2 * Copyright (c) 1990, 1991, 1993, 1994, 1995, 1996, 1997
3 * The Regents of the University of California. All rights reserved.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
23 * txtproto_print() derived from original code by Hannes Gredler
24 * (hannes@juniper.net):
26 * Redistribution and use in source and binary forms, with or without
27 * modification, are permitted provided that: (1) source code
28 * distributions retain the above copyright notice and this paragraph
29 * in its entirety, and (2) distributions including binary code include
30 * the above copyright notice and this paragraph in its entirety in
31 * the documentation or other materials provided with the distribution.
32 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND
33 * WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, WITHOUT
34 * LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
35 * FOR A PARTICULAR PURPOSE.
42 #include <tcpdump-stdinc.h>
54 #include "interface.h"
55 #include "ascii_strcasecmp.h"
57 int32_t thiszone
; /* seconds offset from gmt to local time */
60 * timestamp display buffer size, the biggest size of both formats is needed
61 * sizeof("0000000000.000000000") > sizeof("00:00:00.000000000")
63 #define TS_BUF_SIZE sizeof("0000000000.000000000")
66 * Print out a null-terminated filename (or other ascii string).
67 * If ep is NULL, assume no truncation check is needed.
68 * Return true if truncated.
71 fn_print(netdissect_options
*ndo
,
72 register const u_char
*s
, register const u_char
*ep
)
77 ret
= 1; /* assume truncated */
78 while (ep
== NULL
|| s
< ep
) {
86 ND_PRINT((ndo
, "M-"));
89 c
^= 0x40; /* DEL to ?, others to alpha */
92 ND_PRINT((ndo
, "%c", c
));
98 * Print out a counted filename (or other ascii string).
99 * If ep is NULL, assume no truncation check is needed.
100 * Return true if truncated.
103 fn_printn(netdissect_options
*ndo
,
104 register const u_char
*s
, register u_int n
, register const u_char
*ep
)
108 while (n
> 0 && (ep
== NULL
|| s
< ep
)) {
111 if (!ND_ISASCII(c
)) {
113 ND_PRINT((ndo
, "M-"));
115 if (!ND_ISPRINT(c
)) {
116 c
^= 0x40; /* DEL to ?, others to alpha */
117 ND_PRINT((ndo
, "^"));
119 ND_PRINT((ndo
, "%c", c
));
121 return (n
== 0) ? 0 : 1;
125 * Print out a null-padded filename (or other ascii string).
126 * If ep is NULL, assume no truncation check is needed.
127 * Return true if truncated.
130 fn_printzp(netdissect_options
*ndo
,
131 register const u_char
*s
, register u_int n
,
132 register const u_char
*ep
)
137 ret
= 1; /* assume truncated */
138 while (n
> 0 && (ep
== NULL
|| s
< ep
)) {
145 if (!ND_ISASCII(c
)) {
147 ND_PRINT((ndo
, "M-"));
149 if (!ND_ISPRINT(c
)) {
150 c
^= 0x40; /* DEL to ?, others to alpha */
151 ND_PRINT((ndo
, "^"));
153 ND_PRINT((ndo
, "%c", c
));
155 return (n
== 0) ? 0 : ret
;
159 * Format the timestamp
162 ts_format(netdissect_options
*ndo
163 #ifndef HAVE_PCAP_SET_TSTAMP_PRECISION
166 , int sec
, int usec
, char *buf
)
170 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
171 switch (ndo
->ndo_tstamp_precision
) {
173 case PCAP_TSTAMP_PRECISION_MICRO
:
174 format
= "%02d:%02d:%02d.%06u";
177 case PCAP_TSTAMP_PRECISION_NANO
:
178 format
= "%02d:%02d:%02d.%09u";
182 format
= "%02d:%02d:%02d.{unknown}";
186 format
= "%02d:%02d:%02d.%06u";
189 snprintf(buf
, TS_BUF_SIZE
, format
,
190 sec
/ 3600, (sec
% 3600) / 60, sec
% 60, usec
);
196 * Print the timestamp
199 ts_print(netdissect_options
*ndo
,
200 register const struct timeval
*tvp
)
205 static unsigned b_sec
;
206 static unsigned b_usec
;
209 char buf
[TS_BUF_SIZE
];
211 switch (ndo
->ndo_tflag
) {
213 case 0: /* Default */
214 s
= (tvp
->tv_sec
+ thiszone
) % 86400;
215 ND_PRINT((ndo
, "%s ", ts_format(ndo
, s
