155 ND_PRINT((ndo
, "M-"));
157 if (!ND_ISPRINT(c
)) {
158 c
^= 0x40; /* DEL to ?, others to alpha */
159 ND_PRINT((ndo
, "^"));
161 ND_PRINT((ndo
, "%c", c
));
163 return (n
== 0) ? 0 : ret
;
167 * Format the timestamp
170 ts_format(netdissect_options
*ndo
171 #ifndef HAVE_PCAP_SET_TSTAMP_PRECISION
174 , int sec
, int usec
, char *buf
)
178 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
179 switch (ndo
->ndo_tstamp_precision
) {
181 case PCAP_TSTAMP_PRECISION_MICRO
:
182 format
= "%02d:%02d:%02d.%06u";
185 case PCAP_TSTAMP_PRECISION_NANO
:
186 format
= "%02d:%02d:%02d.%09u";
190 format
= "%02d:%02d:%02d.{unknown}";
194 format
= "%02d:%02d:%02d.%06u";
197 snprintf(buf
, TS_BUF_SIZE
, format
,
198 sec
/ 3600, (sec
% 3600) / 60, sec
% 60, usec
);
204 * Format the timestamp - Unix timeval style
207 ts_unix_format(netdissect_options
*ndo
208 #ifndef HAVE_PCAP_SET_TSTAMP_PRECISION
211 , int sec
, int usec
, char *buf
)
215 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
216 switch (ndo
->ndo_tstamp_precision
) {
218 case PCAP_TSTAMP_PRECISION_MICRO
:
222 case PCAP_TSTAMP_PRECISION_NANO
:
227 format
= "%u.{unknown}";
234 snprintf(buf
, TS_BUF_SIZE
, format
,
235 (unsigned)sec
, (unsigned)usec
);
241 * Print the timestamp
244 ts_print(netdissect_options
*ndo
,
245 register const struct timeval
*tvp
)
250 char buf
[TS_BUF_SIZE
];
251 static struct timeval tv_ref
;
252 struct timeval tv_result
;
256 switch (ndo
->ndo_tflag
) {
258 case 0: /* Default */
259 s
= (tvp
->tv_sec
+ thiszone
) % 86400;
260 ND_PRINT((ndo
, "%s ", ts_format(ndo
, s
, tvp
->tv_usec
, buf
)));
263 case 1: /* No time stamp */
266 case 2: /* Unix timeval style */
267 ND_PRINT((ndo
, "%s ", ts_unix_format(ndo
,
268 tvp
->tv_sec
, tvp
->tv_usec
, buf
)));
271 case 3: /* Microseconds/nanoseconds since previous packet */
272 case 5: /* Microseconds/nanoseconds since first packet */
273 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
274 switch (ndo
->ndo_tstamp_precision
) {
275 case PCAP_TSTAMP_PRECISION_MICRO
:
278 case PCAP_TSTAMP_PRECISION_NANO
:
288 if (!(netdissect_timevalisset(&tv_ref
)))
289 tv_ref
= *tvp
; /* set timestamp for first packet */
291 negative_offset
= netdissect_timevalcmp(tvp
, &tv_ref
, <);
293 netdissect_timevalsub(&tv_ref
, tvp
, &tv_result
, nano_prec
);
295 netdissect_timevalsub(tvp
, &tv_ref
, &tv_result
, nano_prec
);
297 ND_PRINT((ndo
, (negative_offset
? "-" : " ")));
299 ND_PRINT((ndo
, "%s ", ts_format(ndo
,
300 tv_result
.tv_sec
, tv_result
.tv_usec
, buf
)));
302 if (ndo
->ndo_tflag
== 3)
303 tv_ref
= *tvp
; /* set timestamp for previous packet */
306 case 4: /* Default + Date */
307 s
= (tvp
->tv_sec
+ thiszone
) % 86400;
308 Time
= (tvp
->tv_sec
+ thiszone
) - s
;
311 ND_PRINT((ndo
, "Date fail "));
313 ND_PRINT((ndo
, "%04d-%02d-%02d %s ",
314 tm
->tm_year
+1900, tm
->tm_mon
+1, tm
->tm_mday
,
315 ts_format(ndo
, s
, tvp
->tv_usec
, buf
)));
321 * Print a relative number of seconds (e.g. hold time, prune timer)
322 * in the form 5m1s. This does no truncation, so 32230861 seconds
323 * is represented as 1y1w1d1h1m1s.
