2 * Copyright (c) 1990, 1991, 1993, 1994, 1995, 1996, 1997
3 * The Regents of the University of California. All rights reserved.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
23 * txtproto_print() derived from original code by Hannes Gredler
24 * (hannes@gredler.at):
26 * Redistribution and use in source and binary forms, with or without
27 * modification, are permitted provided that: (1) source code
28 * distributions retain the above copyright notice and this paragraph
29 * in its entirety, and (2) distributions including binary code include
30 * the above copyright notice and this paragraph in its entirety in
31 * the documentation or other materials provided with the distribution.
32 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND
33 * WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, WITHOUT
34 * LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
35 * FOR A PARTICULAR PURPOSE.
42 #include "netdissect-stdinc.h"
55 #include "netdissect.h"
57 #include "ascii_strcasecmp.h"
58 #include "timeval-operations.h"
60 int32_t thiszone
; /* seconds offset from gmt to local time */
61 /* invalid string to print '(invalid)' for malformed or corrupted packets */
62 const char istr
[] = " (invalid)";
65 * timestamp display buffer size, the biggest size of both formats is needed
66 * sizeof("0000000000.000000000") > sizeof("00:00:00.000000000")
68 #define TS_BUF_SIZE sizeof("0000000000.000000000")
70 #define TOKBUFSIZE 128
73 * Print out a character, filtering out the non-printable ones
76 fn_print_char(netdissect_options
*ndo
, u_char c
)
83 c
^= 0x40; /* DEL to ?, others to alpha */
90 * Print out a null-terminated filename (or other ASCII string), part of
92 * If ep is NULL, assume no truncation check is needed.
93 * Return true if truncated.
94 * Stop at ep (if given) or before the null char, whichever is first.
97 nd_print(netdissect_options
*ndo
,
98 const u_char
*s
, const u_char
*ep
)
103 ret
= 1; /* assume truncated */
104 while (ep
== NULL
|| s
< ep
) {
111 fn_print_char(ndo
, c
);
117 * Print out a null-terminated filename (or other ASCII string) from
118 * a fixed-length buffer, part of the packet buffer.
119 * If ep is NULL, assume no truncation check is needed.
120 * Return the number of bytes of string processed, including the
121 * terminating null, if not truncated. Return 0 if truncated.
124 nd_printztn(netdissect_options
*ndo
,
125 const u_char
*s
, u_int n
, const u_char
*ep
)
132 if (n
== 0 || (ep
!= NULL
&& s
>= ep
)) {
134 * Truncated. This includes "no null before we
135 * got to the end of the fixed-length buffer".
137 * XXX - BOOTP says "null-terminated", which
138 * means the maximum length of the string, in
139 * bytes, is 1 less than the size of the buffer,
140 * as there must always be a terminating null.
154 fn_print_char(ndo
, c
);
160 * Print out a counted filename (or other ASCII string), part of
162 * If ep is NULL, assume no truncation check is needed.
163 * Return true if truncated.
164 * Stop at ep (if given) or after n bytes, whichever is first.
167 nd_printn(netdissect_options
*ndo
,
168 const u_char
*s
, u_int n
, const u_char
*ep
)
172 while (n
> 0 && (ep
== NULL
|| s
< ep
)) {
176 fn_print_char(ndo
, c
);
178 return (n
== 0) ? 0 : 1;
182 * Print out a null-padded filename (or other ASCII string), part of
184 * If ep is NULL, assume no truncation check is needed.
185 * Return true if truncated.
186 * Stop at ep (if given) or after n bytes or before the null char,
187 * whichever is first.
