2 * Copyright (c) 1990, 1991, 1993, 1994, 1995, 1996, 1997
3 * The Regents of the University of California. All rights reserved.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
23 * txtproto_print() derived from original code by Hannes Gredler
24 * (hannes@gredler.at):
26 * Redistribution and use in source and binary forms, with or without
27 * modification, are permitted provided that: (1) source code
28 * distributions retain the above copyright notice and this paragraph
29 * in its entirety, and (2) distributions including binary code include
30 * the above copyright notice and this paragraph in its entirety in
31 * the documentation or other materials provided with the distribution.
32 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND
33 * WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, WITHOUT
34 * LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
35 * FOR A PARTICULAR PURPOSE.
42 #include "netdissect-stdinc.h"
55 #include "netdissect.h"
57 #include "ascii_strcasecmp.h"
58 #include "timeval-operations.h"
60 int32_t thiszone
; /* seconds offset from gmt to local time */
61 /* invalid string to print '(invalid)' for malformed or corrupted packets */
62 const char istr
[] = " (invalid)";
65 * timestamp display buffer size, the biggest size of both formats is needed
66 * sizeof("0000000000.000000000") > sizeof("00:00:00.000000000")
68 #define TS_BUF_SIZE sizeof("0000000000.000000000")
70 #define TOKBUFSIZE 128
73 * Print out a character, filtering out the non-printable ones
76 fn_print_char(netdissect_options
*ndo
, u_char c
)
83 c
^= 0x40; /* DEL to ?, others to alpha */
90 * Print out a null-terminated filename (or other ASCII string).
91 * If ep is NULL, assume no truncation check is needed.
92 * Return true if truncated.
93 * Stop at ep (if given) or before the null char, whichever is first.
96 fn_print(netdissect_options
*ndo
,
97 const u_char
*s
, const u_char
*ep
)
102 ret
= 1; /* assume truncated */
103 while (ep
== NULL
|| s
< ep
) {
110 if (!ND_ISASCII(c
)) {
114 if (!ND_ISPRINT(c
)) {
115 c
^= 0x40; /* DEL to ?, others to alpha */
124 * Print out a null-terminated filename (or other ASCII string) from
125 * a fixed-length buffer.
126 * If ep is NULL, assume no truncation check is needed.
127 * Return the number of bytes of string processed, including the
128 * terminating null, if not truncated. Return 0 if truncated.
131 fn_printztn(netdissect_options
*ndo
,
132 const u_char
*s
, u_int n
, const u_char
*ep
)
139 if (n
== 0 || (ep
!= NULL
&& s
>= ep
)) {
141 * Truncated. This includes "no null before we
142 * got to the end of the fixed-length buffer".
144 * XXX - BOOTP says "null-terminated", which
145 * means the maximum length of the string, in
146 * bytes, is 1 less than the size of the buffer,
147 * as there must always be a terminating null.
161 if (!ND_ISASCII(c
)) {
165 if (!ND_ISPRINT(c
)) {
166 c
^= 0x40; /* DEL to ?, others to alpha */
175 * Print out a counted filename (or other ASCII string).
176 * If ep is NULL, assume no truncation check is needed.
177 * Return true if truncated.
178 * Stop at ep (if given) or after n bytes, whichever is first.
181 fn_printn(netdissect_options
*ndo
,
182 const u_char
*s
, u_int n
, const u_char
*ep
)
186 while (n
> 0 && (ep
== NULL
|| s
< ep
)) {
190 if (!ND_ISASCII(c
)) {
194 if (!ND_ISPRINT(c
)) {
195 c
^= 0x40; /* DEL to ?, others to alpha */
200 return (n
== 0) ? 0 : 1;
204 * Print out a null-padded filename (or other ASCII string).
205 * If ep is NULL, assume no truncation check is needed.
206 * Return true if truncated.
207 * Stop at ep (if given) or after n bytes or before the null char,
208 * whichever is first.