326 relts_print(netdissect_options
*ndo
,
329 static const char *lengths
[] = {"y", "w", "d", "h", "m", "s"};
330 static const int seconds
[] = {31536000, 604800, 86400, 3600, 60, 1};
331 const char **l
= lengths
;
332 const int *s
= seconds
;
335 ND_PRINT((ndo
, "0s"));
339 ND_PRINT((ndo
, "-"));
344 ND_PRINT((ndo
, "%d%s", secs
/ *s
, *l
));
345 secs
-= (secs
/ *s
) * *s
;
353 * this is a generic routine for printing unknown data;
354 * we pass on the linefeed plus indentation string to
355 * get a proper output - returns 0 on error
359 print_unknown_data(netdissect_options
*ndo
, const u_char
*cp
,const char *ident
,int len
)
362 ND_PRINT((ndo
,"%sDissector error: print_unknown_data called with negative length",
366 if (ndo
->ndo_snapend
- cp
< len
)
367 len
= ndo
->ndo_snapend
- cp
;
369 ND_PRINT((ndo
,"%sDissector error: print_unknown_data called with pointer past end of packet",
373 hex_print(ndo
, ident
,cp
,len
);
374 return(1); /* everything is ok */
378 * Convert a token value to a string; use "fmt" if not found.
381 tok2strbuf(register const struct tok
*lp
, register const char *fmt
,
382 register u_int v
, char *buf
, size_t bufsize
)
385 while (lp
->s
!= NULL
) {
394 (void)snprintf(buf
, bufsize
, fmt
, v
);
395 return (const char *)buf
;
399 * Convert a token value to a string; use "fmt" if not found.
402 tok2str(register const struct tok
*lp
, register const char *fmt
,
405 static char buf
[4][TOKBUFSIZE
];
411 return tok2strbuf(lp
, fmt
, v
, ret
, sizeof(buf
[0]));
415 * Convert a bit token value to a string; use "fmt" if not found.
416 * this is useful for parsing bitfields, the output strings are seperated
417 * if the s field is positive.
420 bittok2str_internal(register const struct tok
*lp
, register const char *fmt
,
421 register u_int v
, const char *sep
)
423 static char buf
[256]; /* our stringbuffer */
425 register u_int rotbit
; /* this is the bit we rotate through all bitpositions */
426 register u_int tokval
;
427 const char * sepstr
= "";
429 while (lp
!= NULL
&& lp
->s
!= NULL
) {
430 tokval
=lp
->v
; /* load our first value */
432 while (rotbit
!= 0) {
434 * lets AND the rotating bit with our token value
435 * and see if we have got a match
437 if (tokval
== (v
&rotbit
)) {
438 /* ok we have found something */
439 buflen
+=snprintf(buf
+buflen
, sizeof(buf
)-buflen
, "%s%s",
444 rotbit
=rotbit
<<1; /* no match - lets shift and try again */
450 /* bummer - lets print the "unknown" message as advised in the fmt string if we got one */
451 (void)snprintf(buf
, sizeof(buf
), fmt
== NULL
? "#%08x" : fmt
, v
);
456 * Convert a bit token value to a string; use "fmt" if not found.
457 * this is useful for parsing bitfields, the output strings are not seperated.
460 bittok2str_nosep(register const struct tok
*lp
, register const char *fmt
,
463 return (bittok2str_internal(lp
, fmt
, v
, ""));
467 * Convert a bit token value to a string; use "fmt" if not found.
468 * this is useful for parsing bitfields, the output strings are comma seperated.
471 bittok2str(register const struct tok
*lp
, register const char *fmt
,
474 return (bittok2str_internal(lp
, fmt
, v
, ", "));
478 * Convert a value to a string using an array; the macro
479 * tok2strary() in <netdissect.h> is the public interface to
480 * this function and ensures that the second argument is
481 * correct for bounds-checking.
