2 * Copyright (c) 1990, 1991, 1993, 1994, 1995, 1996, 1997
3 * The Regents of the University of California. All rights reserved.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
23 * txtproto_print() derived from original code by Hannes Gredler
24 * (hannes@juniper.net):
26 * Redistribution and use in source and binary forms, with or without
27 * modification, are permitted provided that: (1) source code
28 * distributions retain the above copyright notice and this paragraph
29 * in its entirety, and (2) distributions including binary code include
30 * the above copyright notice and this paragraph in its entirety in
31 * the documentation or other materials provided with the distribution.
32 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND
33 * WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, WITHOUT
34 * LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
35 * FOR A PARTICULAR PURPOSE.
42 #include <tcpdump-stdinc.h>
54 #include "interface.h"
55 #include "ascii_strcasecmp.h"
56 #include "timeval-operations.h"
58 int32_t thiszone
; /* seconds offset from gmt to local time */
61 * timestamp display buffer size, the biggest size of both formats is needed
62 * sizeof("0000000000.000000000") > sizeof("00:00:00.000000000")
64 #define TS_BUF_SIZE sizeof("0000000000.000000000")
66 #define TOKBUFSIZE 128
69 * Print out a null-terminated filename (or other ascii string).
70 * If ep is NULL, assume no truncation check is needed.
71 * Return true if truncated.
74 fn_print(netdissect_options
*ndo
,
75 register const u_char
*s
, register const u_char
*ep
)
80 ret
= 1; /* assume truncated */
81 while (ep
== NULL
|| s
< ep
) {
89 ND_PRINT((ndo
, "M-"));
92 c
^= 0x40; /* DEL to ?, others to alpha */
95 ND_PRINT((ndo
, "%c", c
));
101 * Print out a counted filename (or other ascii string).
102 * If ep is NULL, assume no truncation check is needed.
103 * Return true if truncated.
106 fn_printn(netdissect_options
*ndo
,
107 register const u_char
*s
, register u_int n
, register const u_char
*ep
)
111 while (n
> 0 && (ep
== NULL
|| s
< ep
)) {
114 if (!ND_ISASCII(c
)) {
116 ND_PRINT((ndo
, "M-"));
118 if (!ND_ISPRINT(c
)) {
119 c
^= 0x40; /* DEL to ?, others to alpha */
120 ND_PRINT((ndo
, "^"));
122 ND_PRINT((ndo
, "%c", c
));
124 return (n
== 0) ? 0 : 1;
128 * Print out a null-padded filename (or other ascii string).
129 * If ep is NULL, assume no truncation check is needed.
130 * Return true if truncated.
133 fn_printzp(netdissect_options
*ndo
,
134 register const u_char
*s
, register u_int n
,
135 register const u_char
*ep
)
140 ret
= 1; /* assume truncated */
141 while (n
> 0 && (ep
== NULL
|| s
< ep
)) {
148 if (!ND_ISASCII(c
)) {
150 ND_PRINT((ndo
, "M-"));
152 if (!ND_ISPRINT(c
)) {
153 c
^= 0x40; /* DEL to ?, others to alpha */
154 ND_PRINT((ndo
, "^"));
156 ND_PRINT((ndo
, "%c", c
));
158 return (n
== 0) ? 0 : ret
;