211 fn_printzp(netdissect_options
*ndo
,
212 const u_char
*s
, u_int n
,
218 ret
= 1; /* assume truncated */
219 while (n
> 0 && (ep
== NULL
|| s
< ep
)) {
227 if (!ND_ISASCII(c
)) {
231 if (!ND_ISPRINT(c
)) {
232 c
^= 0x40; /* DEL to ?, others to alpha */
237 return (n
== 0) ? 0 : ret
;
241 * Format the timestamp
244 ts_format(netdissect_options
*ndo
245 #ifndef HAVE_PCAP_SET_TSTAMP_PRECISION
248 , int sec
, int usec
, char *buf
)
252 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
253 switch (ndo
->ndo_tstamp_precision
) {
255 case PCAP_TSTAMP_PRECISION_MICRO
:
256 format
= "%02d:%02d:%02d.%06u";
259 case PCAP_TSTAMP_PRECISION_NANO
:
260 format
= "%02d:%02d:%02d.%09u";
264 format
= "%02d:%02d:%02d.{unknown}";
268 format
= "%02d:%02d:%02d.%06u";
271 snprintf(buf
, TS_BUF_SIZE
, format
,
272 sec
/ 3600, (sec
% 3600) / 60, sec
% 60, usec
);
278 * Format the timestamp - Unix timeval style
281 ts_unix_format(netdissect_options
*ndo
282 #ifndef HAVE_PCAP_SET_TSTAMP_PRECISION
285 , int sec
, int usec
, char *buf
)
289 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
290 switch (ndo
->ndo_tstamp_precision
) {
292 case PCAP_TSTAMP_PRECISION_MICRO
:
296 case PCAP_TSTAMP_PRECISION_NANO
:
301 format
= "%u.{unknown}";
308 snprintf(buf
, TS_BUF_SIZE
, format
,
309 (unsigned)sec
, (unsigned)usec
);
315 * Print the timestamp
318 ts_print(netdissect_options
*ndo
,
319 const struct timeval
*tvp
)
324 char buf
[TS_BUF_SIZE
];
325 static struct timeval tv_ref
;
326 struct timeval tv_result
;
330 switch (ndo
->ndo_tflag
) {
332 case 0: /* Default */
333 s
= (tvp
->tv_sec
+ thiszone
) % 86400;
334 ND_PRINT("%s ", ts_format(ndo
, s
, tvp
->tv_usec
, buf
));
337 case 1: /* No time stamp */
340 case 2: /* Unix timeval style */
341 ND_PRINT("%s ", ts_unix_format(ndo
,
342 tvp
->tv_sec
, tvp
->tv_usec
, buf
));
345 case 3: /* Microseconds/nanoseconds since previous packet */
346 case 5: /* Microseconds/nanoseconds since first packet */
347 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
348 switch (ndo
->ndo_tstamp_precision
) {
349 case PCAP_TSTAMP_PRECISION_MICRO
:
352 case PCAP_TSTAMP_PRECISION_NANO
:
362 if (!(netdissect_timevalisset(&tv_ref
)))
363 tv_ref
= *tvp
; /* set timestamp for first packet */
365 negative_offset
= netdissect_timevalcmp(tvp
, &tv_ref
, <);
367 netdissect_timevalsub(&tv_ref
, tvp
, &tv_result
, nano_prec
);
369 netdissect_timevalsub(tvp
, &tv_ref
, &tv_result
, nano_prec
);
371 ND_PRINT((negative_offset
? "-" : " "));
373 ND_PRINT("%s ", ts_format(ndo
,
374 tv_result
.tv_sec
, tv_result
.tv_usec
, buf
));
376 if (ndo
->ndo_tflag
== 3)
377 tv_ref
= *tvp
; /* set timestamp for previous packet */
380 case 4: /* Default + Date */
381 s
= (tvp
->tv_sec
+ thiszone
) % 86400;
382 Time
= (tvp
->tv_sec
+ thiszone
) - s
;
385 ND_PRINT("Date fail ");
387 ND_PRINT("%04d-%02d-%02d %s ",
388 tm
->tm_year
+1900, tm
->tm_mon
+1, tm
->tm_mday
,
389 ts_format(ndo
, s
, tvp
->tv_usec
, buf
));
395 * Print an unsigned relative number of seconds (e.g. hold time, prune timer)
396 * in the form 5m1s. This does no truncation, so 32230861 seconds
397 * is represented as 1y1w1d1h1m1s.