190 nd_printzp(netdissect_options
*ndo
,
191 const u_char
*s
, u_int n
,
197 ret
= 1; /* assume truncated */
198 while (n
> 0 && (ep
== NULL
|| s
< ep
)) {
206 fn_print_char(ndo
, c
);
208 return (n
== 0) ? 0 : ret
;
212 * Format the timestamp
215 ts_format(netdissect_options
*ndo
216 #ifndef HAVE_PCAP_SET_TSTAMP_PRECISION
219 , int sec
, int usec
, char *buf
)
223 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
224 switch (ndo
->ndo_tstamp_precision
) {
226 case PCAP_TSTAMP_PRECISION_MICRO
:
227 format
= "%02d:%02d:%02d.%06u";
230 case PCAP_TSTAMP_PRECISION_NANO
:
231 format
= "%02d:%02d:%02d.%09u";
235 format
= "%02d:%02d:%02d.{unknown}";
239 format
= "%02d:%02d:%02d.%06u";
242 nd_snprintf(buf
, TS_BUF_SIZE
, format
,
243 sec
/ 3600, (sec
% 3600) / 60, sec
% 60, usec
);
249 * Format the timestamp - Unix timeval style
252 ts_unix_format(netdissect_options
*ndo
253 #ifndef HAVE_PCAP_SET_TSTAMP_PRECISION
256 , int sec
, int usec
, char *buf
)
260 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
261 switch (ndo
->ndo_tstamp_precision
) {
263 case PCAP_TSTAMP_PRECISION_MICRO
:
267 case PCAP_TSTAMP_PRECISION_NANO
:
272 format
= "%u.{unknown}";
279 nd_snprintf(buf
, TS_BUF_SIZE
, format
,
280 (unsigned)sec
, (unsigned)usec
);
286 * Print the timestamp
289 ts_print(netdissect_options
*ndo
,
290 const struct timeval
*tvp
)
295 char buf
[TS_BUF_SIZE
];
296 static struct timeval tv_ref
;
297 struct timeval tv_result
;
301 switch (ndo
->ndo_tflag
) {
303 case 0: /* Default */
304 s
= (tvp
->tv_sec
+ thiszone
) % 86400;
305 ND_PRINT("%s ", ts_format(ndo
, s
, tvp
->tv_usec
, buf
));
308 case 1: /* No time stamp */
311 case 2: /* Unix timeval style */
312 ND_PRINT("%s ", ts_unix_format(ndo
,
313 tvp
->tv_sec
, tvp
->tv_usec
, buf
));
316 case 3: /* Microseconds/nanoseconds since previous packet */
317 case 5: /* Microseconds/nanoseconds since first packet */
318 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
319 switch (ndo
->ndo_tstamp_precision
) {
320 case PCAP_TSTAMP_PRECISION_MICRO
:
323 case PCAP_TSTAMP_PRECISION_NANO
:
333 if (!(netdissect_timevalisset(&tv_ref
)))
334 tv_ref
= *tvp
; /* set timestamp for first packet */
336 negative_offset
= netdissect_timevalcmp(tvp
, &tv_ref
, <);
338 netdissect_timevalsub(&tv_ref
, tvp
, &tv_result
, nano_prec
);
340 netdissect_timevalsub(tvp
, &tv_ref
, &tv_result
, nano_prec
);
342 ND_PRINT((negative_offset
? "-" : " "));
344 ND_PRINT("%s ", ts_format(ndo
,
345 tv_result
.tv_sec
, tv_result
.tv_usec
, buf
));
347 if (ndo
->ndo_tflag
== 3)
348 tv_ref
= *tvp
; /* set timestamp for previous packet */
351 case 4: /* Default + Date */
352 s
= (tvp
->tv_sec
+ thiszone
) % 86400;
353 Time
= (tvp
->tv_sec
+ thiszone
) - s
;
356 ND_PRINT("Date fail ");
358 ND_PRINT("%04d-%02d-%02d %s ",
359 tm
->tm_year
+1900, tm
->tm_mon
+1, tm
->tm_mday
,
360 ts_format(ndo
, s
, tvp
->tv_usec
, buf
));
366 * Print an unsigned relative number of seconds (e.g. hold time, prune timer)
367 * in the form 5m1s. This does no truncation, so 32230861 seconds
368 * is represented as 1y1w1d1h1m1s.
