2 * Copyright (c) 1990, 1991, 1993, 1994, 1995, 1996, 1997
3 * The Regents of the University of California. All rights reserved.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
23 * txtproto_print() derived from original code by Hannes Gredler
24 * (hannes@gredler.at):
26 * Redistribution and use in source and binary forms, with or without
27 * modification, are permitted provided that: (1) source code
28 * distributions retain the above copyright notice and this paragraph
29 * in its entirety, and (2) distributions including binary code include
30 * the above copyright notice and this paragraph in its entirety in
31 * the documentation or other materials provided with the distribution.
32 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND
33 * WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, WITHOUT
34 * LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
35 * FOR A PARTICULAR PURPOSE.
42 #include "netdissect-stdinc.h"
55 #include "netdissect.h"
57 #include "ascii_strcasecmp.h"
58 #include "timeval-operations.h"
60 int32_t thiszone
; /* seconds offset from gmt to local time */
61 /* invalid string to print '(invalid)' for malformed or corrupted packets */
62 const char istr
[] = " (invalid)";
65 * timestamp display buffer size, the biggest size of both formats is needed
66 * sizeof("0000000000.000000000") > sizeof("00:00:00.000000000")
68 #define TS_BUF_SIZE sizeof("0000000000.000000000")
70 #define TOKBUFSIZE 128
73 * Print out a character, filtering out the non-printable ones
76 fn_print_char(netdissect_options
*ndo
, u_char c
)
83 c
^= 0x40; /* DEL to ?, others to alpha */
90 * Print out a null-terminated filename (or other ASCII string), part of
92 * If ep is NULL, assume no truncation check is needed.
93 * Return true if truncated.
94 * Stop at ep (if given) or before the null char, whichever is first.
97 nd_print(netdissect_options
*ndo
,
98 const u_char
*s
, const u_char
*ep
)
103 ret
= 1; /* assume truncated */
104 while (ep
== NULL
|| s
< ep
) {
111 fn_print_char(ndo
, c
);
117 * Print out a null-terminated filename (or other ASCII string) from
118 * a fixed-length buffer, part of the packet buffer.
119 * If ep is NULL, assume no truncation check is needed.
120 * Return the number of bytes of string processed, including the
121 * terminating null, if not truncated. Return 0 if truncated.
124 nd_printztn(netdissect_options
*ndo
,
125 const u_char
*s
, u_int n
, const u_char
*ep
)
132 if (n
== 0 || (ep
!= NULL
&& s
>= ep
)) {
134 * Truncated. This includes "no null before we
135 * got to the end of the fixed-length buffer".
137 * XXX - BOOTP says "null-terminated", which
138 * means the maximum length of the string, in
139 * bytes, is 1 less than the size of the buffer,
140 * as there must always be a terminating null.
154 fn_print_char(ndo
, c
);
160 * Print out a counted filename (or other ASCII string), part of
162 * If ep is NULL, assume no truncation check is needed.
163 * Return true if truncated.
164 * Stop at ep (if given) or after n bytes, whichever is first.
167 nd_printn(netdissect_options
*ndo
,
168 const u_char
*s
, u_int n
, const u_char
*ep
)
172 while (n
> 0 && (ep
== NULL
|| s
< ep
)) {
176 fn_print_char(ndo
, c
);
178 return (n
== 0) ? 0 : 1;
182 * Print out a null-padded filename (or other ASCII string), part of
184 * If ep is NULL, assume no truncation check is needed.
185 * Return true if truncated.
186 * Stop at ep (if given) or after n bytes or before the null char,
187 * whichever is first.