400 unsigned_relts_print(netdissect_options
*ndo
,
403 static const char *lengths
[] = {"y", "w", "d", "h", "m", "s"};
404 static const u_int seconds
[] = {31536000, 604800, 86400, 3600, 60, 1};
405 const char **l
= lengths
;
406 const u_int
*s
= seconds
;
414 ND_PRINT("%u%s", secs
/ *s
, *l
);
415 secs
-= (secs
/ *s
) * *s
;
423 * Print a signed relative number of seconds (e.g. hold time, prune timer)
424 * in the form 5m1s. This does no truncation, so 32230861 seconds
425 * is represented as 1y1w1d1h1m1s.
428 signed_relts_print(netdissect_options
*ndo
,
433 if (secs
== INT32_MIN
) {
435 * -2^31; you can't fit its absolute value into
436 * a 32-bit signed integer.
438 * Just directly pass said absolute value to
439 * unsigned_relts_print() directly.
441 * (XXX - does ISO C guarantee that -(-2^n),
442 * when calculated and cast to an n-bit unsigned
443 * integer type, will have the value 2^n?)
445 unsigned_relts_print(ndo
, 2147483648U);
448 * We now know -secs will fit into an int32_t;
449 * negate it and pass that to unsigned_relts_print().
451 unsigned_relts_print(ndo
, -secs
);
455 unsigned_relts_print(ndo
, secs
);
459 * this is a generic routine for printing unknown data;
460 * we pass on the linefeed plus indentation string to
461 * get a proper output - returns 0 on error
465 print_unknown_data(netdissect_options
*ndo
, const u_char
*cp
,const char *ident
,int len
)
468 ND_PRINT("%sDissector error: print_unknown_data called with negative length",
472 if (ndo
->ndo_snapend
- cp
< len
)
473 len
= ndo
->ndo_snapend
- cp
;
475 ND_PRINT("%sDissector error: print_unknown_data called with pointer past end of packet",
479 hex_print(ndo
, ident
,cp
,len
);
480 return(1); /* everything is ok */
484 * Convert a token value to a string; use "fmt" if not found.
487 tok2strbuf(const struct tok
*lp
, const char *fmt
,
488 u_int v
, char *buf
, size_t bufsize
)
491 while (lp
->s
!= NULL
) {
500 (void)snprintf(buf
, bufsize
, fmt
, v
);
501 return (const char *)buf
;
505 * Convert a token value to a string; use "fmt" if not found.
506 * Uses tok2strbuf() on one of four local static buffers of size TOKBUFSIZE
507 * in round-robin fashion.
510 tok2str(const struct tok
*lp
, const char *fmt
,
513 static char buf
[4][TOKBUFSIZE
];
519 return tok2strbuf(lp
, fmt
, v
, ret
, sizeof(buf
[0]));
523 * Convert a bit token value to a string; use "fmt" if not found.
524 * this is useful for parsing bitfields, the output strings are seperated
525 * if the s field is positive.