371 unsigned_relts_print(netdissect_options
*ndo
,
374 static const char *lengths
[] = {"y", "w", "d", "h", "m", "s"};
375 static const u_int seconds
[] = {31536000, 604800, 86400, 3600, 60, 1};
376 const char **l
= lengths
;
377 const u_int
*s
= seconds
;
385 ND_PRINT("%u%s", secs
/ *s
, *l
);
386 secs
-= (secs
/ *s
) * *s
;
394 * Print a signed relative number of seconds (e.g. hold time, prune timer)
395 * in the form 5m1s. This does no truncation, so 32230861 seconds
396 * is represented as 1y1w1d1h1m1s.
399 signed_relts_print(netdissect_options
*ndo
,
404 if (secs
== INT32_MIN
) {
406 * -2^31; you can't fit its absolute value into
407 * a 32-bit signed integer.
409 * Just directly pass said absolute value to
410 * unsigned_relts_print() directly.
412 * (XXX - does ISO C guarantee that -(-2^n),
413 * when calculated and cast to an n-bit unsigned
414 * integer type, will have the value 2^n?)
416 unsigned_relts_print(ndo
, 2147483648U);
419 * We now know -secs will fit into an int32_t;
420 * negate it and pass that to unsigned_relts_print().
422 unsigned_relts_print(ndo
, -secs
);
426 unsigned_relts_print(ndo
, secs
);
430 * this is a generic routine for printing unknown data;
431 * we pass on the linefeed plus indentation string to
432 * get a proper output - returns 0 on error
436 print_unknown_data(netdissect_options
*ndo
, const u_char
*cp
,const char *ident
,int len
)
439 ND_PRINT("%sDissector error: print_unknown_data called with negative length",
443 if (ndo
->ndo_snapend
- cp
< len
)
444 len
= ndo
->ndo_snapend
- cp
;
446 ND_PRINT("%sDissector error: print_unknown_data called with pointer past end of packet",
450 hex_print(ndo
, ident
,cp
,len
);
451 return(1); /* everything is ok */
455 * Convert a token value to a string; use "fmt" if not found.
458 tok2strbuf(const struct tok
*lp
, const char *fmt
,
459 u_int v
, char *buf
, size_t bufsize
)
462 while (lp
->s
!= NULL
) {
471 (void)nd_snprintf(buf
, bufsize
, fmt
, v
);
472 return (const char *)buf
;
476 * Convert a token value to a string; use "fmt" if not found.
477 * Uses tok2strbuf() on one of four local static buffers of size TOKBUFSIZE
478 * in round-robin fashion.
481 tok2str(const struct tok
*lp
, const char *fmt
,
484 static char buf
[4][TOKBUFSIZE
];
490 return tok2strbuf(lp
, fmt
, v
, ret
, sizeof(buf
[0]));
494 * Convert a bit token value to a string; use "fmt" if not found.
495 * this is useful for parsing bitfields, the output strings are seperated
496 * if the s field is positive.
499 bittok2str_internal(const struct tok
*lp
, const char *fmt
,
500 u_int v
, const char *sep
)
502 static char buf
[1024+1]; /* our string buffer */
504 size_t space_left
= sizeof(buf
), string_size
;
505 u_int rotbit
; /* this is the bit we rotate through all bitpositions */
507 const char * sepstr
= "";
509 while (lp
!= NULL
&& lp
->s
!= NULL
) {
510 tokval
=lp
->v
; /* load our first value */
512 while (rotbit
!= 0) {
514 * lets AND the rotating bit with our token value
515 * and see if we have got a match
517 if (tokval
== (v
&rotbit
)) {
518 /* ok we have found something */
520 return (buf
); /* only enough room left for NUL, if that */
521 string_size
= strlcpy(bufp
, sepstr
, space_left
);
522 if (string_size
>= space_left
)
523 return (buf
); /* we ran out of room */
525 space_left
-= string_size
;
527 return (buf
); /* only enough room left for NUL, if that */
528 string_size
= strlcpy(bufp
, lp
->s
, space_left
);
529 if (string_size
>= space_left
)
530 return (buf
); /* we ran out of room */
532 space_left
-= string_size
;
536 rotbit
=rotbit
<<1; /* no match - lets shift and try again */
542 /* bummer - lets print the "unknown" message as advised in the fmt string if we got one */
543 (void)nd_snprintf(buf
, sizeof(buf
), fmt
== NULL
? "#%08x" : fmt
, v
);
548 * Convert a bit token value to a string; use "fmt" if not found.