190 nd_printzp(netdissect_options
*ndo
,
191 const u_char
*s
, u_int n
,
197 ret
= 1; /* assume truncated */
198 while (n
> 0 && (ep
== NULL
|| s
< ep
)) {
206 fn_print_char(ndo
, c
);
208 return (n
== 0) ? 0 : ret
;
212 * Format the timestamp
215 ts_format(netdissect_options
*ndo
216 #ifndef HAVE_PCAP_SET_TSTAMP_PRECISION
219 , int sec
, int usec
, char *buf
)
223 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
224 switch (ndo
->ndo_tstamp_precision
) {
226 case PCAP_TSTAMP_PRECISION_MICRO
:
227 format
= "%02d:%02d:%02d.%06u";
230 case PCAP_TSTAMP_PRECISION_NANO
:
231 format
= "%02d:%02d:%02d.%09u";
235 format
= "%02d:%02d:%02d.{unknown}";
239 format
= "%02d:%02d:%02d.%06u";
242 nd_snprintf(buf
, TS_BUF_SIZE
, format
,
243 sec
/ 3600, (sec
% 3600) / 60, sec
% 60, usec
);
249 * Format the timestamp - Unix timeval style
252 ts_unix_format(netdissect_options
*ndo
253 #ifndef HAVE_PCAP_SET_TSTAMP_PRECISION
256 , int sec
, int usec
, char *buf
)
260 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
261 switch (ndo
->ndo_tstamp_precision
) {
263 case PCAP_TSTAMP_PRECISION_MICRO
:
267 case PCAP_TSTAMP_PRECISION_NANO
:
272 format
= "%u.{unknown}";
279 nd_snprintf(buf
, TS_BUF_SIZE
, format
,
280 (unsigned)sec
, (unsigned)usec
);
286 * Print the timestamp
289 ts_print(netdissect_options
*ndo
,
290 const struct timeval
*tvp
)
295 char buf
[TS_BUF_SIZE
];
296 static struct timeval tv_ref
;
297 struct timeval tv_result
;
301 switch (ndo
->ndo_tflag
) {
303 case 0: /* Default */
304 s
= (tvp
->tv_sec
+ thiszone
) % 86400;
305 ND_PRINT("%s ", ts_format(ndo
, s
, tvp
->tv_usec
, buf
));
308 case 1: /* No time stamp */
311 case 2: /* Unix timeval style */
312 ND_PRINT("%s ", ts_unix_format(ndo
,
313 tvp
->tv_sec
, tvp
->tv_usec
, buf
));
316 case 3: /* Microseconds/nanoseconds since previous packet */
317 case 5: /* Microseconds/nanoseconds since first packet */
318 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
319 switch (ndo
->ndo_tstamp_precision
) {
320 case PCAP_TSTAMP_PRECISION_MICRO
:
323 case PCAP_TSTAMP_PRECISION_NANO
:
333 if (!(netdissect_timevalisset(&tv_ref
)))
334 tv_ref
= *tvp
; /* set timestamp for first packet */
336 negative_offset
= netdissect_timevalcmp(tvp
, &tv_ref
, <);
338 netdissect_timevalsub(&tv_ref
, tvp
, &tv_result
, nano_prec
);
340 netdissect_timevalsub(tvp
, &tv_ref
, &tv_result
, nano_prec
);
342 ND_PRINT((negative_offset
? "-" : " "));
344 ND_PRINT("%s ", ts_format(ndo
,
345 tv_result
.tv_sec
, tv_result
.tv_usec
, buf
));
347 if (ndo
->ndo_tflag
== 3)
348 tv_ref
= *tvp
; /* set timestamp for previous packet */
351 case 4: /* Default + Date */
352 s
= (tvp
->tv_sec
+ thiszone
) % 86400;
353 Time
= (tvp
->tv_sec
+ thiszone
) - s
;
356 ND_PRINT("Date fail ");
358 ND_PRINT("%04d-%02d-%02d %s ",
359 tm
->tm_year
+1900, tm
->tm_mon
+1, tm
->tm_mday
,
360 ts_format(ndo
, s
, tvp
->tv_usec
, buf
));
366 * Print an unsigned relative number of seconds (e.g. hold time, prune timer)
367 * in the form 5m1s. This does no truncation, so 32230861 seconds
368 * is represented as 1y1w1d1h1m1s.
371 unsigned_relts_print(netdissect_options
*ndo
,
374 static const char *lengths
[] = {"y", "w", "d", "h", "m", "s"};
375 static const u_int seconds
[] = {31536000, 604800, 86400, 3600, 60, 1};
376 const char **l
= lengths
;
377 const u_int
*s
= seconds
;
385 ND_PRINT("%u%s", secs
/ *s
, *l
);
386 secs
-= (secs
/ *s
) * *s
;
394 * Print a signed relative number of seconds (e.g. hold time, prune timer)
395 * in the form 5m1s. This does no truncation, so 32230861 seconds
396 * is represented as 1y1w1d1h1m1s.
399 signed_relts_print(netdissect_options
*ndo
,
404 if (secs
== INT32_MIN
) {
406 * -2^31; you can't fit its absolute value into
407 * a 32-bit signed integer.
409 * Just directly pass said absolute value to
410 * unsigned_relts_print() directly.
412 * (XXX - does ISO C guarantee that -(-2^n),
413 * when calculated and cast to an n-bit unsigned
414 * integer type, will have the value 2^n?)
416 unsigned_relts_print(ndo
, 2147483648U);
419 * We now know -secs will fit into an int32_t;
420 * negate it and pass that to unsigned_relts_print().