528 bittok2str_internal(const struct tok
*lp
, const char *fmt
,
529 u_int v
, const char *sep
)
531 static char buf
[1024+1]; /* our string buffer */
533 size_t space_left
= sizeof(buf
), string_size
;
534 u_int rotbit
; /* this is the bit we rotate through all bitpositions */
536 const char * sepstr
= "";
538 while (lp
!= NULL
&& lp
->s
!= NULL
) {
539 tokval
=lp
->v
; /* load our first value */
541 while (rotbit
!= 0) {
543 * lets AND the rotating bit with our token value
544 * and see if we have got a match
546 if (tokval
== (v
&rotbit
)) {
547 /* ok we have found something */
549 return (buf
); /* only enough room left for NUL, if that */
550 string_size
= strlcpy(bufp
, sepstr
, space_left
);
551 if (string_size
>= space_left
)
552 return (buf
); /* we ran out of room */
554 space_left
-= string_size
;
556 return (buf
); /* only enough room left for NUL, if that */
557 string_size
= strlcpy(bufp
, lp
->s
, space_left
);
558 if (string_size
>= space_left
)
559 return (buf
); /* we ran out of room */
561 space_left
-= string_size
;
565 rotbit
=rotbit
<<1; /* no match - lets shift and try again */
571 /* bummer - lets print the "unknown" message as advised in the fmt string if we got one */
572 (void)snprintf(buf
, sizeof(buf
), fmt
== NULL
? "#%08x" : fmt
, v
);
577 * Convert a bit token value to a string; use "fmt" if not found.
578 * this is useful for parsing bitfields, the output strings are not seperated.
581 bittok2str_nosep(const struct tok
*lp
, const char *fmt
,
584 return (bittok2str_internal(lp
, fmt
, v
, ""));
588 * Convert a bit token value to a string; use "fmt" if not found.
589 * this is useful for parsing bitfields, the output strings are comma seperated.
592 bittok2str(const struct tok
*lp
, const char *fmt
,
595 return (bittok2str_internal(lp
, fmt
, v
, ", "));
599 * Convert a value to a string using an array; the macro
600 * tok2strary() in <netdissect.h> is the public interface to
601 * this function and ensures that the second argument is
602 * correct for bounds-checking.
605 tok2strary_internal(const char **lp
, int n
, const char *fmt
,
608 static char buf
[TOKBUFSIZE
];
610 if (v
>= 0 && v
< n
&& lp
[v
] != NULL
)
614 (void)snprintf(buf
, sizeof(buf
), fmt
, v
);
619 * Convert a 32-bit netmask to prefixlen if possible
620 * the function returns the prefix-len; if plen == -1
621 * then conversion was not possible;
625 mask2plen(uint32_t mask
)
627 uint32_t bitmasks
[33] = {
629 0x80000000, 0xc0000000, 0xe0000000, 0xf0000000,
630 0xf8000000, 0xfc000000, 0xfe000000, 0xff000000,
631 0xff800000, 0xffc00000, 0xffe00000, 0xfff00000,
632 0xfff80000, 0xfffc0000, 0xfffe0000, 0xffff0000,
633 0xffff8000, 0xffffc000, 0xffffe000, 0xfffff000,
634 0xfffff800, 0xfffffc00, 0xfffffe00, 0xffffff00,
635 0xffffff80, 0xffffffc0, 0xffffffe0, 0xfffffff0,
636 0xfffffff8, 0xfffffffc, 0xfffffffe, 0xffffffff
640 /* let's see if we can transform the mask into a prefixlen */
641 while (prefix_len
>= 0) {
642 if (bitmasks
[prefix_len
] == mask
)
650 mask62plen(const u_char
*mask
)
652 u_char bitmasks
[9] = {
654 0x80, 0xc0, 0xe0, 0xf0,
655 0xf8, 0xfc, 0xfe, 0xff
660 for (byte
= 0; byte
< 16; byte
++) {
663 for (bits
= 0; bits
< (sizeof (bitmasks
) / sizeof (bitmasks
[0])); bits
++) {
664 if (mask
[byte
] == bitmasks
[bits
]) {
670 if (mask
[byte
] != 0xff)
677 * Routine to print out information for text-based protocols such as FTP,
678 * HTTP, SMTP, RTSP, SIP, ....
680 #define MAX_TOKEN 128
683 * Fetch a token from a packet, starting at the specified index,
684 * and return the length of the token.
686 * Returns 0 on error; yes, this is indistinguishable from an empty
687 * token, but an "empty token" isn't a valid token - it just means
688 * either a space character at the beginning of the line (this
689 * includes a blank line) or no more tokens remaining on the line.