549 * this is useful for parsing bitfields, the output strings are not seperated.
552 bittok2str_nosep(const struct tok
*lp
, const char *fmt
,
555 return (bittok2str_internal(lp
, fmt
, v
, ""));
559 * Convert a bit token value to a string; use "fmt" if not found.
560 * this is useful for parsing bitfields, the output strings are comma seperated.
563 bittok2str(const struct tok
*lp
, const char *fmt
,
566 return (bittok2str_internal(lp
, fmt
, v
, ", "));
570 * Convert a value to a string using an array; the macro
571 * tok2strary() in <netdissect.h> is the public interface to
572 * this function and ensures that the second argument is
573 * correct for bounds-checking.
576 tok2strary_internal(const char **lp
, int n
, const char *fmt
,
579 static char buf
[TOKBUFSIZE
];
581 if (v
>= 0 && v
< n
&& lp
[v
] != NULL
)
585 (void)nd_snprintf(buf
, sizeof(buf
), fmt
, v
);
590 * Convert a 32-bit netmask to prefixlen if possible
591 * the function returns the prefix-len; if plen == -1
592 * then conversion was not possible;
596 mask2plen(uint32_t mask
)
598 uint32_t bitmasks
[33] = {
600 0x80000000, 0xc0000000, 0xe0000000, 0xf0000000,
601 0xf8000000, 0xfc000000, 0xfe000000, 0xff000000,
602 0xff800000, 0xffc00000, 0xffe00000, 0xfff00000,
603 0xfff80000, 0xfffc0000, 0xfffe0000, 0xffff0000,
604 0xffff8000, 0xffffc000, 0xffffe000, 0xfffff000,
605 0xfffff800, 0xfffffc00, 0xfffffe00, 0xffffff00,
606 0xffffff80, 0xffffffc0, 0xffffffe0, 0xfffffff0,
607 0xfffffff8, 0xfffffffc, 0xfffffffe, 0xffffffff
611 /* let's see if we can transform the mask into a prefixlen */
612 while (prefix_len
>= 0) {
613 if (bitmasks
[prefix_len
] == mask
)
621 mask62plen(const u_char
*mask
)
623 u_char bitmasks
[9] = {
625 0x80, 0xc0, 0xe0, 0xf0,
626 0xf8, 0xfc, 0xfe, 0xff
631 for (byte
= 0; byte
< 16; byte
++) {
634 for (bits
= 0; bits
< (sizeof (bitmasks
) / sizeof (bitmasks
[0])); bits
++) {
635 if (mask
[byte
] == bitmasks
[bits
]) {
641 if (mask
[byte
] != 0xff)
648 * Routine to print out information for text-based protocols such as FTP,
649 * HTTP, SMTP, RTSP, SIP, ....
651 #define MAX_TOKEN 128
654 * Fetch a token from a packet, starting at the specified index,
655 * and return the length of the token.
657 * Returns 0 on error; yes, this is indistinguishable from an empty
658 * token, but an "empty token" isn't a valid token - it just means
659 * either a space character at the beginning of the line (this
660 * includes a blank line) or no more tokens remaining on the line.
