2 * Copyright (c) 1990, 1991, 1993, 1994, 1995, 1996, 1997
3 * The Regents of the University of California. All rights reserved.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
23 * txtproto_print() derived from original code by Hannes Gredler
24 * (hannes@gredler.at):
26 * Redistribution and use in source and binary forms, with or without
27 * modification, are permitted provided that: (1) source code
28 * distributions retain the above copyright notice and this paragraph
29 * in its entirety, and (2) distributions including binary code include
30 * the above copyright notice and this paragraph in its entirety in
31 * the documentation or other materials provided with the distribution.
32 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND
33 * WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, WITHOUT
34 * LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
35 * FOR A PARTICULAR PURPOSE.
42 #include "netdissect-stdinc.h"
55 #include "netdissect.h"
57 #include "ascii_strcasecmp.h"
58 #include "timeval-operations.h"
60 int32_t thiszone
; /* seconds offset from gmt to local time */
61 /* invalid string to print '(invalid)' for malformed or corrupted packets */
62 const char istr
[] = " (invalid)";
65 * timestamp display buffer size, the biggest size of both formats is needed
66 * sizeof("0000000000.000000000") > sizeof("00:00:00.000000000")
68 #define TS_BUF_SIZE sizeof("0000000000.000000000")
70 #define TOKBUFSIZE 128
73 * Print out a character, filtering out the non-printable ones
76 fn_print_char(netdissect_options
*ndo
, u_char c
)
83 c
^= 0x40; /* DEL to ?, others to alpha */
90 * Print out a null-terminated filename (or other ASCII string).
91 * If ep is NULL, assume no truncation check is needed.
92 * Return true if truncated.
93 * Stop at ep (if given) or before the null char, whichever is first.
96 fn_print(netdissect_options
*ndo
,
97 const u_char
*s
, const u_char
*ep
)
102 ret
= 1; /* assume truncated */
103 while (ep
== NULL
|| s
< ep
) {
110 fn_print_char(ndo
, c
);
116 * Print out a null-terminated filename (or other ASCII string) from
117 * a fixed-length buffer.
118 * If ep is NULL, assume no truncation check is needed.
119 * Return the number of bytes of string processed, including the
120 * terminating null, if not truncated. Return 0 if truncated.
123 fn_printztn(netdissect_options
*ndo
,
124 const u_char
*s
, u_int n
, const u_char
*ep
)
131 if (n
== 0 || (ep
!= NULL
&& s
>= ep
)) {
133 * Truncated. This includes "no null before we
134 * got to the end of the fixed-length buffer".
136 * XXX - BOOTP says "null-terminated", which
137 * means the maximum length of the string, in
138 * bytes, is 1 less than the size of the buffer,
139 * as there must always be a terminating null.
153 fn_print_char(ndo
, c
);
159 * Print out a counted filename (or other ASCII string).
160 * If ep is NULL, assume no truncation check is needed.
161 * Return true if truncated.
162 * Stop at ep (if given) or after n bytes, whichever is first.
165 fn_printn(netdissect_options
*ndo
,
166 const u_char
*s
, u_int n
, const u_char
*ep
)
170 while (n
> 0 && (ep
== NULL
|| s
< ep
)) {
174 fn_print_char(ndo
, c
);
176 return (n
== 0) ? 0 : 1;
180 * Print out a null-padded filename (or other ASCII string).
181 * If ep is NULL, assume no truncation check is needed.
182 * Return true if truncated.
183 * Stop at ep (if given) or after n bytes or before the null char,
184 * whichever is first.