484 tok2strary_internal(register const char **lp
, int n
, register const char *fmt
,
487 static char buf
[TOKBUFSIZE
];
489 if (v
>= 0 && v
< n
&& lp
[v
] != NULL
)
493 (void)snprintf(buf
, sizeof(buf
), fmt
, v
);
498 * Convert a 32-bit netmask to prefixlen if possible
499 * the function returns the prefix-len; if plen == -1
500 * then conversion was not possible;
504 mask2plen(uint32_t mask
)
506 uint32_t bitmasks
[33] = {
508 0x80000000, 0xc0000000, 0xe0000000, 0xf0000000,
509 0xf8000000, 0xfc000000, 0xfe000000, 0xff000000,
510 0xff800000, 0xffc00000, 0xffe00000, 0xfff00000,
511 0xfff80000, 0xfffc0000, 0xfffe0000, 0xffff0000,
512 0xffff8000, 0xffffc000, 0xffffe000, 0xfffff000,
513 0xfffff800, 0xfffffc00, 0xfffffe00, 0xffffff00,
514 0xffffff80, 0xffffffc0, 0xffffffe0, 0xfffffff0,
515 0xfffffff8, 0xfffffffc, 0xfffffffe, 0xffffffff
519 /* let's see if we can transform the mask into a prefixlen */
520 while (prefix_len
>= 0) {
521 if (bitmasks
[prefix_len
] == mask
)
529 mask62plen(const u_char
*mask
)
531 u_char bitmasks
[9] = {
533 0x80, 0xc0, 0xe0, 0xf0,
534 0xf8, 0xfc, 0xfe, 0xff
539 for (byte
= 0; byte
< 16; byte
++) {
542 for (bits
= 0; bits
< (sizeof (bitmasks
) / sizeof (bitmasks
[0])); bits
++) {
543 if (mask
[byte
] == bitmasks
[bits
]) {
549 if (mask
[byte
] != 0xff)
556 * Routine to print out information for text-based protocols such as FTP,
557 * HTTP, SMTP, RTSP, SIP, ....
559 #define MAX_TOKEN 128
562 * Fetch a token from a packet, starting at the specified index,
563 * and return the length of the token.
565 * Returns 0 on error; yes, this is indistinguishable from an empty
566 * token, but an "empty token" isn't a valid token - it just means
567 * either a space character at the beginning of the line (this
568 * includes a blank line) or no more tokens remaining on the line.
571 fetch_token(netdissect_options
*ndo
, const u_char
*pptr
, u_int idx
, u_int len
,
572 u_char
*tbuf
, size_t tbuflen
)
576 for (; idx
< len
; idx
++) {
577 if (!ND_TTEST(*(pptr
+ idx
))) {
578 /* ran past end of captured data */
581 if (!isascii(*(pptr
+ idx
))) {
582 /* not an ASCII character */
585 if (isspace(*(pptr
+ idx
))) {
589 if (!isprint(*(pptr
+ idx
))) {
590 /* not part of a command token or response code */
593 if (toklen
+ 2 > tbuflen
) {
594 /* no room for this character and terminating '\0' */
597 tbuf
[toklen
] = *(pptr
+ idx
);
607 * Skip past any white space after the token, until we see
608 * an end-of-line (CR or LF).
610 for (; idx
< len
; idx
++) {
611 if (!ND_TTEST(*(pptr
+ idx
))) {
612 /* ran past end of captured data */
615 if (*(pptr
+ idx
) == '\r' || *(pptr
+ idx
) == '\n') {
619 if (!isascii(*(pptr
+ idx
)) || !isprint(*(pptr
+ idx
))) {
620 /* not a printable ASCII character */
623 if (!isspace(*(pptr
+ idx
))) {
624 /* beginning of next token */
632 * Scan a buffer looking for a line ending - LF or CR-LF.
633 * Return the index of the character after the line ending or 0 if
634 * we encounter a non-ASCII or non-printable character or don't find
638 print_txt_line(netdissect_options
*ndo
, const char *protoname
,
639 const char *prefix
, const u_char
*pptr
, u_int idx
, u_int len
)
646 ND_TCHECK(*(pptr
+idx
));
647 if (*(pptr
+idx
) == '\n') {
649 * LF without CR; end of line.