162 * Format the timestamp
165 ts_format(netdissect_options
*ndo
166 #ifndef HAVE_PCAP_SET_TSTAMP_PRECISION
169 , int sec
, int usec
, char *buf
)
173 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
174 switch (ndo
->ndo_tstamp_precision
) {
176 case PCAP_TSTAMP_PRECISION_MICRO
:
177 format
= "%02d:%02d:%02d.%06u";
180 case PCAP_TSTAMP_PRECISION_NANO
:
181 format
= "%02d:%02d:%02d.%09u";
185 format
= "%02d:%02d:%02d.{unknown}";
189 format
= "%02d:%02d:%02d.%06u";
192 snprintf(buf
, TS_BUF_SIZE
, format
,
193 sec
/ 3600, (sec
% 3600) / 60, sec
% 60, usec
);
199 * Format the timestamp - Unix timeval style
202 ts_unix_format(netdissect_options
*ndo
203 #ifndef HAVE_PCAP_SET_TSTAMP_PRECISION
206 , int sec
, int usec
, char *buf
)
210 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
211 switch (ndo
->ndo_tstamp_precision
) {
213 case PCAP_TSTAMP_PRECISION_MICRO
:
217 case PCAP_TSTAMP_PRECISION_NANO
:
222 format
= "%u.{unknown}";
229 snprintf(buf
, TS_BUF_SIZE
, format
,
230 (unsigned)sec
, (unsigned)usec
);
236 * Print the timestamp
239 ts_print(netdissect_options
*ndo
,
240 register const struct timeval
*tvp
)
245 char buf
[TS_BUF_SIZE
];
246 static struct timeval tv_ref
;
247 struct timeval tv_result
;
251 switch (ndo
->ndo_tflag
) {
253 case 0: /* Default */
254 s
= (tvp
->tv_sec
+ thiszone
) % 86400;
255 ND_PRINT((ndo
, "%s ", ts_format(ndo
, s
, tvp
->tv_usec
, buf
)));
258 case 1: /* No time stamp */
261 case 2: /* Unix timeval style */
262 ND_PRINT((ndo
, "%s ", ts_unix_format(ndo
,
263 tvp
->tv_sec
, tvp
->tv_usec
, buf
)));
266 case 3: /* Microseconds/nanoseconds since previous packet */
267 case 5: /* Microseconds/nanoseconds since first packet */
268 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
269 switch (ndo
->ndo_tstamp_precision
) {
270 case PCAP_TSTAMP_PRECISION_MICRO
:
273 case PCAP_TSTAMP_PRECISION_NANO
:
283 if (!(tcpdump_timevalisset(&tv_ref
)))
284 tv_ref
= *tvp
; /* set timestamp for first packet */
286 negative_offset
= tcpdump_timevalcmp(tvp
, &tv_ref
, <);
288 tcpdump_timevalsub(&tv_ref
, tvp
, &tv_result
, nano_prec
);
290 tcpdump_timevalsub(tvp
, &tv_ref
, &tv_result
, nano_prec
);
292 ND_PRINT((ndo
, (negative_offset
? "-" : " ")));
294 ND_PRINT((ndo
, "%s ", ts_format(ndo
,
295 tv_result
.tv_sec
, tv_result
.tv_usec
, buf
)));
297 if (ndo
->ndo_tflag
== 3)
298 tv_ref
= *tvp
; /* set timestamp for previous packet */
301 case 4: /* Default + Date */
302 s
= (tvp
->tv_sec
+ thiszone
) % 86400;
303 Time
= (tvp
->tv_sec
+ thiszone
) - s
;
306 ND_PRINT((ndo
, "Date fail "));
308 ND_PRINT((ndo
, "%04d-%02d-%02d %s ",
309 tm
->tm_year
+1900, tm
->tm_mon
+1, tm
->tm_mday
,
310 ts_format(ndo
, s
, tvp
->tv_usec
, buf
)));
316 * Print a relative number of seconds (e.g. hold time, prune timer)
317 * in the form 5m1s. This does no truncation, so 32230861 seconds
318 * is represented as 1y1w1d1h1m1s.