422 unsigned_relts_print(ndo
, -secs
);
426 unsigned_relts_print(ndo
, secs
);
429 /* Print the truncated string */
430 void nd_print_trunc(netdissect_options
*ndo
)
432 ND_PRINT(" [|%s]", ndo
->ndo_protocol
);
436 * this is a generic routine for printing unknown data;
437 * we pass on the linefeed plus indentation string to
438 * get a proper output - returns 0 on error
442 print_unknown_data(netdissect_options
*ndo
, const u_char
*cp
,const char *ident
,int len
)
445 ND_PRINT("%sDissector error: print_unknown_data called with negative length",
449 if (ndo
->ndo_snapend
- cp
< len
)
450 len
= ndo
->ndo_snapend
- cp
;
452 ND_PRINT("%sDissector error: print_unknown_data called with pointer past end of packet",
456 hex_print(ndo
, ident
,cp
,len
);
457 return(1); /* everything is ok */
461 * Convert a token value to a string; use "fmt" if not found.
464 tok2strbuf(const struct tok
*lp
, const char *fmt
,
465 u_int v
, char *buf
, size_t bufsize
)
468 while (lp
->s
!= NULL
) {
477 (void)nd_snprintf(buf
, bufsize
, fmt
, v
);
478 return (const char *)buf
;
482 * Convert a token value to a string; use "fmt" if not found.
483 * Uses tok2strbuf() on one of four local static buffers of size TOKBUFSIZE
484 * in round-robin fashion.
487 tok2str(const struct tok
*lp
, const char *fmt
,
490 static char buf
[4][TOKBUFSIZE
];
496 return tok2strbuf(lp
, fmt
, v
, ret
, sizeof(buf
[0]));
500 * Convert a bit token value to a string; use "fmt" if not found.
501 * this is useful for parsing bitfields, the output strings are seperated
502 * if the s field is positive.
505 bittok2str_internal(const struct tok
*lp
, const char *fmt
,
506 u_int v
, const char *sep
)
508 static char buf
[1024+1]; /* our string buffer */
510 size_t space_left
= sizeof(buf
), string_size
;
511 u_int rotbit
; /* this is the bit we rotate through all bitpositions */
513 const char * sepstr
= "";
515 while (lp
!= NULL
&& lp
->s
!= NULL
) {
516 tokval
=lp
->v
; /* load our first value */
518 while (rotbit
!= 0) {
520 * lets AND the rotating bit with our token value
521 * and see if we have got a match
523 if (tokval
== (v
&rotbit
)) {
524 /* ok we have found something */
526 return (buf
); /* only enough room left for NUL, if that */
527 string_size
= strlcpy(bufp
, sepstr
, space_left
);
528 if (string_size
>= space_left
)
529 return (buf
); /* we ran out of room */
531 space_left
-= string_size
;
533 return (buf
); /* only enough room left for NUL, if that */
534 string_size
= strlcpy(bufp
, lp
->s
, space_left
);
535 if (string_size
>= space_left
)
536 return (buf
); /* we ran out of room */
538 space_left
-= string_size
;
542 rotbit
=rotbit
<<1; /* no match - lets shift and try again */
548 /* bummer - lets print the "unknown" message as advised in the fmt string if we got one */
549 (void)nd_snprintf(buf
, sizeof(buf
), fmt
== NULL
? "#%08x" : fmt
, v
);
554 * Convert a bit token value to a string; use "fmt" if not found.
555 * this is useful for parsing bitfields, the output strings are not seperated.
558 bittok2str_nosep(const struct tok
*lp
, const char *fmt
,
561 return (bittok2str_internal(lp
, fmt
, v
, ""));
565 * Convert a bit token value to a string; use "fmt" if not found.
566 * this is useful for parsing bitfields, the output strings are comma seperated.
569 bittok2str(const struct tok
*lp
, const char *fmt
,
572 return (bittok2str_internal(lp
, fmt
, v
, ", "));
576 * Convert a value to a string using an array; the macro
577 * tok2strary() in <netdissect.h> is the public interface to
578 * this function and ensures that the second argument is
579 * correct for bounds-checking.
