2 * Copyright (c) 1990, 1991, 1993, 1994, 1995, 1996, 1997
3 * The Regents of the University of California. All rights reserved.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
23 * txtproto_print() derived from original code by Hannes Gredler
24 * (hannes@juniper.net):
26 * Redistribution and use in source and binary forms, with or without
27 * modification, are permitted provided that: (1) source code
28 * distributions retain the above copyright notice and this paragraph
29 * in its entirety, and (2) distributions including binary code include
30 * the above copyright notice and this paragraph in its entirety in
31 * the documentation or other materials provided with the distribution.
32 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND
33 * WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, WITHOUT
34 * LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
35 * FOR A PARTICULAR PURPOSE.
42 #include <netdissect-stdinc.h>
55 #include "netdissect.h"
56 #include "ascii_strcasecmp.h"
57 #include "timeval-operations.h"
59 int32_t thiszone
; /* seconds offset from gmt to local time */
60 /* invalid string to print '(invalid)' for malformed or corrupted packets */
61 const char istr
[] = " (invalid)";
64 * timestamp display buffer size, the biggest size of both formats is needed
65 * sizeof("0000000000.000000000") > sizeof("00:00:00.000000000")
67 #define TS_BUF_SIZE sizeof("0000000000.000000000")
69 #define TOKBUFSIZE 128
72 * Print out a character, filtering out the non-printable ones
75 fn_print_char(netdissect_options
*ndo
, u_char c
)
79 ND_PRINT((ndo
, "M-"));
82 c
^= 0x40; /* DEL to ?, others to alpha */
85 ND_PRINT((ndo
, "%c", c
));
89 * Print out a null-terminated filename (or other ascii string).
90 * If ep is NULL, assume no truncation check is needed.
91 * Return true if truncated.
92 * Stop at ep (if given) or before the null char, whichever is first.
95 fn_print(netdissect_options
*ndo
,
96 register const u_char
*s
, register const u_char
*ep
)
101 ret
= 1; /* assume truncated */
102 while (ep
== NULL
|| s
< ep
) {
108 if (!ND_ISASCII(c
)) {
110 ND_PRINT((ndo
, "M-"));
112 if (!ND_ISPRINT(c
)) {
113 c
^= 0x40; /* DEL to ?, others to alpha */
114 ND_PRINT((ndo
, "^"));
116 ND_PRINT((ndo
, "%c", c
));
122 * Print out a counted filename (or other ascii string).
123 * If ep is NULL, assume no truncation check is needed.
124 * Return true if truncated.
125 * Stop at ep (if given) or after n bytes, whichever is first.
128 fn_printn(netdissect_options
*ndo
,
129 register const u_char
*s
, register u_int n
, register const u_char
*ep
)
133 while (n
> 0 && (ep
== NULL
|| s
< ep
)) {
136 if (!ND_ISASCII(c
)) {
138 ND_PRINT((ndo
, "M-"));
140 if (!ND_ISPRINT(c
)) {
141 c
^= 0x40; /* DEL to ?, others to alpha */
142 ND_PRINT((ndo
, "^"));
144 ND_PRINT((ndo
, "%c", c
));
146 return (n
== 0) ? 0 : 1;
150 * Print out a null-padded filename (or other ascii string).
151 * If ep is NULL, assume no truncation check is needed.
152 * Return true if truncated.
153 * Stop at ep (if given) or after n bytes or before the null char,
154 * whichever is first.
