2 * Copyright (c) 1990, 1991, 1993, 1994, 1995, 1996, 1997
3 * The Regents of the University of California. All rights reserved.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
23 * txtproto_print() derived from original code by Hannes Gredler
24 * (hannes@gredler.at):
26 * Redistribution and use in source and binary forms, with or without
27 * modification, are permitted provided that: (1) source code
28 * distributions retain the above copyright notice and this paragraph
29 * in its entirety, and (2) distributions including binary code include
30 * the above copyright notice and this paragraph in its entirety in
31 * the documentation or other materials provided with the distribution.
32 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND
33 * WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, WITHOUT
34 * LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
35 * FOR A PARTICULAR PURPOSE.
42 #include <netdissect-stdinc.h>
55 #include "netdissect.h"
56 #include "ascii_strcasecmp.h"
57 #include "timeval-operations.h"
59 int32_t thiszone
; /* seconds offset from gmt to local time */
60 /* invalid string to print '(invalid)' for malformed or corrupted packets */
61 const char istr
[] = " (invalid)";
64 * timestamp display buffer size, the biggest size of both formats is needed
65 * sizeof("0000000000.000000000") > sizeof("00:00:00.000000000")
67 #define TS_BUF_SIZE sizeof("0000000000.000000000")
69 #define TOKBUFSIZE 128
72 * Print out a character, filtering out the non-printable ones
75 fn_print_char(netdissect_options
*ndo
, u_char c
)
79 ND_PRINT((ndo
, "M-"));
82 c
^= 0x40; /* DEL to ?, others to alpha */
85 ND_PRINT((ndo
, "%c", c
));
89 * Print out a null-terminated filename (or other ASCII string).
90 * If ep is NULL, assume no truncation check is needed.
91 * Return true if truncated.
92 * Stop at ep (if given) or before the null char, whichever is first.
95 fn_print(netdissect_options
*ndo
,
96 register const u_char
*s
, register const u_char
*ep
)
101 ret
= 1; /* assume truncated */
102 while (ep
== NULL
|| s
< ep
) {
108 if (!ND_ISASCII(c
)) {
110 ND_PRINT((ndo
, "M-"));
112 if (!ND_ISPRINT(c
)) {
113 c
^= 0x40; /* DEL to ?, others to alpha */
114 ND_PRINT((ndo
, "^"));
116 ND_PRINT((ndo
, "%c", c
));
122 * Print out a null-terminated filename (or other ASCII string) from
123 * a fixed-length buffer.
124 * If ep is NULL, assume no truncation check is needed.
125 * Return the number of bytes of string processed, including the
126 * terminating null, if not truncated. Return 0 if truncated.
129 fn_printztn(netdissect_options
*ndo
,
130 register const u_char
*s
, register u_int n
, register const u_char
*ep
)
132 register u_int bytes
;
137 if (n
== 0 || (ep
!= NULL
&& s
>= ep
)) {
139 * Truncated. This includes "no null before we
140 * got to the end of the fixed-length buffer".
142 * XXX - BOOTP says "null-terminated", which
143 * means the maximum length of the string, in
144 * bytes, is 1 less than the size of the buffer,
145 * as there must always be a terminating null.
158 if (!ND_ISASCII(c
)) {
160 ND_PRINT((ndo
, "M-"));
162 if (!ND_ISPRINT(c
)) {
163 c
^= 0x40; /* DEL to ?, others to alpha */
164 ND_PRINT((ndo
, "^"));
166 ND_PRINT((ndo
, "%c", c
));
172 * Print out a counted filename (or other ASCII string).
173 * If ep is NULL, assume no truncation check is needed.
174 * Return true if truncated.
175 * Stop at ep (if given) or after n bytes, whichever is first.
178 fn_printn(netdissect_options
*ndo
,
179 register const u_char
*s
, register u_int n
, register const u_char
*ep
)
183 while (n
> 0 && (ep
== NULL
|| s
< ep
)) {
186 if (!ND_ISASCII(c
)) {
188 ND_PRINT((ndo
, "M-"));
190 if (!ND_ISPRINT(c
)) {
191 c
^= 0x40; /* DEL to ?, others to alpha */
192 ND_PRINT((ndo
, "^"));
194 ND_PRINT((ndo
, "%c", c
));
196 return (n
== 0) ? 0 : 1;
200 * Print out a null-padded filename (or other ASCII string).
201 * If ep is NULL, assume no truncation check is needed.
202 * Return true if truncated.
203 * Stop at ep (if given) or after n bytes or before the null char,
204 * whichever is first.