187 fn_printzp(netdissect_options
*ndo
,
188 const u_char
*s
, u_int n
,
194 ret
= 1; /* assume truncated */
195 while (n
> 0 && (ep
== NULL
|| s
< ep
)) {
203 fn_print_char(ndo
, c
);
205 return (n
== 0) ? 0 : ret
;
209 * Format the timestamp
212 ts_format(netdissect_options
*ndo
213 #ifndef HAVE_PCAP_SET_TSTAMP_PRECISION
216 , int sec
, int usec
, char *buf
)
220 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
221 switch (ndo
->ndo_tstamp_precision
) {
223 case PCAP_TSTAMP_PRECISION_MICRO
:
224 format
= "%02d:%02d:%02d.%06u";
227 case PCAP_TSTAMP_PRECISION_NANO
:
228 format
= "%02d:%02d:%02d.%09u";
232 format
= "%02d:%02d:%02d.{unknown}";
236 format
= "%02d:%02d:%02d.%06u";
239 nd_snprintf(buf
, TS_BUF_SIZE
, format
,
240 sec
/ 3600, (sec
% 3600) / 60, sec
% 60, usec
);
246 * Format the timestamp - Unix timeval style
249 ts_unix_format(netdissect_options
*ndo
250 #ifndef HAVE_PCAP_SET_TSTAMP_PRECISION
253 , int sec
, int usec
, char *buf
)
257 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
258 switch (ndo
->ndo_tstamp_precision
) {
260 case PCAP_TSTAMP_PRECISION_MICRO
:
264 case PCAP_TSTAMP_PRECISION_NANO
:
269 format
= "%u.{unknown}";
276 nd_snprintf(buf
, TS_BUF_SIZE
, format
,
277 (unsigned)sec
, (unsigned)usec
);
283 * Print the timestamp
286 ts_print(netdissect_options
*ndo
,
287 const struct timeval
*tvp
)
292 char buf
[TS_BUF_SIZE
];
293 static struct timeval tv_ref
;
294 struct timeval tv_result
;
298 switch (ndo
->ndo_tflag
) {
300 case 0: /* Default */
301 s
= (tvp
->tv_sec
+ thiszone
) % 86400;
302 ND_PRINT("%s ", ts_format(ndo
, s
, tvp
->tv_usec
, buf
));
305 case 1: /* No time stamp */
308 case 2: /* Unix timeval style */
309 ND_PRINT("%s ", ts_unix_format(ndo
,
310 tvp
->tv_sec
, tvp
->tv_usec
, buf
));
313 case 3: /* Microseconds/nanoseconds since previous packet */
314 case 5: /* Microseconds/nanoseconds since first packet */
315 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
316 switch (ndo
->ndo_tstamp_precision
) {
317 case PCAP_TSTAMP_PRECISION_MICRO
:
320 case PCAP_TSTAMP_PRECISION_NANO
:
330 if (!(netdissect_timevalisset(&tv_ref
)))
331 tv_ref
= *tvp
; /* set timestamp for first packet */
333 negative_offset
= netdissect_timevalcmp(tvp
, &tv_ref
, <);
335 netdissect_timevalsub(&tv_ref
, tvp
, &tv_result
, nano_prec
);
337 netdissect_timevalsub(tvp
, &tv_ref
, &tv_result
, nano_prec
);
339 ND_PRINT((negative_offset
? "-" : " "));
341 ND_PRINT("%s ", ts_format(ndo
,
342 tv_result
.tv_sec
, tv_result
.tv_usec
, buf
));
344 if (ndo
->ndo_tflag
== 3)
345 tv_ref
= *tvp
; /* set timestamp for previous packet */
348 case 4: /* Default + Date */
349 s
= (tvp
->tv_sec
+ thiszone
) % 86400;
350 Time
= (tvp
->tv_sec
+ thiszone
) - s
;
353 ND_PRINT("Date fail ");
355 ND_PRINT("%04d-%02d-%02d %s ",
356 tm
->tm_year
+1900, tm
->tm_mon
+1, tm
->tm_mday
,
357 ts_format(ndo
, s
, tvp
->tv_usec
, buf
));
363 * Print an unsigned relative number of seconds (e.g. hold time, prune timer)
364 * in the form 5m1s. This does no truncation, so 32230861 seconds
365 * is represented as 1y1w1d1h1m1s.