157 fn_printzp(netdissect_options
*ndo
,
158 register const u_char
*s
, register u_int n
,
159 register const u_char
*ep
)
164 ret
= 1; /* assume truncated */
165 while (n
> 0 && (ep
== NULL
|| s
< ep
)) {
172 if (!ND_ISASCII(c
)) {
174 ND_PRINT((ndo
, "M-"));
176 if (!ND_ISPRINT(c
)) {
177 c
^= 0x40; /* DEL to ?, others to alpha */
178 ND_PRINT((ndo
, "^"));
180 ND_PRINT((ndo
, "%c", c
));
182 return (n
== 0) ? 0 : ret
;
186 * Format the timestamp
189 ts_format(netdissect_options
*ndo
190 #ifndef HAVE_PCAP_SET_TSTAMP_PRECISION
193 , int sec
, int usec
, char *buf
)
197 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
198 switch (ndo
->ndo_tstamp_precision
) {
200 case PCAP_TSTAMP_PRECISION_MICRO
:
201 format
= "%02d:%02d:%02d.%06u";
204 case PCAP_TSTAMP_PRECISION_NANO
:
205 format
= "%02d:%02d:%02d.%09u";
209 format
= "%02d:%02d:%02d.{unknown}";
213 format
= "%02d:%02d:%02d.%06u";
216 snprintf(buf
, TS_BUF_SIZE
, format
,
217 sec
/ 3600, (sec
% 3600) / 60, sec
% 60, usec
);
223 * Format the timestamp - Unix timeval style
226 ts_unix_format(netdissect_options
*ndo
227 #ifndef HAVE_PCAP_SET_TSTAMP_PRECISION
230 , int sec
, int usec
, char *buf
)
234 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
235 switch (ndo
->ndo_tstamp_precision
) {
237 case PCAP_TSTAMP_PRECISION_MICRO
:
241 case PCAP_TSTAMP_PRECISION_NANO
:
246 format
= "%u.{unknown}";
253 snprintf(buf
, TS_BUF_SIZE
, format
,
254 (unsigned)sec
, (unsigned)usec
);
260 * Print the timestamp
263 ts_print(netdissect_options
*ndo
,
264 register const struct timeval
*tvp
)
269 char buf
[TS_BUF_SIZE
];
270 static struct timeval tv_ref
;
271 struct timeval tv_result
;
275 switch (ndo
->ndo_tflag
) {
277 case 0: /* Default */
278 s
= (tvp
->tv_sec
+ thiszone
) % 86400;
279 ND_PRINT((ndo
, "%s ", ts_format(ndo
, s
, tvp
->tv_usec
, buf
)));
282 case 1: /* No time stamp */
285 case 2: /* Unix timeval style */
286 ND_PRINT((ndo
, "%s ", ts_unix_format(ndo
,
287 tvp
->tv_sec
, tvp
->tv_usec
, buf
)));
290 case 3: /* Microseconds/nanoseconds since previous packet */
291 case 5: /* Microseconds/nanoseconds since first packet */
292 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
293 switch (ndo
->ndo_tstamp_precision
) {
294 case PCAP_TSTAMP_PRECISION_MICRO
:
297 case PCAP_TSTAMP_PRECISION_NANO
:
307 if (!(netdissect_timevalisset(&tv_ref
)))
308 tv_ref
= *tvp
; /* set timestamp for first packet */
310 negative_offset
= netdissect_timevalcmp(tvp
, &tv_ref
, <);
312 netdissect_timevalsub(&tv_ref
, tvp
, &tv_result
, nano_prec
);
314 netdissect_timevalsub(tvp
, &tv_ref
, &tv_result
, nano_prec
);
316 ND_PRINT((ndo
, (negative_offset
? "-" : " ")));
318 ND_PRINT((ndo
, "%s ", ts_format(ndo
,
319 tv_result
.tv_sec
, tv_result
.tv_usec
, buf
)));
321 if (ndo
->ndo_tflag
== 3)
322 tv_ref
= *tvp
; /* set timestamp for previous packet */
325 case 4: /* Default + Date */
326 s
= (tvp
->tv_sec
+ thiszone
) % 86400;
327 Time
= (tvp
->tv_sec
+ thiszone
) - s
;
330 ND_PRINT((ndo
, "Date fail "));
332 ND_PRINT((ndo
, "%04d-%02d-%02d %s ",
333 tm
->tm_year
+1900, tm
->tm_mon
+1, tm
->tm_mday
,
334 ts_format(ndo
, s
, tvp
->tv_usec
, buf
)));
340 * Print a relative number of seconds (e.g. hold time, prune timer)
341 * in the form 5m1s. This does no truncation, so 32230861 seconds
342 * is represented as 1y1w1d1h1m1s.