207 fn_printzp(netdissect_options
*ndo
,
208 register const u_char
*s
, register u_int n
,
209 register const u_char
*ep
)
214 ret
= 1; /* assume truncated */
215 while (n
> 0 && (ep
== NULL
|| s
< ep
)) {
222 if (!ND_ISASCII(c
)) {
224 ND_PRINT((ndo
, "M-"));
226 if (!ND_ISPRINT(c
)) {
227 c
^= 0x40; /* DEL to ?, others to alpha */
228 ND_PRINT((ndo
, "^"));
230 ND_PRINT((ndo
, "%c", c
));
232 return (n
== 0) ? 0 : ret
;
236 * Format the timestamp
239 ts_format(netdissect_options
*ndo
240 #ifndef HAVE_PCAP_SET_TSTAMP_PRECISION
243 , int sec
, int usec
, char *buf
)
247 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
248 switch (ndo
->ndo_tstamp_precision
) {
250 case PCAP_TSTAMP_PRECISION_MICRO
:
251 format
= "%02d:%02d:%02d.%06u";
254 case PCAP_TSTAMP_PRECISION_NANO
:
255 format
= "%02d:%02d:%02d.%09u";
259 format
= "%02d:%02d:%02d.{unknown}";
263 format
= "%02d:%02d:%02d.%06u";
266 snprintf(buf
, TS_BUF_SIZE
, format
,
267 sec
/ 3600, (sec
% 3600) / 60, sec
% 60, usec
);
273 * Format the timestamp - Unix timeval style
276 ts_unix_format(netdissect_options
*ndo
277 #ifndef HAVE_PCAP_SET_TSTAMP_PRECISION
280 , int sec
, int usec
, char *buf
)
284 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
285 switch (ndo
->ndo_tstamp_precision
) {
287 case PCAP_TSTAMP_PRECISION_MICRO
:
291 case PCAP_TSTAMP_PRECISION_NANO
:
296 format
= "%u.{unknown}";
303 snprintf(buf
, TS_BUF_SIZE
, format
,
304 (unsigned)sec
, (unsigned)usec
);
310 * Print the timestamp
313 ts_print(netdissect_options
*ndo
,
314 register const struct timeval
*tvp
)
319 char buf
[TS_BUF_SIZE
];
320 static struct timeval tv_ref
;
321 struct timeval tv_result
;
325 switch (ndo
->ndo_tflag
) {
327 case 0: /* Default */
328 s
= (tvp
->tv_sec
+ thiszone
) % 86400;
329 ND_PRINT((ndo
, "%s ", ts_format(ndo
, s
, tvp
->tv_usec
, buf
)));
332 case 1: /* No time stamp */
335 case 2: /* Unix timeval style */
336 ND_PRINT((ndo
, "%s ", ts_unix_format(ndo
,
337 tvp
->tv_sec
, tvp
->tv_usec
, buf
)));
340 case 3: /* Microseconds/nanoseconds since previous packet */
341 case 5: /* Microseconds/nanoseconds since first packet */
342 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
343 switch (ndo
->ndo_tstamp_precision
) {
344 case PCAP_TSTAMP_PRECISION_MICRO
:
347 case PCAP_TSTAMP_PRECISION_NANO
:
357 if (!(netdissect_timevalisset(&tv_ref
)))
358 tv_ref
= *tvp
; /* set timestamp for first packet */
360 negative_offset
= netdissect_timevalcmp(tvp
, &tv_ref
, <);
362 netdissect_timevalsub(&tv_ref
, tvp
, &tv_result
, nano_prec
);
364 netdissect_timevalsub(tvp
, &tv_ref
, &tv_result
, nano_prec
);
366 ND_PRINT((ndo
, (negative_offset
? "-" : " ")));
368 ND_PRINT((ndo
, "%s ", ts_format(ndo
,
369 tv_result
.tv_sec
, tv_result
.tv_usec
, buf
)));
371 if (ndo
->ndo_tflag
== 3)
372 tv_ref
= *tvp
; /* set timestamp for previous packet */
375 case 4: /* Default + Date */
376 s
= (tvp
->tv_sec
+ thiszone
) % 86400;
377 Time
= (tvp
->tv_sec
+ thiszone
) - s
;
380 ND_PRINT((ndo
, "Date fail "));
382 ND_PRINT((ndo
, "%04d-%02d-%02d %s ",
383 tm
->tm_year
+1900, tm
->tm_mon
+1, tm
->tm_mday
,
384 ts_format(ndo
, s
, tvp
->tv_usec
, buf
)));
390 * Print an unsigned relative number of seconds (e.g. hold time, prune timer)
391 * in the form 5m1s. This does no truncation, so 32230861 seconds
392 * is represented as 1y1w1d1h1m1s.