321 relts_print(netdissect_options
*ndo
,
324 static const char *lengths
[] = {"y", "w", "d", "h", "m", "s"};
325 static const int seconds
[] = {31536000, 604800, 86400, 3600, 60, 1};
326 const char **l
= lengths
;
327 const int *s
= seconds
;
330 ND_PRINT((ndo
, "0s"));
334 ND_PRINT((ndo
, "-"));
339 ND_PRINT((ndo
, "%d%s", secs
/ *s
, *l
));
340 secs
-= (secs
/ *s
) * *s
;
348 * this is a generic routine for printing unknown data;
349 * we pass on the linefeed plus indentation string to
350 * get a proper output - returns 0 on error
354 print_unknown_data(netdissect_options
*ndo
, const u_char
*cp
,const char *ident
,int len
)
357 ND_PRINT((ndo
,"%sDissector error: print_unknown_data called with negative length",
361 if (ndo
->ndo_snapend
- cp
< len
)
362 len
= ndo
->ndo_snapend
- cp
;
364 ND_PRINT((ndo
,"%sDissector error: print_unknown_data called with pointer past end of packet",
368 hex_print(ndo
, ident
,cp
,len
);
369 return(1); /* everything is ok */
373 * Convert a token value to a string; use "fmt" if not found.
376 tok2strbuf(register const struct tok
*lp
, register const char *fmt
,
377 register u_int v
, char *buf
, size_t bufsize
)
380 while (lp
->s
!= NULL
) {
389 (void)snprintf(buf
, bufsize
, fmt
, v
);
390 return (const char *)buf
;
394 * Convert a token value to a string; use "fmt" if not found.
397 tok2str(register const struct tok
*lp
, register const char *fmt
,
400 static char buf
[4][TOKBUFSIZE
];
406 return tok2strbuf(lp
, fmt
, v
, ret
, sizeof(buf
[0]));
410 * Convert a bit token value to a string; use "fmt" if not found.
411 * this is useful for parsing bitfields, the output strings are seperated
412 * if the s field is positive.
415 bittok2str_internal(register const struct tok
*lp
, register const char *fmt
,
416 register u_int v
, const char *sep
)
418 static char buf
[256]; /* our stringbuffer */
420 register u_int rotbit
; /* this is the bit we rotate through all bitpositions */
421 register u_int tokval
;
422 const char * sepstr
= "";
424 while (lp
!= NULL
&& lp
->s
!= NULL
) {
425 tokval
=lp
->v
; /* load our first value */
427 while (rotbit
!= 0) {
429 * lets AND the rotating bit with our token value
430 * and see if we have got a match
432 if (tokval
== (v
&rotbit
)) {
433 /* ok we have found something */
434 buflen
+=snprintf(buf
+buflen
, sizeof(buf
)-buflen
, "%s%s",
439 rotbit
=rotbit
<<1; /* no match - lets shift and try again */
445 /* bummer - lets print the "unknown" message as advised in the fmt string if we got one */
446 (void)snprintf(buf
, sizeof(buf
), fmt
== NULL
? "#%08x" : fmt
, v
);
451 * Convert a bit token value to a string; use "fmt" if not found.
452 * this is useful for parsing bitfields, the output strings are not seperated.
455 bittok2str_nosep(register const struct tok
*lp
, register const char *fmt
,
458 return (bittok2str_internal(lp
, fmt
, v
, ""));
462 * Convert a bit token value to a string; use "fmt" if not found.
463 * this is useful for parsing bitfields, the output strings are comma seperated.
466 bittok2str(register const struct tok
*lp
, register const char *fmt
,
469 return (bittok2str_internal(lp
, fmt
, v
, ", "));
473 * Convert a value to a string using an array; the macro
474 * tok2strary() in <interface.h> is the public interface to
475 * this function and ensures that the second argument is
476 * correct for bounds-checking.