, tvp
->tv_usec
, buf
)));
218 case 1: /* No time stamp */
221 case 2: /* Unix timeval style */
222 ND_PRINT((ndo
, "%u.%06u ",
223 (unsigned)tvp
->tv_sec
,
224 (unsigned)tvp
->tv_usec
));
227 case 3: /* Microseconds since previous packet */
228 case 5: /* Microseconds since first packet */
230 /* init timestamp for first packet */
231 b_usec
= tvp
->tv_usec
;
235 d_usec
= tvp
->tv_usec
- b_usec
;
236 d_sec
= tvp
->tv_sec
- b_sec
;
243 ND_PRINT((ndo
, "%s ", ts_format(ndo
, d_sec
, d_usec
, buf
)));
245 if (ndo
->ndo_tflag
== 3) { /* set timestamp for last packet */
247 b_usec
= tvp
->tv_usec
;
251 case 4: /* Default + Date */
252 s
= (tvp
->tv_sec
+ thiszone
) % 86400;
253 Time
= (tvp
->tv_sec
+ thiszone
) - s
;
256 ND_PRINT((ndo
, "Date fail "));
258 ND_PRINT((ndo
, "%04d-%02d-%02d %s ",
259 tm
->tm_year
+1900, tm
->tm_mon
+1, tm
->tm_mday
,
260 ts_format(ndo
, s
, tvp
->tv_usec
, buf
)));
266 * Print a relative number of seconds (e.g. hold time, prune timer)
267 * in the form 5m1s. This does no truncation, so 32230861 seconds
268 * is represented as 1y1w1d1h1m1s.
271 relts_print(netdissect_options
*ndo
,
274 static const char *lengths
[] = {"y", "w", "d", "h", "m", "s"};
275 static const int seconds
[] = {31536000, 604800, 86400, 3600, 60, 1};
276 const char **l
= lengths
;
277 const int *s
= seconds
;
280 ND_PRINT((ndo
, "0s"));
284 ND_PRINT((ndo
, "-"));
289 ND_PRINT((ndo
, "%d%s", secs
/ *s
, *l
));
290 secs
-= (secs
/ *s
) * *s
;
298 * this is a generic routine for printing unknown data;
299 * we pass on the linefeed plus indentation string to
300 * get a proper output - returns 0 on error
304 print_unknown_data(netdissect_options
*ndo
, const u_char
*cp
,const char *ident
,int len
)
307 ND_PRINT((ndo
,"%sDissector error: print_unknown_data called with negative length",
311 if (ndo
->ndo_snapend
- cp
< len
)
312 len
= ndo
->ndo_snapend
- cp
;
314 ND_PRINT((ndo
,"%sDissector error: print_unknown_data called with pointer past end of packet",
318 hex_print(ndo
, ident
,cp
,len
);
319 return(1); /* everything is ok */
323 * Convert a token value to a string; use "fmt" if not found.
326 tok2strbuf(register const struct tok
*lp
, register const char *fmt
,
327 register u_int v
, char *buf
, size_t bufsize
)
330 while (lp
->s
!= NULL
) {
339 (void)snprintf(buf
, bufsize
, fmt
, v
);
340 return (const char *)buf
;
344 * Convert a token value to a string; use "fmt" if not found.
347 tok2str(register const struct tok
*lp
, register const char *fmt
,
350 static char buf
[4][128];
356 return tok2strbuf(lp
, fmt
, v
, ret
, sizeof(buf
[0]));
360 * Convert a bit token value to a string; use "fmt" if not found.
361 * this is useful for parsing bitfields, the output strings are seperated
362 * if the s field is positive.
365 bittok2str_internal(register const struct tok
*lp
, register const char *fmt
,
366 register u_int v
, const char *sep
)
368 static char buf
[256]; /* our stringbuffer */
370 register u_int rotbit
; /* this is the bit we rotate through all bitpositions */
371 register u_int tokval
;
372 const char * sepstr
= "";
374 while (lp
!= NULL
&& lp
->s
!= NULL
) {
375 tokval
=lp
->v
; /* load our first value */
377 while (rotbit
!= 0) {
379 * lets AND the rotating bit with our token value
380 * and see if we have got a match
382 if (tokval
== (v
&rotbit
)) {
383 /* ok we have found something */
384 buflen
+=snprintf(buf
+buflen
, sizeof(buf
)-buflen
, "%s%s",
389 rotbit
=rotbit
<<1; /* no match - lets shift and try again */
395 /* bummer - lets print the "unknown" message as advised in the fmt string if we got one */
396 (void)snprintf(buf
, sizeof(buf
), fmt
== NULL
? "#%08x" : fmt
, v
);
401 * Convert a bit token value to a string; use "fmt" if not found.