395 unsigned_relts_print(netdissect_options
*ndo
,
398 static const char *lengths
[] = {"y", "w", "d", "h", "m", "s"};
399 static const u_int seconds
[] = {31536000, 604800, 86400, 3600, 60, 1};
400 const char **l
= lengths
;
401 const u_int
*s
= seconds
;
404 ND_PRINT((ndo
, "0s"));
409 ND_PRINT((ndo
, "%d%s", secs
/ *s
, *l
));
410 secs
-= (secs
/ *s
) * *s
;
418 * Print a signed relative number of seconds (e.g. hold time, prune timer)
419 * in the form 5m1s. This does no truncation, so 32230861 seconds
420 * is represented as 1y1w1d1h1m1s.
423 signed_relts_print(netdissect_options
*ndo
,
427 ND_PRINT((ndo
, "-"));
428 if (secs
== INT32_MIN
) {
430 * -2^31; you can't fit its absolute value into
431 * a 32-bit signed integer.
433 * Just directly pass said absolute value to
434 * unsigned_relts_print() directly.
436 * (XXX - does ISO C guarantee that -(-2^n),
437 * when calculated and cast to an n-bit unsigned
438 * integer type, will have the value 2^n?)
440 unsigned_relts_print(ndo
, 2147483648U);
443 * We now know -secs will fit into an int32_t;
444 * negate it and pass that to unsigned_relts_print().
446 unsigned_relts_print(ndo
, -secs
);
450 unsigned_relts_print(ndo
, secs
);
454 * this is a generic routine for printing unknown data;
455 * we pass on the linefeed plus indentation string to
456 * get a proper output - returns 0 on error
460 print_unknown_data(netdissect_options
*ndo
, const u_char
*cp
,const char *ident
,int len
)
463 ND_PRINT((ndo
,"%sDissector error: print_unknown_data called with negative length",
467 if (ndo
->ndo_snapend
- cp
< len
)
468 len
= ndo
->ndo_snapend
- cp
;
470 ND_PRINT((ndo
,"%sDissector error: print_unknown_data called with pointer past end of packet",
474 hex_print(ndo
, ident
,cp
,len
);
475 return(1); /* everything is ok */
479 * Convert a token value to a string; use "fmt" if not found.
482 tok2strbuf(register const struct tok
*lp
, register const char *fmt
,
483 register u_int v
, char *buf
, size_t bufsize
)
486 while (lp
->s
!= NULL
) {
495 (void)snprintf(buf
, bufsize
, fmt
, v
);
496 return (const char *)buf
;
500 * Convert a token value to a string; use "fmt" if not found.
501 * Uses tok2strbuf() on one of four local static buffers of size TOKBUFSIZE
502 * in round-robin fashion.
505 tok2str(register const struct tok
*lp
, register const char *fmt
,
508 static char buf
[4][TOKBUFSIZE
];
514 return tok2strbuf(lp
, fmt
, v
, ret
, sizeof(buf
[0]));
518 * Convert a bit token value to a string; use "fmt" if not found.
519 * this is useful for parsing bitfields, the output strings are seperated
520 * if the s field is positive.
523 bittok2str_internal(register const struct tok
*lp
, register const char *fmt
,
524 register u_int v
, const char *sep
)
526 static char buf
[256]; /* our stringbuffer */
528 register u_int rotbit
; /* this is the bit we rotate through all bitpositions */
529 register u_int tokval
;
530 const char * sepstr
= "";
532 while (lp
!= NULL
&& lp
->s
!= NULL
) {
533 tokval
=lp
->v
; /* load our first value */
535 while (rotbit
!= 0) {
537 * lets AND the rotating bit with our token value
538 * and see if we have got a match
540 if (tokval
== (v
&rotbit
)) {
541 /* ok we have found something */
542 buflen
+=snprintf(buf
+buflen
, sizeof(buf
)-buflen
, "%s%s",
547 rotbit
=rotbit
<<1; /* no match - lets shift and try again */
553 /* bummer - lets print the "unknown" message as advised in the fmt string if we got one */
554 (void)snprintf(buf
, sizeof(buf
), fmt
== NULL
? "#%08x" : fmt
, v
);
559 * Convert a bit token value to a string; use "fmt" if not found.
560 * this is useful for parsing bitfields, the output strings are not seperated.