479 tok2strary_internal(register const char **lp
, int n
, register const char *fmt
,
482 static char buf
[TOKBUFSIZE
];
484 if (v
>= 0 && v
< n
&& lp
[v
] != NULL
)
488 (void)snprintf(buf
, sizeof(buf
), fmt
, v
);
493 * Convert a 32-bit netmask to prefixlen if possible
494 * the function returns the prefix-len; if plen == -1
495 * then conversion was not possible;
499 mask2plen(uint32_t mask
)
501 uint32_t bitmasks
[33] = {
503 0x80000000, 0xc0000000, 0xe0000000, 0xf0000000,
504 0xf8000000, 0xfc000000, 0xfe000000, 0xff000000,
505 0xff800000, 0xffc00000, 0xffe00000, 0xfff00000,
506 0xfff80000, 0xfffc0000, 0xfffe0000, 0xffff0000,
507 0xffff8000, 0xffffc000, 0xffffe000, 0xfffff000,
508 0xfffff800, 0xfffffc00, 0xfffffe00, 0xffffff00,
509 0xffffff80, 0xffffffc0, 0xffffffe0, 0xfffffff0,
510 0xfffffff8, 0xfffffffc, 0xfffffffe, 0xffffffff
514 /* let's see if we can transform the mask into a prefixlen */
515 while (prefix_len
>= 0) {
516 if (bitmasks
[prefix_len
] == mask
)
525 mask62plen(const u_char
*mask
)
527 u_char bitmasks
[9] = {
529 0x80, 0xc0, 0xe0, 0xf0,
530 0xf8, 0xfc, 0xfe, 0xff
535 for (byte
= 0; byte
< 16; byte
++) {
538 for (bits
= 0; bits
< (sizeof (bitmasks
) / sizeof (bitmasks
[0])); bits
++) {
539 if (mask
[byte
] == bitmasks
[bits
]) {
545 if (mask
[byte
] != 0xff)
553 * Routine to print out information for text-based protocols such as FTP,
554 * HTTP, SMTP, RTSP, SIP, ....
556 #define MAX_TOKEN 128
559 * Fetch a token from a packet, starting at the specified index,
560 * and return the length of the token.
562 * Returns 0 on error; yes, this is indistinguishable from an empty
563 * token, but an "empty token" isn't a valid token - it just means
564 * either a space character at the beginning of the line (this
565 * includes a blank line) or no more tokens remaining on the line.
568 fetch_token(netdissect_options
*ndo
, const u_char
*pptr
, u_int idx
, u_int len
,
569 u_char
*tbuf
, size_t tbuflen
)
573 for (; idx
< len
; idx
++) {
574 if (!ND_TTEST(*(pptr
+ idx
))) {
575 /* ran past end of captured data */
578 if (!isascii(*(pptr
+ idx
))) {
579 /* not an ASCII character */
582 if (isspace(*(pptr
+ idx
))) {
586 if (!isprint(*(pptr
+ idx
))) {
587 /* not part of a command token or response code */
590 if (toklen
+ 2 > tbuflen
) {
591 /* no room for this character and terminating '\0' */
594 tbuf
[toklen
] = *(pptr
+ idx
);
604 * Skip past any white space after the token, until we see
605 * an end-of-line (CR or LF).
607 for (; idx
< len
; idx
++) {
608 if (!ND_TTEST(*(pptr
+ idx
))) {
609 /* ran past end of captured data */
612 if (*(pptr
+ idx
) == '\r' || *(pptr
+ idx
) == '\n') {
616 if (!isascii(*(pptr
+ idx
)) || !isprint(*(pptr
+ idx
))) {
617 /* not a printable ASCII character */
620 if (!isspace(*(pptr
+ idx
))) {
621 /* beginning of next token */
629 * Scan a buffer looking for a line ending - LF or CR-LF.
630 * Return the index of the character after the line ending or 0 if
631 * we encounter a non-ASCII or non-printable character or don't find
635 print_txt_line(netdissect_options
*ndo
, const char *protoname
,
636 const char *prefix
, const u_char
*pptr
, u_int idx
, u_int len
)
643 ND_TCHECK(*(pptr
+idx
));
644 if (*(pptr
+idx
) == '\n') {
646 * LF without CR; end of line.
647 * Skip the LF and print the line, with the
648 * exception of the LF.