402 * this is useful for parsing bitfields, the output strings are not seperated.
405 bittok2str_nosep(register const struct tok
*lp
, register const char *fmt
,
408 return (bittok2str_internal(lp
, fmt
, v
, ""));
412 * Convert a bit token value to a string; use "fmt" if not found.
413 * this is useful for parsing bitfields, the output strings are comma seperated.
416 bittok2str(register const struct tok
*lp
, register const char *fmt
,
419 return (bittok2str_internal(lp
, fmt
, v
, ", "));
423 * Convert a value to a string using an array; the macro
424 * tok2strary() in <interface.h> is the public interface to
425 * this function and ensures that the second argument is
426 * correct for bounds-checking.
429 tok2strary_internal(register const char **lp
, int n
, register const char *fmt
,
432 static char buf
[128];
434 if (v
>= 0 && v
< n
&& lp
[v
] != NULL
)
438 (void)snprintf(buf
, sizeof(buf
), fmt
, v
);
443 * Convert a 32-bit netmask to prefixlen if possible
444 * the function returns the prefix-len; if plen == -1
445 * then conversion was not possible;
449 mask2plen(uint32_t mask
)
451 uint32_t bitmasks
[33] = {
453 0x80000000, 0xc0000000, 0xe0000000, 0xf0000000,
454 0xf8000000, 0xfc000000, 0xfe000000, 0xff000000,
455 0xff800000, 0xffc00000, 0xffe00000, 0xfff00000,
456 0xfff80000, 0xfffc0000, 0xfffe0000, 0xffff0000,
457 0xffff8000, 0xffffc000, 0xffffe000, 0xfffff000,
458 0xfffff800, 0xfffffc00, 0xfffffe00, 0xffffff00,
459 0xffffff80, 0xffffffc0, 0xffffffe0, 0xfffffff0,
460 0xfffffff8, 0xfffffffc, 0xfffffffe, 0xffffffff
464 /* let's see if we can transform the mask into a prefixlen */
465 while (prefix_len
>= 0) {
466 if (bitmasks
[prefix_len
] == mask
)
475 mask62plen(const u_char
*mask
)
477 u_char bitmasks
[9] = {
479 0x80, 0xc0, 0xe0, 0xf0,
480 0xf8, 0xfc, 0xfe, 0xff
485 for (byte
= 0; byte
< 16; byte
++) {
488 for (bits
= 0; bits
< (sizeof (bitmasks
) / sizeof (bitmasks
[0])); bits
++) {
489 if (mask
[byte
] == bitmasks
[bits
]) {
495 if (mask
[byte
] != 0xff)
503 * Routine to print out information for text-based protocols such as FTP,
504 * HTTP, SMTP, RTSP, SIP, ....
506 #define MAX_TOKEN 128
509 * Fetch a token from a packet, starting at the specified index,
510 * and return the length of the token.
512 * Returns 0 on error; yes, this is indistinguishable from an empty
513 * token, but an "empty token" isn't a valid token - it just means
514 * either a space character at the beginning of the line (this
515 * includes a blank line) or no more tokens remaining on the line.
518 fetch_token(netdissect_options
*ndo
, const u_char
*pptr
, u_int idx
, u_int len
,
519 u_char
*tbuf
, size_t tbuflen
)
523 for (; idx
< len
; idx
++) {
524 if (!ND_TTEST(*(pptr
+ idx
))) {
525 /* ran past end of captured data */
528 if (!isascii(*(pptr
+ idx
))) {
529 /* not an ASCII character */
532 if (isspace(*(pptr
+ idx
))) {
536 if (!isprint(*(pptr
+ idx
))) {
537 /* not part of a command token or response code */
540 if (toklen
+ 2 > tbuflen
) {
541 /* no room for this character and terminating '\0' */
544 tbuf
[toklen
] = *(pptr
+ idx
);
554 * Skip past any white space after the token, until we see
555 * an end-of-line (CR or LF).
557 for (; idx
< len
; idx
++) {
558 if (!ND_TTEST(*(pptr
+ idx
))) {
559 /* ran past end of captured data */
562 if (*(pptr
+ idx
) == '\r' || *(pptr
+ idx
) == '\n') {
566 if (!isascii(*(pptr
+ idx
)) || !isprint(*(pptr
+ idx
))) {
567 /* not a printable ASCII character */
570 if (!isspace(*(pptr
+ idx
))) {
571 /* beginning of next token */
579 * Scan a buffer looking for a line ending - LF or CR-LF.