563 bittok2str_nosep(register const struct tok
*lp
, register const char *fmt
,
566 return (bittok2str_internal(lp
, fmt
, v
, ""));
570 * Convert a bit token value to a string; use "fmt" if not found.
571 * this is useful for parsing bitfields, the output strings are comma seperated.
574 bittok2str(register const struct tok
*lp
, register const char *fmt
,
577 return (bittok2str_internal(lp
, fmt
, v
, ", "));
581 * Convert a value to a string using an array; the macro
582 * tok2strary() in <netdissect.h> is the public interface to
583 * this function and ensures that the second argument is
584 * correct for bounds-checking.
587 tok2strary_internal(register const char **lp
, int n
, register const char *fmt
,
590 static char buf
[TOKBUFSIZE
];
592 if (v
>= 0 && v
< n
&& lp
[v
] != NULL
)
596 (void)snprintf(buf
, sizeof(buf
), fmt
, v
);
601 * Convert a 32-bit netmask to prefixlen if possible
602 * the function returns the prefix-len; if plen == -1
603 * then conversion was not possible;
607 mask2plen(uint32_t mask
)
609 uint32_t bitmasks
[33] = {
611 0x80000000, 0xc0000000, 0xe0000000, 0xf0000000,
612 0xf8000000, 0xfc000000, 0xfe000000, 0xff000000,
613 0xff800000, 0xffc00000, 0xffe00000, 0xfff00000,
614 0xfff80000, 0xfffc0000, 0xfffe0000, 0xffff0000,
615 0xffff8000, 0xffffc000, 0xffffe000, 0xfffff000,
616 0xfffff800, 0xfffffc00, 0xfffffe00, 0xffffff00,
617 0xffffff80, 0xffffffc0, 0xffffffe0, 0xfffffff0,
618 0xfffffff8, 0xfffffffc, 0xfffffffe, 0xffffffff
622 /* let's see if we can transform the mask into a prefixlen */
623 while (prefix_len
>= 0) {
624 if (bitmasks
[prefix_len
] == mask
)
632 mask62plen(const u_char
*mask
)
634 u_char bitmasks
[9] = {
636 0x80, 0xc0, 0xe0, 0xf0,
637 0xf8, 0xfc, 0xfe, 0xff
642 for (byte
= 0; byte
< 16; byte
++) {
645 for (bits
= 0; bits
< (sizeof (bitmasks
) / sizeof (bitmasks
[0])); bits
++) {
646 if (mask
[byte
] == bitmasks
[bits
]) {
652 if (mask
[byte
] != 0xff)
659 * Routine to print out information for text-based protocols such as FTP,
660 * HTTP, SMTP, RTSP, SIP, ....
662 #define MAX_TOKEN 128
665 * Fetch a token from a packet, starting at the specified index,
666 * and return the length of the token.
668 * Returns 0 on error; yes, this is indistinguishable from an empty
669 * token, but an "empty token" isn't a valid token - it just means
670 * either a space character at the beginning of the line (this
671 * includes a blank line) or no more tokens remaining on the line.
674 fetch_token(netdissect_options
*ndo
, const u_char
*pptr
, u_int idx
, u_int len
,
675 u_char
*tbuf
, size_t tbuflen
)
679 for (; idx
< len
; idx
++) {
680 if (!ND_TTEST(*(pptr
+ idx
))) {
681 /* ran past end of captured data */
684 if (!isascii(*(pptr
+ idx
))) {
685 /* not an ASCII character */
688 if (isspace(*(pptr
+ idx
))) {
692 if (!isprint(*(pptr
+ idx
))) {
693 /* not part of a command token or response code */
696 if (toklen
+ 2 > tbuflen
) {
697 /* no room for this character and terminating '\0' */
700 tbuf
[toklen
] = *(pptr
+ idx
);
710 * Skip past any white space after the token, until we see
711 * an end-of-line (CR or LF).
713 for (; idx
< len
; idx
++) {
714 if (!ND_TTEST(*(pptr
+ idx
))) {
715 /* ran past end of captured data */
718 if (*(pptr
+ idx
) == '\r' || *(pptr
+ idx
) == '\n') {
722 if (!isascii(*(pptr
+ idx
)) || !isprint(*(pptr
+ idx
))) {
723 /* not a printable ASCII character */
726 if (!isspace(*(pptr
+ idx
))) {
727 /* beginning of next token */
735 * Scan a buffer looking for a line ending - LF or CR-LF.