650 * Skip the LF and print the line, with the
651 * exception of the LF.
653 linelen
= idx
- startidx
;
656 } else if (*(pptr
+idx
) == '\r') {
658 if ((idx
+1) >= len
) {
659 /* not in this packet */
662 ND_TCHECK(*(pptr
+idx
+1));
663 if (*(pptr
+idx
+1) == '\n') {
665 * CR-LF; end of line.
666 * Skip the CR-LF and print the line, with
667 * the exception of the CR-LF.
669 linelen
= idx
- startidx
;
675 * CR followed by something else; treat this
676 * as if it were binary data, and don't print
680 } else if (!isascii(*(pptr
+idx
)) ||
681 (!isprint(*(pptr
+idx
)) && *(pptr
+idx
) != '\t')) {
683 * Not a printable ASCII character and not a tab;
684 * treat this as if it were binary data, and
693 * All printable ASCII, but no line ending after that point
694 * in the buffer; treat this as if it were truncated.
697 linelen
= idx
- startidx
;
698 ND_PRINT((ndo
, "%s%.*s[!%s]", prefix
, (int)linelen
, pptr
+ startidx
,
703 ND_PRINT((ndo
, "%s%.*s", prefix
, (int)linelen
, pptr
+ startidx
));
708 txtproto_print(netdissect_options
*ndo
, const u_char
*pptr
, u_int len
,
709 const char *protoname
, const char **cmds
, u_int flags
)
712 u_char token
[MAX_TOKEN
+1];
719 * This protocol has more than just request and
720 * response lines; see whether this looks like a
721 * request or response.
723 idx
= fetch_token(ndo
, pptr
, 0, len
, token
, sizeof(token
));
725 /* Is this a valid request name? */
726 while ((cmd
= *cmds
++) != NULL
) {
727 if (ascii_strcasecmp((const char *)token
, cmd
) == 0) {
735 * No - is this a valid response code (3 digits)?
737 * Is this token the response code, or is the next
738 * token the response code?
740 if (flags
& RESP_CODE_SECOND_TOKEN
) {
742 * Next token - get it.
744 idx
= fetch_token(ndo
, pptr
, idx
, len
, token
,
748 if (isdigit(token
[0]) && isdigit(token
[1]) &&
749 isdigit(token
[2]) && token
[3] == '\0') {
757 * This protocol has only request and response lines
758 * (e.g., FTP, where all the data goes over a
759 * different connection); assume the payload is
760 * a request or response.
765 /* Capitalize the protocol name */
766 for (pnp
= protoname
; *pnp
!= '\0'; pnp
++)
767 ND_PRINT((ndo
, "%c", toupper(*pnp
)));
771 * In non-verbose mode, just print the protocol, followed
772 * by the first line as the request or response info.
774 * In verbose mode, print lines as text until we run out
775 * of characters or see something that's not a
776 * printable-ASCII line.
778 if (ndo
->ndo_vflag
) {
780 * We're going to print all the text lines in the
781 * request or response; just print the length
782 * on the first line of the output.
784 ND_PRINT((ndo
, ", length: %u", len
));
786 idx
< len
&& (eol
= print_txt_line(ndo
, protoname
, "\n\t", pptr
, idx
, len
)) != 0;
791 * Just print the first text line.
793 print_txt_line(ndo
, protoname
, ": ", pptr
, 0, len
);
799 safeputs(netdissect_options
*ndo
,
800 const u_char
*s
, const u_int maxlen
)
804 while (*s
&& idx
< maxlen
) {
805 safeputchar(ndo
, *s
);
812 safeputchar(netdissect_options
*ndo
,
815 ND_PRINT((ndo
, (c
< 0x80 && ND_ISPRINT(c
)) ? "%c" : "\\0x%02x", c
));
820 * Some compilers try to optimize memcpy(), using the alignment constraint
821 * on the argument pointer type. by using this function, we try to avoid the
825 unaligned_memcpy(void *p
, const void *q
, size_t l
)
830 /* As with memcpy(), so with memcmp(). */
832 unaligned_memcmp(const void *p
, const void *q
, size_t l
)
834 return (memcmp(p
, q
, l
));