650 linelen
= idx
- startidx
;
653 } else if (*(pptr
+idx
) == '\r') {
655 if ((idx
+1) >= len
) {
656 /* not in this packet */
659 ND_TCHECK(*(pptr
+idx
+1));
660 if (*(pptr
+idx
+1) == '\n') {
662 * CR-LF; end of line.
663 * Skip the CR-LF and print the line, with
664 * the exception of the CR-LF.
666 linelen
= idx
- startidx
;
672 * CR followed by something else; treat this
673 * as if it were binary data, and don't print
677 } else if (!isascii(*(pptr
+idx
)) ||
678 (!isprint(*(pptr
+idx
)) && *(pptr
+idx
) != '\t')) {
680 * Not a printable ASCII character and not a tab;
681 * treat this as if it were binary data, and
690 * All printable ASCII, but no line ending after that point
691 * in the buffer; treat this as if it were truncated.
694 linelen
= idx
- startidx
;
695 ND_PRINT((ndo
, "%s%.*s[!%s]", prefix
, (int)linelen
, pptr
+ startidx
,
700 ND_PRINT((ndo
, "%s%.*s", prefix
, (int)linelen
, pptr
+ startidx
));
705 txtproto_print(netdissect_options
*ndo
, const u_char
*pptr
, u_int len
,
706 const char *protoname
, const char **cmds
, u_int flags
)
709 u_char token
[MAX_TOKEN
+1];
716 * This protocol has more than just request and
717 * response lines; see whether this looks like a
718 * request or response.
720 idx
= fetch_token(ndo
, pptr
, 0, len
, token
, sizeof(token
));
722 /* Is this a valid request name? */
723 while ((cmd
= *cmds
++) != NULL
) {
724 if (ascii_strcasecmp((const char *)token
, cmd
) == 0) {
732 * No - is this a valid response code (3 digits)?
734 * Is this token the response code, or is the next
735 * token the response code?
737 if (flags
& RESP_CODE_SECOND_TOKEN
) {
739 * Next token - get it.
741 idx
= fetch_token(ndo
, pptr
, idx
, len
, token
,
745 if (isdigit(token
[0]) && isdigit(token
[1]) &&
746 isdigit(token
[2]) && token
[3] == '\0') {
754 * This protocol has only request and response lines
755 * (e.g., FTP, where all the data goes over a
756 * different connection); assume the payload is
757 * a request or response.
762 /* Capitalize the protocol name */
763 for (pnp
= protoname
; *pnp
!= '\0'; pnp
++)
764 ND_PRINT((ndo
, "%c", toupper(*pnp
)));
768 * In non-verbose mode, just print the protocol, followed
769 * by the first line as the request or response info.
771 * In verbose mode, print lines as text until we run out
772 * of characters or see something that's not a
773 * printable-ASCII line.
775 if (ndo
->ndo_vflag
) {
777 * We're going to print all the text lines in the
778 * request or response; just print the length
779 * on the first line of the output.
781 ND_PRINT((ndo
, ", length: %u", len
));
783 idx
< len
&& (eol
= print_txt_line(ndo
, protoname
, "\n\t", pptr
, idx
, len
)) != 0;
788 * Just print the first text line.
790 print_txt_line(ndo
, protoname
, ": ", pptr
, 0, len
);
796 safeputs(netdissect_options
*ndo
,
797 const u_char
*s
, const u_int maxlen
)
801 while (*s
&& idx
< maxlen
) {
802 safeputchar(ndo
, *s
);
809 safeputchar(netdissect_options
*ndo
,
812 ND_PRINT((ndo
, (c
< 0x80 && ND_ISPRINT(c
)) ? "%c" : "\\0x%02x", c
));
817 * Some compilers try to optimize memcpy(), using the alignment constraint
818 * on the argument pointer type. by using this function, we try to avoid the
822 unaligned_memcpy(void *p
, const void *q
, size_t l
)
827 /* As with memcpy(), so with memcmp(). */
829 unaligned_memcmp(const void *p
, const void *q
, size_t l
)
831 return (memcmp(p
, q
, l
));