736 * Return the index of the character after the line ending or 0 if
737 * we encounter a non-ASCII or non-printable character or don't find
741 print_txt_line(netdissect_options
*ndo
, const char *protoname
,
742 const char *prefix
, const u_char
*pptr
, u_int idx
, u_int len
)
749 ND_TCHECK(*(pptr
+idx
));
750 if (*(pptr
+idx
) == '\n') {
752 * LF without CR; end of line.
753 * Skip the LF and print the line, with the
754 * exception of the LF.
756 linelen
= idx
- startidx
;
759 } else if (*(pptr
+idx
) == '\r') {
761 if ((idx
+1) >= len
) {
762 /* not in this packet */
765 ND_TCHECK(*(pptr
+idx
+1));
766 if (*(pptr
+idx
+1) == '\n') {
768 * CR-LF; end of line.
769 * Skip the CR-LF and print the line, with
770 * the exception of the CR-LF.
772 linelen
= idx
- startidx
;
778 * CR followed by something else; treat this
779 * as if it were binary data, and don't print
783 } else if (!isascii(*(pptr
+idx
)) ||
784 (!isprint(*(pptr
+idx
)) && *(pptr
+idx
) != '\t')) {
786 * Not a printable ASCII character and not a tab;
787 * treat this as if it were binary data, and
796 * All printable ASCII, but no line ending after that point
797 * in the buffer; treat this as if it were truncated.
800 linelen
= idx
- startidx
;
801 ND_PRINT((ndo
, "%s%.*s[!%s]", prefix
, (int)linelen
, pptr
+ startidx
,
806 ND_PRINT((ndo
, "%s%.*s", prefix
, (int)linelen
, pptr
+ startidx
));
811 txtproto_print(netdissect_options
*ndo
, const u_char
*pptr
, u_int len
,
812 const char *protoname
, const char **cmds
, u_int flags
)
815 u_char token
[MAX_TOKEN
+1];
822 * This protocol has more than just request and
823 * response lines; see whether this looks like a
824 * request or response.
826 idx
= fetch_token(ndo
, pptr
, 0, len
, token
, sizeof(token
));
828 /* Is this a valid request name? */
829 while ((cmd
= *cmds
++) != NULL
) {
830 if (ascii_strcasecmp((const char *)token
, cmd
) == 0) {
838 * No - is this a valid response code (3 digits)?
840 * Is this token the response code, or is the next
841 * token the response code?
843 if (flags
& RESP_CODE_SECOND_TOKEN
) {
845 * Next token - get it.
847 idx
= fetch_token(ndo
, pptr
, idx
, len
, token
,
851 if (isdigit(token
[0]) && isdigit(token
[1]) &&
852 isdigit(token
[2]) && token
[3] == '\0') {
860 * This protocol has only request and response lines
861 * (e.g., FTP, where all the data goes over a
862 * different connection); assume the payload is
863 * a request or response.
868 /* Capitalize the protocol name */
869 for (pnp
= protoname
; *pnp
!= '\0'; pnp
++)
870 ND_PRINT((ndo
, "%c", toupper((u_char
)*pnp
)));
874 * In non-verbose mode, just print the protocol, followed
875 * by the first line as the request or response info.
877 * In verbose mode, print lines as text until we run out
878 * of characters or see something that's not a
879 * printable-ASCII line.
881 if (ndo
->ndo_vflag
) {
883 * We're going to print all the text lines in the
884 * request or response; just print the length
885 * on the first line of the output.
887 ND_PRINT((ndo
, ", length: %u", len
));
889 idx
< len
&& (eol
= print_txt_line(ndo
, protoname
, "\n\t", pptr
, idx
, len
)) != 0;
894 * Just print the first text line.
896 print_txt_line(ndo
, protoname
, ": ", pptr
, 0, len
);
902 safeputs(netdissect_options
*ndo
,
903 const u_char
*s
, const u_int maxlen
)
907 while (*s
&& idx
< maxlen
) {
908 safeputchar(ndo
, *s
);
915 safeputchar(netdissect_options
*ndo
,
918 ND_PRINT((ndo
, (c
< 0x80 && ND_ISPRINT(c
)) ? "%c" : "\\0x%02x", c
));
923 * Some compilers try to optimize memcpy(), using the alignment constraint
924 * on the argument pointer type. by using this function, we try to avoid the
928 unaligned_memcpy(void *p
, const void *q
, size_t l
)
933 /* As with memcpy(), so with memcmp(). */
935 unaligned_memcmp(const void *p
, const void *q
, size_t l
)
937 return (memcmp(p
, q
, l
));