368 unsigned_relts_print(netdissect_options
*ndo
,
371 static const char *lengths
[] = {"y", "w", "d", "h", "m", "s"};
372 static const u_int seconds
[] = {31536000, 604800, 86400, 3600, 60, 1};
373 const char **l
= lengths
;
374 const u_int
*s
= seconds
;
382 ND_PRINT("%u%s", secs
/ *s
, *l
);
383 secs
-= (secs
/ *s
) * *s
;
391 * Print a signed relative number of seconds (e.g. hold time, prune timer)
392 * in the form 5m1s. This does no truncation, so 32230861 seconds
393 * is represented as 1y1w1d1h1m1s.
396 signed_relts_print(netdissect_options
*ndo
,
401 if (secs
== INT32_MIN
) {
403 * -2^31; you can't fit its absolute value into
404 * a 32-bit signed integer.
406 * Just directly pass said absolute value to
407 * unsigned_relts_print() directly.
409 * (XXX - does ISO C guarantee that -(-2^n),
410 * when calculated and cast to an n-bit unsigned
411 * integer type, will have the value 2^n?)
413 unsigned_relts_print(ndo
, 2147483648U);
416 * We now know -secs will fit into an int32_t;
417 * negate it and pass that to unsigned_relts_print().
419 unsigned_relts_print(ndo
, -secs
);
423 unsigned_relts_print(ndo
, secs
);
427 * this is a generic routine for printing unknown data;
428 * we pass on the linefeed plus indentation string to
429 * get a proper output - returns 0 on error
433 print_unknown_data(netdissect_options
*ndo
, const u_char
*cp
,const char *ident
,int len
)
436 ND_PRINT("%sDissector error: print_unknown_data called with negative length",
440 if (ndo
->ndo_snapend
- cp
< len
)
441 len
= ndo
->ndo_snapend
- cp
;
443 ND_PRINT("%sDissector error: print_unknown_data called with pointer past end of packet",
447 hex_print(ndo
, ident
,cp
,len
);
448 return(1); /* everything is ok */
452 * Convert a token value to a string; use "fmt" if not found.
455 tok2strbuf(const struct tok
*lp
, const char *fmt
,
456 u_int v
, char *buf
, size_t bufsize
)
459 while (lp
->s
!= NULL
) {
468 (void)nd_snprintf(buf
, bufsize
, fmt
, v
);
469 return (const char *)buf
;
473 * Convert a token value to a string; use "fmt" if not found.
474 * Uses tok2strbuf() on one of four local static buffers of size TOKBUFSIZE
475 * in round-robin fashion.
478 tok2str(const struct tok
*lp
, const char *fmt
,
481 static char buf
[4][TOKBUFSIZE
];
487 return tok2strbuf(lp
, fmt
, v
, ret
, sizeof(buf
[0]));
491 * Convert a bit token value to a string; use "fmt" if not found.
492 * this is useful for parsing bitfields, the output strings are seperated
493 * if the s field is positive.
496 bittok2str_internal(const struct tok
*lp
, const char *fmt
,
497 u_int v
, const char *sep
)
499 static char buf
[1024+1]; /* our string buffer */
501 size_t space_left
= sizeof(buf
), string_size
;
502 u_int rotbit
; /* this is the bit we rotate through all bitpositions */
504 const char * sepstr
= "";
506 while (lp
!= NULL
&& lp
->s
!= NULL
) {
507 tokval
=lp
->v
; /* load our first value */
509 while (rotbit
!= 0) {
511 * lets AND the rotating bit with our token value
512 * and see if we have got a match
514 if (tokval
== (v
&rotbit
)) {
515 /* ok we have found something */
517 return (buf
); /* only enough room left for NUL, if that */
518 string_size
= strlcpy(bufp
, sepstr
, space_left
);
519 if (string_size
>= space_left
)
520 return (buf
); /* we ran out of room */
522 space_left
-= string_size
;
524 return (buf
); /* only enough room left for NUL, if that */
525 string_size
= strlcpy(bufp
, lp
->s
, space_left
);
526 if (string_size
>= space_left
)
527 return (buf
); /* we ran out of room */
529 space_left
-= string_size
;
533 rotbit
=rotbit
<<1; /* no match - lets shift and try again */
539 /* bummer - lets print the "unknown" message as advised in the fmt string if we got one */
540 (void)nd_snprintf(buf
, sizeof(buf
), fmt
== NULL
? "#%08x" : fmt
, v
);
545 * Convert a bit token value to a string; use "fmt" if not found.