692 fetch_token(netdissect_options
*ndo
, const u_char
*pptr
, u_int idx
, u_int len
,
693 u_char
*tbuf
, size_t tbuflen
)
697 for (; idx
< len
; idx
++) {
698 if (!ND_TTEST_1(pptr
+ idx
)) {
699 /* ran past end of captured data */
702 if (!isascii(*(pptr
+ idx
))) {
703 /* not an ASCII character */
706 if (isspace(*(pptr
+ idx
))) {
710 if (!isprint(*(pptr
+ idx
))) {
711 /* not part of a command token or response code */
714 if (toklen
+ 2 > tbuflen
) {
715 /* no room for this character and terminating '\0' */
718 tbuf
[toklen
] = *(pptr
+ idx
);
728 * Skip past any white space after the token, until we see
729 * an end-of-line (CR or LF).
731 for (; idx
< len
; idx
++) {
732 if (!ND_TTEST_1(pptr
+ idx
)) {
733 /* ran past end of captured data */
736 if (*(pptr
+ idx
) == '\r' || *(pptr
+ idx
) == '\n') {
740 if (!isascii(*(pptr
+ idx
)) || !isprint(*(pptr
+ idx
))) {
741 /* not a printable ASCII character */
744 if (!isspace(*(pptr
+ idx
))) {
745 /* beginning of next token */
753 * Scan a buffer looking for a line ending - LF or CR-LF.
754 * Return the index of the character after the line ending or 0 if
755 * we encounter a non-ASCII or non-printable character or don't find
759 print_txt_line(netdissect_options
*ndo
, const char *protoname
,
760 const char *prefix
, const u_char
*pptr
, u_int idx
, u_int len
)
767 ND_TCHECK_1(pptr
+ idx
);
768 if (*(pptr
+idx
) == '\n') {
770 * LF without CR; end of line.
771 * Skip the LF and print the line, with the
772 * exception of the LF.
774 linelen
= idx
- startidx
;
777 } else if (*(pptr
+idx
) == '\r') {
779 if ((idx
+1) >= len
) {
780 /* not in this packet */
783 ND_TCHECK_1(pptr
+ idx
+ 1);
784 if (*(pptr
+idx
+1) == '\n') {
786 * CR-LF; end of line.
787 * Skip the CR-LF and print the line, with
788 * the exception of the CR-LF.
790 linelen
= idx
- startidx
;
796 * CR followed by something else; treat this
797 * as if it were binary data, and don't print
801 } else if (!isascii(*(pptr
+idx
)) ||
802 (!isprint(*(pptr
+idx
)) && *(pptr
+idx
) != '\t')) {
804 * Not a printable ASCII character and not a tab;
805 * treat this as if it were binary data, and
814 * All printable ASCII, but no line ending after that point
815 * in the buffer; treat this as if it were truncated.
818 linelen
= idx
- startidx
;
819 ND_PRINT("%s%.*s[!%s]", prefix
, (int)linelen
, pptr
+ startidx
,
824 ND_PRINT("%s%.*s", prefix
, (int)linelen
, pptr
+ startidx
);
829 txtproto_print(netdissect_options
*ndo
, const u_char
*pptr
, u_int len
,
830 const char *protoname
, const char **cmds
, u_int flags
)
833 u_char token
[MAX_TOKEN
+1];
840 * This protocol has more than just request and
841 * response lines; see whether this looks like a
842 * request or response and, if so, print it and,
843 * in verbose mode, print everything after it.
845 * This is for HTTP-like protocols, where we
846 * want to print requests and responses, but
847 * don't want to print continuations of request
848 * or response bodies in packets that don't
849 * contain the request or response line.
851 idx
= fetch_token(ndo
, pptr
, 0, len
, token
, sizeof(token
));
853 /* Is this a valid request name? */
854 while ((cmd
= *cmds
++) != NULL
) {
855 if (ascii_strcasecmp((const char *)token
, cmd
) == 0) {
863 * No - is this a valid response code (3 digits)?