582 tok2strary_internal(const char **lp
, int n
, const char *fmt
,
585 static char buf
[TOKBUFSIZE
];
587 if (v
>= 0 && v
< n
&& lp
[v
] != NULL
)
591 (void)nd_snprintf(buf
, sizeof(buf
), fmt
, v
);
596 * Convert a 32-bit netmask to prefixlen if possible
597 * the function returns the prefix-len; if plen == -1
598 * then conversion was not possible;
602 mask2plen(uint32_t mask
)
604 uint32_t bitmasks
[33] = {
606 0x80000000, 0xc0000000, 0xe0000000, 0xf0000000,
607 0xf8000000, 0xfc000000, 0xfe000000, 0xff000000,
608 0xff800000, 0xffc00000, 0xffe00000, 0xfff00000,
609 0xfff80000, 0xfffc0000, 0xfffe0000, 0xffff0000,
610 0xffff8000, 0xffffc000, 0xffffe000, 0xfffff000,
611 0xfffff800, 0xfffffc00, 0xfffffe00, 0xffffff00,
612 0xffffff80, 0xffffffc0, 0xffffffe0, 0xfffffff0,
613 0xfffffff8, 0xfffffffc, 0xfffffffe, 0xffffffff
617 /* let's see if we can transform the mask into a prefixlen */
618 while (prefix_len
>= 0) {
619 if (bitmasks
[prefix_len
] == mask
)
627 mask62plen(const u_char
*mask
)
629 u_char bitmasks
[9] = {
631 0x80, 0xc0, 0xe0, 0xf0,
632 0xf8, 0xfc, 0xfe, 0xff
637 for (byte
= 0; byte
< 16; byte
++) {
640 for (bits
= 0; bits
< (sizeof (bitmasks
) / sizeof (bitmasks
[0])); bits
++) {
641 if (mask
[byte
] == bitmasks
[bits
]) {
647 if (mask
[byte
] != 0xff)
654 * Routine to print out information for text-based protocols such as FTP,
655 * HTTP, SMTP, RTSP, SIP, ....
657 #define MAX_TOKEN 128
660 * Fetch a token from a packet, starting at the specified index,
661 * and return the length of the token.
663 * Returns 0 on error; yes, this is indistinguishable from an empty
664 * token, but an "empty token" isn't a valid token - it just means
665 * either a space character at the beginning of the line (this
666 * includes a blank line) or no more tokens remaining on the line.
669 fetch_token(netdissect_options
*ndo
, const u_char
*pptr
, u_int idx
, u_int len
,
670 u_char
*tbuf
, size_t tbuflen
)
674 for (; idx
< len
; idx
++) {
675 if (!ND_TTEST_1(pptr
+ idx
)) {
676 /* ran past end of captured data */
679 if (!isascii(*(pptr
+ idx
))) {
680 /* not an ASCII character */
683 if (isspace(*(pptr
+ idx
))) {
687 if (!isprint(*(pptr
+ idx
))) {
688 /* not part of a command token or response code */
691 if (toklen
+ 2 > tbuflen
) {
692 /* no room for this character and terminating '\0' */
695 tbuf
[toklen
] = *(pptr
+ idx
);
705 * Skip past any white space after the token, until we see
706 * an end-of-line (CR or LF).
708 for (; idx
< len
; idx
++) {
709 if (!ND_TTEST_1(pptr
+ idx
)) {
710 /* ran past end of captured data */
713 if (*(pptr
+ idx
) == '\r' || *(pptr
+ idx
) == '\n') {
717 if (!isascii(*(pptr
+ idx
)) || !isprint(*(pptr
+ idx
))) {
718 /* not a printable ASCII character */
721 if (!isspace(*(pptr
+ idx
))) {
722 /* beginning of next token */
730 * Scan a buffer looking for a line ending - LF or CR-LF.
731 * Return the index of the character after the line ending or 0 if
732 * we encounter a non-ASCII or non-printable character or don't find
736 print_txt_line(netdissect_options
*ndo
, const char *protoname
,
737 const char *prefix
, const u_char
*pptr
, u_int idx
, u_int len
)
744 ND_TCHECK_1(pptr
+ idx
);
745 if (*(pptr
+idx
) == '\n') {
747 * LF without CR; end of line.
748 * Skip the LF and print the line, with the
749 * exception of the LF.
751 linelen
= idx
- startidx
;
754 } else if (*(pptr
+idx
) == '\r') {
756 if ((idx
+1) >= len
) {
757 /* not in this packet */
760 ND_TCHECK_1(pptr
+ idx
+ 1);
761 if (*(pptr
+idx
+1) == '\n') {
763 * CR-LF; end of line.
764 * Skip the CR-LF and print the line, with
765 * the exception of the CR-LF.
767 linelen
= idx
- startidx
;
773 * CR followed by something else; treat this
774 * as if it were binary data, and don't print
778 } else if (!isascii(*(pptr
+idx
)) ||
779 (!isprint(*(pptr
+idx
)) && *(pptr
+idx
) != '\t')) {
781 * Not a printable ASCII character and not a tab;
782 * treat this as if it were binary data, and
791 * All printable ASCII, but no line ending after that point
792 * in the buffer; treat this as if it were truncated.