663 fetch_token(netdissect_options
*ndo
, const u_char
*pptr
, u_int idx
, u_int len
,
664 u_char
*tbuf
, size_t tbuflen
)
668 for (; idx
< len
; idx
++) {
669 if (!ND_TTEST_1(pptr
+ idx
)) {
670 /* ran past end of captured data */
673 if (!isascii(*(pptr
+ idx
))) {
674 /* not an ASCII character */
677 if (isspace(*(pptr
+ idx
))) {
681 if (!isprint(*(pptr
+ idx
))) {
682 /* not part of a command token or response code */
685 if (toklen
+ 2 > tbuflen
) {
686 /* no room for this character and terminating '\0' */
689 tbuf
[toklen
] = *(pptr
+ idx
);
699 * Skip past any white space after the token, until we see
700 * an end-of-line (CR or LF).
702 for (; idx
< len
; idx
++) {
703 if (!ND_TTEST_1(pptr
+ idx
)) {
704 /* ran past end of captured data */
707 if (*(pptr
+ idx
) == '\r' || *(pptr
+ idx
) == '\n') {
711 if (!isascii(*(pptr
+ idx
)) || !isprint(*(pptr
+ idx
))) {
712 /* not a printable ASCII character */
715 if (!isspace(*(pptr
+ idx
))) {
716 /* beginning of next token */
724 * Scan a buffer looking for a line ending - LF or CR-LF.
725 * Return the index of the character after the line ending or 0 if
726 * we encounter a non-ASCII or non-printable character or don't find
730 print_txt_line(netdissect_options
*ndo
, const char *protoname
,
731 const char *prefix
, const u_char
*pptr
, u_int idx
, u_int len
)
738 ND_TCHECK_1(pptr
+ idx
);
739 if (*(pptr
+idx
) == '\n') {
741 * LF without CR; end of line.
742 * Skip the LF and print the line, with the
743 * exception of the LF.
745 linelen
= idx
- startidx
;
748 } else if (*(pptr
+idx
) == '\r') {
750 if ((idx
+1) >= len
) {
751 /* not in this packet */
754 ND_TCHECK_1(pptr
+ idx
+ 1);
755 if (*(pptr
+idx
+1) == '\n') {
757 * CR-LF; end of line.
758 * Skip the CR-LF and print the line, with
759 * the exception of the CR-LF.
761 linelen
= idx
- startidx
;
767 * CR followed by something else; treat this
768 * as if it were binary data, and don't print
772 } else if (!isascii(*(pptr
+idx
)) ||
773 (!isprint(*(pptr
+idx
)) && *(pptr
+idx
) != '\t')) {
775 * Not a printable ASCII character and not a tab;
776 * treat this as if it were binary data, and
785 * All printable ASCII, but no line ending after that point
786 * in the buffer; treat this as if it were truncated.
789 linelen
= idx
- startidx
;
790 ND_PRINT("%s%.*s[!%s]", prefix
, (int)linelen
, pptr
+ startidx
,
795 ND_PRINT("%s%.*s", prefix
, (int)linelen
, pptr
+ startidx
);
800 txtproto_print(netdissect_options
*ndo
, const u_char
*pptr
, u_int len
,
801 const char *protoname
, const char **cmds
, u_int flags
)
804 u_char token
[MAX_TOKEN
+1];
811 * This protocol has more than just request and
812 * response lines; see whether this looks like a
813 * request or response and, if so, print it and,
814 * in verbose mode, print everything after it.
816 * This is for HTTP-like protocols, where we
817 * want to print requests and responses, but
818 * don't want to print continuations of request
819 * or response bodies in packets that don't
820 * contain the request or response line.
822 idx
= fetch_token(ndo
, pptr
, 0, len
, token
, sizeof(token
));
824 /* Is this a valid request name? */
825 while ((cmd
= *cmds
++) != NULL
) {
826 if (ascii_strcasecmp((const char *)token
, cmd
) == 0) {
834 * No - is this a valid response code (3 digits)?