345 relts_print(netdissect_options
*ndo
,
348 static const char *lengths
[] = {"y", "w", "d", "h", "m", "s"};
349 static const int seconds
[] = {31536000, 604800, 86400, 3600, 60, 1};
350 const char **l
= lengths
;
351 const int *s
= seconds
;
354 ND_PRINT((ndo
, "0s"));
358 ND_PRINT((ndo
, "-"));
363 ND_PRINT((ndo
, "%d%s", secs
/ *s
, *l
));
364 secs
-= (secs
/ *s
) * *s
;
372 * this is a generic routine for printing unknown data;
373 * we pass on the linefeed plus indentation string to
374 * get a proper output - returns 0 on error
378 print_unknown_data(netdissect_options
*ndo
, const u_char
*cp
,const char *ident
,int len
)
381 ND_PRINT((ndo
,"%sDissector error: print_unknown_data called with negative length",
385 if (ndo
->ndo_snapend
- cp
< len
)
386 len
= ndo
->ndo_snapend
- cp
;
388 ND_PRINT((ndo
,"%sDissector error: print_unknown_data called with pointer past end of packet",
392 hex_print(ndo
, ident
,cp
,len
);
393 return(1); /* everything is ok */
397 * Convert a token value to a string; use "fmt" if not found.
400 tok2strbuf(register const struct tok
*lp
, register const char *fmt
,
401 register u_int v
, char *buf
, size_t bufsize
)
404 while (lp
->s
!= NULL
) {
413 (void)snprintf(buf
, bufsize
, fmt
, v
);
414 return (const char *)buf
;
418 * Convert a token value to a string; use "fmt" if not found.
421 tok2str(register const struct tok
*lp
, register const char *fmt
,
424 static char buf
[4][TOKBUFSIZE
];
430 return tok2strbuf(lp
, fmt
, v
, ret
, sizeof(buf
[0]));
434 * Convert a bit token value to a string; use "fmt" if not found.
435 * this is useful for parsing bitfields, the output strings are seperated
436 * if the s field is positive.
439 bittok2str_internal(register const struct tok
*lp
, register const char *fmt
,
440 register u_int v
, const char *sep
)
442 static char buf
[256]; /* our stringbuffer */
444 register u_int rotbit
; /* this is the bit we rotate through all bitpositions */
445 register u_int tokval
;
446 const char * sepstr
= "";
448 while (lp
!= NULL
&& lp
->s
!= NULL
) {
449 tokval
=lp
->v
; /* load our first value */
451 while (rotbit
!= 0) {
453 * lets AND the rotating bit with our token value
454 * and see if we have got a match
456 if (tokval
== (v
&rotbit
)) {
457 /* ok we have found something */
458 buflen
+=snprintf(buf
+buflen
, sizeof(buf
)-buflen
, "%s%s",
463 rotbit
=rotbit
<<1; /* no match - lets shift and try again */
469 /* bummer - lets print the "unknown" message as advised in the fmt string if we got one */
470 (void)snprintf(buf
, sizeof(buf
), fmt
== NULL
? "#%08x" : fmt
, v
);
475 * Convert a bit token value to a string; use "fmt" if not found.
476 * this is useful for parsing bitfields, the output strings are not seperated.
479 bittok2str_nosep(register const struct tok
*lp
, register const char *fmt
,
482 return (bittok2str_internal(lp
, fmt
, v
, ""));
486 * Convert a bit token value to a string; use "fmt" if not found.
487 * this is useful for parsing bitfields, the output strings are comma seperated.
490 bittok2str(register const struct tok
*lp
, register const char *fmt
,
493 return (bittok2str_internal(lp
, fmt
, v
, ", "));
497 * Convert a value to a string using an array; the macro
498 * tok2strary() in <netdissect.h> is the public interface to
499 * this function and ensures that the second argument is
500 * correct for bounds-checking.