546 * this is useful for parsing bitfields, the output strings are not seperated.
549 bittok2str_nosep(const struct tok
*lp
, const char *fmt
,
552 return (bittok2str_internal(lp
, fmt
, v
, ""));
556 * Convert a bit token value to a string; use "fmt" if not found.
557 * this is useful for parsing bitfields, the output strings are comma seperated.
560 bittok2str(const struct tok
*lp
, const char *fmt
,
563 return (bittok2str_internal(lp
, fmt
, v
, ", "));
567 * Convert a value to a string using an array; the macro
568 * tok2strary() in <netdissect.h> is the public interface to
569 * this function and ensures that the second argument is
570 * correct for bounds-checking.
573 tok2strary_internal(const char **lp
, int n
, const char *fmt
,
576 static char buf
[TOKBUFSIZE
];
578 if (v
>= 0 && v
< n
&& lp
[v
] != NULL
)
582 (void)nd_snprintf(buf
, sizeof(buf
), fmt
, v
);
587 * Convert a 32-bit netmask to prefixlen if possible
588 * the function returns the prefix-len; if plen == -1
589 * then conversion was not possible;
593 mask2plen(uint32_t mask
)
595 uint32_t bitmasks
[33] = {
597 0x80000000, 0xc0000000, 0xe0000000, 0xf0000000,
598 0xf8000000, 0xfc000000, 0xfe000000, 0xff000000,
599 0xff800000, 0xffc00000, 0xffe00000, 0xfff00000,
600 0xfff80000, 0xfffc0000, 0xfffe0000, 0xffff0000,
601 0xffff8000, 0xffffc000, 0xffffe000, 0xfffff000,
602 0xfffff800, 0xfffffc00, 0xfffffe00, 0xffffff00,
603 0xffffff80, 0xffffffc0, 0xffffffe0, 0xfffffff0,
604 0xfffffff8, 0xfffffffc, 0xfffffffe, 0xffffffff
608 /* let's see if we can transform the mask into a prefixlen */
609 while (prefix_len
>= 0) {
610 if (bitmasks
[prefix_len
] == mask
)
618 mask62plen(const u_char
*mask
)
620 u_char bitmasks
[9] = {
622 0x80, 0xc0, 0xe0, 0xf0,
623 0xf8, 0xfc, 0xfe, 0xff
628 for (byte
= 0; byte
< 16; byte
++) {
631 for (bits
= 0; bits
< (sizeof (bitmasks
) / sizeof (bitmasks
[0])); bits
++) {
632 if (mask
[byte
] == bitmasks
[bits
]) {
638 if (mask
[byte
] != 0xff)
645 * Routine to print out information for text-based protocols such as FTP,
646 * HTTP, SMTP, RTSP, SIP, ....
648 #define MAX_TOKEN 128
651 * Fetch a token from a packet, starting at the specified index,
652 * and return the length of the token.
654 * Returns 0 on error; yes, this is indistinguishable from an empty
655 * token, but an "empty token" isn't a valid token - it just means
656 * either a space character at the beginning of the line (this
657 * includes a blank line) or no more tokens remaining on the line.