580 * Return the index of the character after the line ending or 0 if
581 * we encounter a non-ASCII or non-printable character or don't find
585 print_txt_line(netdissect_options
*ndo
, const char *protoname
,
586 const char *prefix
, const u_char
*pptr
, u_int idx
, u_int len
)
593 ND_TCHECK(*(pptr
+idx
));
594 if (*(pptr
+idx
) == '\n') {
596 * LF without CR; end of line.
597 * Skip the LF and print the line, with the
598 * exception of the LF.
600 linelen
= idx
- startidx
;
603 } else if (*(pptr
+idx
) == '\r') {
605 if ((idx
+1) >= len
) {
606 /* not in this packet */
609 ND_TCHECK(*(pptr
+idx
+1));
610 if (*(pptr
+idx
+1) == '\n') {
612 * CR-LF; end of line.
613 * Skip the CR-LF and print the line, with
614 * the exception of the CR-LF.
616 linelen
= idx
- startidx
;
622 * CR followed by something else; treat this
623 * as if it were binary data, and don't print
627 } else if (!isascii(*(pptr
+idx
)) ||
628 (!isprint(*(pptr
+idx
)) && *(pptr
+idx
) != '\t')) {
630 * Not a printable ASCII character and not a tab;
631 * treat this as if it were binary data, and
640 * All printable ASCII, but no line ending after that point
641 * in the buffer; treat this as if it were truncated.
644 linelen
= idx
- startidx
;
645 ND_PRINT((ndo
, "%s%.*s[!%s]", prefix
, (int)linelen
, pptr
+ startidx
,
650 ND_PRINT((ndo
, "%s%.*s", prefix
, (int)linelen
, pptr
+ startidx
));
655 txtproto_print(netdissect_options
*ndo
, const u_char
*pptr
, u_int len
,
656 const char *protoname
, const char **cmds
, u_int flags
)
659 u_char token
[MAX_TOKEN
+1];
666 * This protocol has more than just request and
667 * response lines; see whether this looks like a
668 * request or response.
670 idx
= fetch_token(ndo
, pptr
, 0, len
, token
, sizeof(token
));
672 /* Is this a valid request name? */
673 while ((cmd
= *cmds
++) != NULL
) {
674 if (ascii_strcasecmp((const char *)token
, cmd
) == 0) {
682 * No - is this a valid response code (3 digits)?
684 * Is this token the response code, or is the next
685 * token the response code?
687 if (flags
& RESP_CODE_SECOND_TOKEN
) {
689 * Next token - get it.
691 idx
= fetch_token(ndo
, pptr
, idx
, len
, token
,
695 if (isdigit(token
[0]) && isdigit(token
[1]) &&
696 isdigit(token
[2]) && token
[3] == '\0') {
704 * This protocol has only request and response lines
705 * (e.g., FTP, where all the data goes over a
706 * different connection); assume the payload is
707 * a request or response.
712 /* Capitalize the protocol name */
713 for (pnp
= protoname
; *pnp
!= '\0'; pnp
++)
714 ND_PRINT((ndo
, "%c", toupper(*pnp
)));
718 * In non-verbose mode, just print the protocol, followed
719 * by the first line as the request or response info.
721 * In verbose mode, print lines as text until we run out
722 * of characters or see something that's not a
723 * printable-ASCII line.
725 if (ndo
->ndo_vflag
) {
727 * We're going to print all the text lines in the
728 * request or response; just print the length
729 * on the first line of the output.
731 ND_PRINT((ndo
, ", length: %u", len
));
733 idx
< len
&& (eol
= print_txt_line(ndo
, protoname
, "\n\t", pptr
, idx
, len
)) != 0;
738 * Just print the first text line.
740 print_txt_line(ndo
, protoname
, ": ", pptr
, 0, len
);
746 safeputs(netdissect_options
*ndo
,
747 const u_char
*s
, const u_int maxlen
)
751 while (*s
&& idx
< maxlen
) {
752 safeputchar(ndo
, *s
);
759 safeputchar(netdissect_options
*ndo
,
762 ND_PRINT((ndo
, (c
< 0x80 && ND_ISPRINT(c
)) ? "%c" : "\\0x%02x", c
));
767 * Some compilers try to optimize memcpy(), using the alignment constraint
768 * on the argument pointer type. by using this function, we try to avoid the
772 unaligned_memcpy(void *p
, const void *q
, size_t l
)
777 /* As with memcpy(), so with memcmp(). */
779 unaligned_memcmp(const void *p
, const void *q
, size_t l
)
781 return (memcmp(p
, q
, l
));