836 * Is this token the response code, or is the next
837 * token the response code?
839 if (flags
& RESP_CODE_SECOND_TOKEN
) {
841 * Next token - get it.
843 idx
= fetch_token(ndo
, pptr
, idx
, len
, token
,
847 if (isdigit(token
[0]) && isdigit(token
[1]) &&
848 isdigit(token
[2]) && token
[3] == '\0') {
858 * 1) This protocol has only request and response lines
859 * (e.g., FTP, where all the data goes over a different
860 * connection); assume the payload is a request or
865 * 2) This protocol is just text, so that we should
866 * always, at minimum, print the first line and,
867 * in verbose mode, print all lines.
872 /* Capitalize the protocol name */
873 for (pnp
= protoname
; *pnp
!= '\0'; pnp
++)
874 ND_PRINT("%c", toupper((u_char
)*pnp
));
878 * In non-verbose mode, just print the protocol, followed
881 * In verbose mode, print lines as text until we run out
882 * of characters or see something that's not a
883 * printable-ASCII line.
885 if (ndo
->ndo_vflag
) {
887 * We're going to print all the text lines in the
888 * request or response; just print the length
889 * on the first line of the output.
891 ND_PRINT(", length: %u", len
);
893 idx
< len
&& (eol
= print_txt_line(ndo
, protoname
, "\n\t", pptr
, idx
, len
)) != 0;
898 * Just print the first text line.
900 print_txt_line(ndo
, protoname
, ": ", pptr
, 0, len
);
906 safeputs(netdissect_options
*ndo
,
907 const u_char
*s
, const u_int maxlen
)
911 while (idx
< maxlen
&& EXTRACT_U_1(s
)) {
912 safeputchar(ndo
, EXTRACT_U_1(s
));
919 safeputchar(netdissect_options
*ndo
,
922 ND_PRINT((c
< 0x80 && ND_ISPRINT(c
)) ? "%c" : "\\0x%02x", c
);
925 #if (defined(__i386__) || defined(_M_IX86) || defined(__X86__) || defined(__x86_64__) || defined(_M_X64)) || \
926 (defined(__arm__) || defined(_M_ARM) || defined(__aarch64__)) || \
927 (defined(__m68k__) && (!defined(__mc68000__) && !defined(__mc68010__))) || \
928 (defined(__ppc__) || defined(__ppc64__) || defined(_M_PPC) || defined(_ARCH_PPC) || defined(_ARCH_PPC64)) || \
929 (defined(__s390__) || defined(__s390x__) || defined(__zarch__)) || \
932 * The procesor natively handles unaligned loads, so just use memcpy()
933 * and memcmp(), to enable those optimizations.
935 * XXX - are those all the x86 tests we need?
936 * XXX - do we need to worry about ARMv1 through ARMv5, which didn't
937 * support unaligned loads, and, if so, do we need to worry about all
938 * of them, or just some of them, e.g. ARMv5?
939 * XXX - are those the only 68k tests we need not to generated
940 * unaligned accesses if the target is the 68000 or 68010?
941 * XXX - are there any tests we don't need, because some definitions are for
942 * compilers that also predefine the GCC symbols?
943 * XXX - do we need to test for both 32-bit and 64-bit versions of those
944 * architectures in all cases?
948 * The processor doesn't natively handle unaligned loads,
949 * and the compiler might "helpfully" optimize memcpy()
950 * and memcmp(), when handed pointers that would normally
951 * be properly aligned, into sequences that assume proper
954 * Do copies and compares of possibly-unaligned data by
955 * calling routines that wrap memcpy() and memcmp(), to
956 * prevent that optimization.
959 unaligned_memcpy(void *p
, const void *q
, size_t l
)
964 /* As with memcpy(), so with memcmp(). */
966 unaligned_memcmp(const void *p
, const void *q
, size_t l
)
968 return (memcmp(p
, q
, l
));