660 fetch_token(netdissect_options
*ndo
, const u_char
*pptr
, u_int idx
, u_int len
,
661 u_char
*tbuf
, size_t tbuflen
)
665 for (; idx
< len
; idx
++) {
666 if (!ND_TTEST_1(pptr
+ idx
)) {
667 /* ran past end of captured data */
670 if (!isascii(*(pptr
+ idx
))) {
671 /* not an ASCII character */
674 if (isspace(*(pptr
+ idx
))) {
678 if (!isprint(*(pptr
+ idx
))) {
679 /* not part of a command token or response code */
682 if (toklen
+ 2 > tbuflen
) {
683 /* no room for this character and terminating '\0' */
686 tbuf
[toklen
] = *(pptr
+ idx
);
696 * Skip past any white space after the token, until we see
697 * an end-of-line (CR or LF).
699 for (; idx
< len
; idx
++) {
700 if (!ND_TTEST_1(pptr
+ idx
)) {
701 /* ran past end of captured data */
704 if (*(pptr
+ idx
) == '\r' || *(pptr
+ idx
) == '\n') {
708 if (!isascii(*(pptr
+ idx
)) || !isprint(*(pptr
+ idx
))) {
709 /* not a printable ASCII character */
712 if (!isspace(*(pptr
+ idx
))) {
713 /* beginning of next token */
721 * Scan a buffer looking for a line ending - LF or CR-LF.
722 * Return the index of the character after the line ending or 0 if
723 * we encounter a non-ASCII or non-printable character or don't find
727 print_txt_line(netdissect_options
*ndo
, const char *protoname
,
728 const char *prefix
, const u_char
*pptr
, u_int idx
, u_int len
)
735 ND_TCHECK_1(pptr
+ idx
);
736 if (*(pptr
+idx
) == '\n') {
738 * LF without CR; end of line.
739 * Skip the LF and print the line, with the
740 * exception of the LF.
742 linelen
= idx
- startidx
;
745 } else if (*(pptr
+idx
) == '\r') {
747 if ((idx
+1) >= len
) {
748 /* not in this packet */
751 ND_TCHECK_1(pptr
+ idx
+ 1);
752 if (*(pptr
+idx
+1) == '\n') {
754 * CR-LF; end of line.
755 * Skip the CR-LF and print the line, with
756 * the exception of the CR-LF.
758 linelen
= idx
- startidx
;
764 * CR followed by something else; treat this
765 * as if it were binary data, and don't print
769 } else if (!isascii(*(pptr
+idx
)) ||
770 (!isprint(*(pptr
+idx
)) && *(pptr
+idx
) != '\t')) {
772 * Not a printable ASCII character and not a tab;
773 * treat this as if it were binary data, and
782 * All printable ASCII, but no line ending after that point
783 * in the buffer; treat this as if it were truncated.
786 linelen
= idx
- startidx
;
787 ND_PRINT("%s%.*s[!%s]", prefix
, (int)linelen
, pptr
+ startidx
,
792 ND_PRINT("%s%.*s", prefix
, (int)linelen
, pptr
+ startidx
);
797 txtproto_print(netdissect_options
*ndo
, const u_char
*pptr
, u_int len
,
798 const char *protoname
, const char **cmds
, u_int flags
)
801 u_char token
[MAX_TOKEN
+1];
808 * This protocol has more than just request and
809 * response lines; see whether this looks like a
810 * request or response and, if so, print it and,
811 * in verbose mode, print everything after it.
813 * This is for HTTP-like protocols, where we
814 * want to print requests and responses, but
815 * don't want to print continuations of request
816 * or response bodies in packets that don't
817 * contain the request or response line.
819 idx
= fetch_token(ndo
, pptr
, 0, len
, token
, sizeof(token
));
821 /* Is this a valid request name? */
822 while ((cmd
= *cmds
++) != NULL
) {
823 if (ascii_strcasecmp((const char *)token
, cmd
) == 0) {
831 * No - is this a valid response code (3 digits)?