503 tok2strary_internal(register const char **lp
, int n
, register const char *fmt
,
506 static char buf
[TOKBUFSIZE
];
508 if (v
>= 0 && v
< n
&& lp
[v
] != NULL
)
512 (void)snprintf(buf
, sizeof(buf
), fmt
, v
);
517 * Convert a 32-bit netmask to prefixlen if possible
518 * the function returns the prefix-len; if plen == -1
519 * then conversion was not possible;
523 mask2plen(uint32_t mask
)
525 uint32_t bitmasks
[33] = {
527 0x80000000, 0xc0000000, 0xe0000000, 0xf0000000,
528 0xf8000000, 0xfc000000, 0xfe000000, 0xff000000,
529 0xff800000, 0xffc00000, 0xffe00000, 0xfff00000,
530 0xfff80000, 0xfffc0000, 0xfffe0000, 0xffff0000,
531 0xffff8000, 0xffffc000, 0xffffe000, 0xfffff000,
532 0xfffff800, 0xfffffc00, 0xfffffe00, 0xffffff00,
533 0xffffff80, 0xffffffc0, 0xffffffe0, 0xfffffff0,
534 0xfffffff8, 0xfffffffc, 0xfffffffe, 0xffffffff
538 /* let's see if we can transform the mask into a prefixlen */
539 while (prefix_len
>= 0) {
540 if (bitmasks
[prefix_len
] == mask
)
548 mask62plen(const u_char
*mask
)
550 u_char bitmasks
[9] = {
552 0x80, 0xc0, 0xe0, 0xf0,
553 0xf8, 0xfc, 0xfe, 0xff
558 for (byte
= 0; byte
< 16; byte
++) {
561 for (bits
= 0; bits
< (sizeof (bitmasks
) / sizeof (bitmasks
[0])); bits
++) {
562 if (mask
[byte
] == bitmasks
[bits
]) {
568 if (mask
[byte
] != 0xff)
575 * Routine to print out information for text-based protocols such as FTP,
576 * HTTP, SMTP, RTSP, SIP, ....
578 #define MAX_TOKEN 128
581 * Fetch a token from a packet, starting at the specified index,
582 * and return the length of the token.
584 * Returns 0 on error; yes, this is indistinguishable from an empty
585 * token, but an "empty token" isn't a valid token - it just means
586 * either a space character at the beginning of the line (this
587 * includes a blank line) or no more tokens remaining on the line.
590 fetch_token(netdissect_options
*ndo
, const u_char
*pptr
, u_int idx
, u_int len
,
591 u_char
*tbuf
, size_t tbuflen
)
595 for (; idx
< len
; idx
++) {
596 if (!ND_TTEST(*(pptr
+ idx
))) {
597 /* ran past end of captured data */
600 if (!isascii(*(pptr
+ idx
))) {
601 /* not an ASCII character */
604 if (isspace(*(pptr
+ idx
))) {
608 if (!isprint(*(pptr
+ idx
))) {
609 /* not part of a command token or response code */
612 if (toklen
+ 2 > tbuflen
) {
613 /* no room for this character and terminating '\0' */
616 tbuf
[toklen
] = *(pptr
+ idx
);
626 * Skip past any white space after the token, until we see
627 * an end-of-line (CR or LF).
629 for (; idx
< len
; idx
++) {
630 if (!ND_TTEST(*(pptr
+ idx
))) {
631 /* ran past end of captured data */
634 if (*(pptr
+ idx
) == '\r' || *(pptr
+ idx
) == '\n') {
638 if (!isascii(*(pptr
+ idx
)) || !isprint(*(pptr
+ idx
))) {
639 /* not a printable ASCII character */
642 if (!isspace(*(pptr
+ idx
))) {
643 /* beginning of next token */
651 * Scan a buffer looking for a line ending - LF or CR-LF.
652 * Return the index of the character after the line ending or 0 if
653 * we encounter a non-ASCII or non-printable character or don't find
657 print_txt_line(netdissect_options
*ndo
, const char *protoname
,
658 const char *prefix
, const u_char
*pptr
, u_int idx
, u_int len
)
665 ND_TCHECK(*(pptr
+idx
));
666 if (*(pptr
+idx
) == '\n') {
668 * LF without CR; end of line.
669 * Skip the LF and print the line, with the
670 * exception of the LF.