795 linelen
= idx
- startidx
;
796 ND_PRINT("%s%.*s[!%s]", prefix
, (int)linelen
, pptr
+ startidx
,
801 ND_PRINT("%s%.*s", prefix
, (int)linelen
, pptr
+ startidx
);
806 txtproto_print(netdissect_options
*ndo
, const u_char
*pptr
, u_int len
,
807 const char *protoname
, const char **cmds
, u_int flags
)
810 u_char token
[MAX_TOKEN
+1];
817 * This protocol has more than just request and
818 * response lines; see whether this looks like a
819 * request or response and, if so, print it and,
820 * in verbose mode, print everything after it.
822 * This is for HTTP-like protocols, where we
823 * want to print requests and responses, but
824 * don't want to print continuations of request
825 * or response bodies in packets that don't
826 * contain the request or response line.
828 idx
= fetch_token(ndo
, pptr
, 0, len
, token
, sizeof(token
));
830 /* Is this a valid request name? */
831 while ((cmd
= *cmds
++) != NULL
) {
832 if (ascii_strcasecmp((const char *)token
, cmd
) == 0) {
840 * No - is this a valid response code (3 digits)?
842 * Is this token the response code, or is the next
843 * token the response code?
845 if (flags
& RESP_CODE_SECOND_TOKEN
) {
847 * Next token - get it.
849 idx
= fetch_token(ndo
, pptr
, idx
, len
, token
,
853 if (isdigit(token
[0]) && isdigit(token
[1]) &&
854 isdigit(token
[2]) && token
[3] == '\0') {
864 * 1) This protocol has only request and response lines
865 * (e.g., FTP, where all the data goes over a different
866 * connection); assume the payload is a request or
871 * 2) This protocol is just text, so that we should
872 * always, at minimum, print the first line and,
873 * in verbose mode, print all lines.
878 /* Capitalize the protocol name */
879 for (pnp
= protoname
; *pnp
!= '\0'; pnp
++)
880 ND_PRINT("%c", toupper((u_char
)*pnp
));
884 * In non-verbose mode, just print the protocol, followed
887 * In verbose mode, print lines as text until we run out
888 * of characters or see something that's not a
889 * printable-ASCII line.
891 if (ndo
->ndo_vflag
) {
893 * We're going to print all the text lines in the
894 * request or response; just print the length
895 * on the first line of the output.
897 ND_PRINT(", length: %u", len
);
899 idx
< len
&& (eol
= print_txt_line(ndo
, protoname
, "\n\t", pptr
, idx
, len
)) != 0;
904 * Just print the first text line.
906 print_txt_line(ndo
, protoname
, ": ", pptr
, 0, len
);
911 #if (defined(__i386__) || defined(_M_IX86) || defined(__X86__) || defined(__x86_64__) || defined(_M_X64)) || \
912 (defined(__arm__) || defined(_M_ARM) || defined(__aarch64__)) || \
913 (defined(__m68k__) && (!defined(__mc68000__) && !defined(__mc68010__))) || \
914 (defined(__ppc__) || defined(__ppc64__) || defined(_M_PPC) || defined(_ARCH_PPC) || defined(_ARCH_PPC64)) || \
915 (defined(__s390__) || defined(__s390x__) || defined(__zarch__)) || \
918 * The procesor natively handles unaligned loads, so just use memcpy()
919 * and memcmp(), to enable those optimizations.
921 * XXX - are those all the x86 tests we need?
922 * XXX - do we need to worry about ARMv1 through ARMv5, which didn't
923 * support unaligned loads, and, if so, do we need to worry about all
924 * of them, or just some of them, e.g. ARMv5?
925 * XXX - are those the only 68k tests we need not to generated
926 * unaligned accesses if the target is the 68000 or 68010?
927 * XXX - are there any tests we don't need, because some definitions are for
928 * compilers that also predefine the GCC symbols?
929 * XXX - do we need to test for both 32-bit and 64-bit versions of those
930 * architectures in all cases?
934 * The processor doesn't natively handle unaligned loads,
935 * and the compiler might "helpfully" optimize memcpy()
936 * and memcmp(), when handed pointers that would normally
937 * be properly aligned, into sequences that assume proper
940 * Do copies and compares of possibly-unaligned data by
941 * calling routines that wrap memcpy() and memcmp(), to
942 * prevent that optimization.
945 unaligned_memcpy(void *p
, const void *q
, size_t l
)
950 /* As with memcpy(), so with memcmp(). */
952 unaligned_memcmp(const void *p
, const void *q
, size_t l
)
954 return (memcmp(p
, q
, l
));