833 * Is this token the response code, or is the next
834 * token the response code?
836 if (flags
& RESP_CODE_SECOND_TOKEN
) {
838 * Next token - get it.
840 idx
= fetch_token(ndo
, pptr
, idx
, len
, token
,
844 if (isdigit(token
[0]) && isdigit(token
[1]) &&
845 isdigit(token
[2]) && token
[3] == '\0') {
855 * 1) This protocol has only request and response lines
856 * (e.g., FTP, where all the data goes over a different
857 * connection); assume the payload is a request or
862 * 2) This protocol is just text, so that we should
863 * always, at minimum, print the first line and,
864 * in verbose mode, print all lines.
869 /* Capitalize the protocol name */
870 for (pnp
= protoname
; *pnp
!= '\0'; pnp
++)
871 ND_PRINT("%c", toupper((u_char
)*pnp
));
875 * In non-verbose mode, just print the protocol, followed
878 * In verbose mode, print lines as text until we run out
879 * of characters or see something that's not a
880 * printable-ASCII line.
882 if (ndo
->ndo_vflag
) {
884 * We're going to print all the text lines in the
885 * request or response; just print the length
886 * on the first line of the output.
888 ND_PRINT(", length: %u", len
);
890 idx
< len
&& (eol
= print_txt_line(ndo
, protoname
, "\n\t", pptr
, idx
, len
)) != 0;
895 * Just print the first text line.
897 print_txt_line(ndo
, protoname
, ": ", pptr
, 0, len
);
903 safeputs(netdissect_options
*ndo
,
904 const u_char
*s
, const u_int maxlen
)
908 while (idx
< maxlen
&& EXTRACT_U_1(s
)) {
909 safeputchar(ndo
, EXTRACT_U_1(s
));
916 safeputchar(netdissect_options
*ndo
,
919 ND_PRINT((c
< 0x80 && ND_ISPRINT(c
)) ? "%c" : "\\0x%02x", c
);
922 #if (defined(__i386__) || defined(_M_IX86) || defined(__X86__) || defined(__x86_64__) || defined(_M_X64)) || \
923 (defined(__arm__) || defined(_M_ARM) || defined(__aarch64__)) || \
924 (defined(__m68k__) && (!defined(__mc68000__) && !defined(__mc68010__))) || \
925 (defined(__ppc__) || defined(__ppc64__) || defined(_M_PPC) || defined(_ARCH_PPC) || defined(_ARCH_PPC64)) || \
926 (defined(__s390__) || defined(__s390x__) || defined(__zarch__)) || \
929 * The procesor natively handles unaligned loads, so just use memcpy()
930 * and memcmp(), to enable those optimizations.
932 * XXX - are those all the x86 tests we need?
933 * XXX - do we need to worry about ARMv1 through ARMv5, which didn't
934 * support unaligned loads, and, if so, do we need to worry about all
935 * of them, or just some of them, e.g. ARMv5?
936 * XXX - are those the only 68k tests we need not to generated
937 * unaligned accesses if the target is the 68000 or 68010?
938 * XXX - are there any tests we don't need, because some definitions are for
939 * compilers that also predefine the GCC symbols?
940 * XXX - do we need to test for both 32-bit and 64-bit versions of those
941 * architectures in all cases?
945 * The processor doesn't natively handle unaligned loads,
946 * and the compiler might "helpfully" optimize memcpy()
947 * and memcmp(), when handed pointers that would normally
948 * be properly aligned, into sequences that assume proper
951 * Do copies and compares of possibly-unaligned data by
952 * calling routines that wrap memcpy() and memcmp(), to
953 * prevent that optimization.
956 unaligned_memcpy(void *p
, const void *q
, size_t l
)
961 /* As with memcpy(), so with memcmp(). */
963 unaligned_memcmp(const void *p
, const void *q
, size_t l
)
965 return (memcmp(p
, q
, l
));