672 linelen
= idx
- startidx
;
675 } else if (*(pptr
+idx
) == '\r') {
677 if ((idx
+1) >= len
) {
678 /* not in this packet */
681 ND_TCHECK(*(pptr
+idx
+1));
682 if (*(pptr
+idx
+1) == '\n') {
684 * CR-LF; end of line.
685 * Skip the CR-LF and print the line, with
686 * the exception of the CR-LF.
688 linelen
= idx
- startidx
;
694 * CR followed by something else; treat this
695 * as if it were binary data, and don't print
699 } else if (!isascii(*(pptr
+idx
)) ||
700 (!isprint(*(pptr
+idx
)) && *(pptr
+idx
) != '\t')) {
702 * Not a printable ASCII character and not a tab;
703 * treat this as if it were binary data, and
712 * All printable ASCII, but no line ending after that point
713 * in the buffer; treat this as if it were truncated.
716 linelen
= idx
- startidx
;
717 ND_PRINT((ndo
, "%s%.*s[!%s]", prefix
, (int)linelen
, pptr
+ startidx
,
722 ND_PRINT((ndo
, "%s%.*s", prefix
, (int)linelen
, pptr
+ startidx
));
727 txtproto_print(netdissect_options
*ndo
, const u_char
*pptr
, u_int len
,
728 const char *protoname
, const char **cmds
, u_int flags
)
731 u_char token
[MAX_TOKEN
+1];
738 * This protocol has more than just request and
739 * response lines; see whether this looks like a
740 * request or response.
742 idx
= fetch_token(ndo
, pptr
, 0, len
, token
, sizeof(token
));
744 /* Is this a valid request name? */
745 while ((cmd
= *cmds
++) != NULL
) {
746 if (ascii_strcasecmp((const char *)token
, cmd
) == 0) {
754 * No - is this a valid response code (3 digits)?
756 * Is this token the response code, or is the next
757 * token the response code?
759 if (flags
& RESP_CODE_SECOND_TOKEN
) {
761 * Next token - get it.
763 idx
= fetch_token(ndo
, pptr
, idx
, len
, token
,
767 if (isdigit(token
[0]) && isdigit(token
[1]) &&
768 isdigit(token
[2]) && token
[3] == '\0') {
776 * This protocol has only request and response lines
777 * (e.g., FTP, where all the data goes over a
778 * different connection); assume the payload is
779 * a request or response.
784 /* Capitalize the protocol name */
785 for (pnp
= protoname
; *pnp
!= '\0'; pnp
++)
786 ND_PRINT((ndo
, "%c", toupper(*pnp
)));
790 * In non-verbose mode, just print the protocol, followed
791 * by the first line as the request or response info.
793 * In verbose mode, print lines as text until we run out
794 * of characters or see something that's not a
795 * printable-ASCII line.
797 if (ndo
->ndo_vflag
) {
799 * We're going to print all the text lines in the
800 * request or response; just print the length
801 * on the first line of the output.
803 ND_PRINT((ndo
, ", length: %u", len
));
805 idx
< len
&& (eol
= print_txt_line(ndo
, protoname
, "\n\t", pptr
, idx
, len
)) != 0;
810 * Just print the first text line.
812 print_txt_line(ndo
, protoname
, ": ", pptr
, 0, len
);
818 safeputs(netdissect_options
*ndo
,
819 const u_char
*s
, const u_int maxlen
)
823 while (*s
&& idx
< maxlen
) {
824 safeputchar(ndo
, *s
);
831 safeputchar(netdissect_options
*ndo
,
834 ND_PRINT((ndo
, (c
< 0x80 && ND_ISPRINT(c
)) ? "%c" : "\\0x%02x", c
));
839 * Some compilers try to optimize memcpy(), using the alignment constraint
840 * on the argument pointer type. by using this function, we try to avoid the
844 unaligned_memcpy(void *p
, const void *q
, size_t l
)
849 /* As with memcpy(), so with memcmp(). */
851 unaligned_memcmp(const void *p
, const void *q
, size_t l
)
853 return (memcmp(p
, q
, l
));