865 * Is this token the response code, or is the next
866 * token the response code?
868 if (flags
& RESP_CODE_SECOND_TOKEN
) {
870 * Next token - get it.
872 idx
= fetch_token(ndo
, pptr
, idx
, len
, token
,
876 if (isdigit(token
[0]) && isdigit(token
[1]) &&
877 isdigit(token
[2]) && token
[3] == '\0') {
887 * 1) This protocol has only request and response lines
888 * (e.g., FTP, where all the data goes over a different
889 * connection); assume the payload is a request or
894 * 2) This protocol is just text, so that we should
895 * always, at minimum, print the first line and,
896 * in verbose mode, print all lines.
901 /* Capitalize the protocol name */
902 for (pnp
= protoname
; *pnp
!= '\0'; pnp
++)
903 ND_PRINT("%c", toupper((u_char
)*pnp
));
907 * In non-verbose mode, just print the protocol, followed
910 * In verbose mode, print lines as text until we run out
911 * of characters or see something that's not a
912 * printable-ASCII line.
914 if (ndo
->ndo_vflag
) {
916 * We're going to print all the text lines in the
917 * request or response; just print the length
918 * on the first line of the output.
920 ND_PRINT(", length: %u", len
);
922 idx
< len
&& (eol
= print_txt_line(ndo
, protoname
, "\n\t", pptr
, idx
, len
)) != 0;
927 * Just print the first text line.
929 print_txt_line(ndo
, protoname
, ": ", pptr
, 0, len
);
935 safeputs(netdissect_options
*ndo
,
936 const u_char
*s
, const u_int maxlen
)
940 while (idx
< maxlen
&& EXTRACT_U_1(s
)) {
941 safeputchar(ndo
, EXTRACT_U_1(s
));
948 safeputchar(netdissect_options
*ndo
,
951 ND_PRINT((c
< 0x80 && ND_ISPRINT(c
)) ? "%c" : "\\0x%02x", c
);
954 #if (defined(__i386__) || defined(_M_IX86) || defined(__X86__) || defined(__x86_64__) || defined(_M_X64)) || \
955 (defined(__arm__) || defined(_M_ARM) || defined(__aarch64__)) || \
956 (defined(__m68k__) && (!defined(__mc68000__) && !defined(__mc68010__))) || \
957 (defined(__ppc__) || defined(__ppc64__) || defined(_M_PPC) || defined(_ARCH_PPC) || defined(_ARCH_PPC64)) || \
958 (defined(__s390__) || defined(__s390x__) || defined(__zarch__)) || \
961 * The procesor natively handles unaligned loads, so just use memcpy()
962 * and memcmp(), to enable those optimizations.
964 * XXX - are those all the x86 tests we need?
965 * XXX - do we need to worry about ARMv1 through ARMv5, which didn't
966 * support unaligned loads, and, if so, do we need to worry about all
967 * of them, or just some of them, e.g. ARMv5?
968 * XXX - are those the only 68k tests we need not to generated
969 * unaligned accesses if the target is the 68000 or 68010?
970 * XXX - are there any tests we don't need, because some definitions are for
971 * compilers that also predefine the GCC symbols?
972 * XXX - do we need to test for both 32-bit and 64-bit versions of those
973 * architectures in all cases?
977 * The processor doesn't natively handle unaligned loads,
978 * and the compiler might "helpfully" optimize memcpy()
979 * and memcmp(), when handed pointers that would normally
980 * be properly aligned, into sequences that assume proper
983 * Do copies and compares of possibly-unaligned data by
984 * calling routines that wrap memcpy() and memcmp(), to
985 * prevent that optimization.
988 unaligned_memcpy(void *p
, const void *q
, size_t l
)
993 /* As with memcpy(), so with memcmp(). */
995 unaligned_memcmp(const void *p
, const void *q
, size_t l
)
997 return (memcmp(p
, q
, l
));