2 * Routines for printing packet analysis trees.
4 * $Id: print.c,v 1.81 2004/05/01 15:15:08 ulfl Exp $
6 * Gilbert Ramirez <gram@alumni.rice.edu>
8 * Ethereal - Network traffic analyzer
9 * By Gerald Combs <gerald@ethereal.com>
10 * Copyright 1998 Gerald Combs
12 * This program is free software; you can redistribute it and/or
13 * modify it under the terms of the GNU General Public License
14 * as published by the Free Software Foundation; either version 2
15 * of the License, or (at your option) any later version.
17 * This program is distributed in the hope that it will be useful,
18 * but WITHOUT ANY WARRANTY; without even the implied warranty of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 * GNU General Public License for more details.
22 * You should have received a copy of the GNU General Public License
23 * along with this program; if not, write to the Free Software
24 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
34 #include <epan/epan.h>
35 #include <epan/epan_dissect.h>
36 #include <epan/tvbuff.h>
37 #include <epan/packet.h>
43 #include "packet-data.h"
44 #include "packet-frame.h"
46 #define PDML_VERSION "0"
47 #define PSML_VERSION "0"
49 static void proto_tree_print_node(proto_node *node, gpointer data);
50 static void proto_tree_print_node_pdml(proto_node *node, gpointer data);
51 static void print_hex_data_buffer(FILE *fh, register const guchar *cp,
52 register guint length, char_enc encoding, print_format_e format);
53 static void ps_clean_string(unsigned char *out, const unsigned char *in,
55 static void print_escaped_xml(FILE *fh, char *unescaped_string);
61 print_dissections_e print_dissections;
62 gboolean print_hex_for_data;
68 static void print_pdml_geninfo(proto_tree *tree, print_data *pdata);
70 FILE *open_print_dest(int to_file, const char *dest)
74 /* Open the file or command for output */
76 fh = fopen(dest, "w");
78 fh = popen(dest, "w");
83 gboolean close_print_dest(int to_file, FILE *fh)
85 /* Close the file or command */
87 return (fclose(fh) == 0);
89 return (pclose(fh) == 0);
94 proto_tree_print(print_args_t *print_args, epan_dissect_t *edt,
100 /* Create the output */
103 data.src_list = edt->pi.data_src;
104 data.encoding = edt->pi.fd->flags.encoding;
105 data.print_dissections = print_args->print_dissections;
106 data.print_hex_for_data = !print_args->print_hex;
107 /* If we're printing the entire packet in hex, don't
108 print uninterpreted data fields in hex as well. */
109 data.format = print_args->format;
112 switch(data.format) {
113 case(PR_FMT_TEXT): /* fall through */
115 proto_tree_children_foreach(edt->tree, proto_tree_print_node, &data);
118 fprintf(fh, "<packet>\n");
120 /* Print a "geninfo" protocol as required by PDML */
121 print_pdml_geninfo(edt->tree, &data);
123 proto_tree_children_foreach(edt->tree, proto_tree_print_node_pdml, &data);
125 fprintf(fh, "</packet>\n\n");
128 /* if this is the first packet, we have to create the PSML structure output */
129 if(edt->pi.fd->num == 1) {
130 fprintf(fh, "<structure>\n");
132 for(i=0; i < edt->pi.cinfo->num_cols; i++) {
133 fprintf(fh, "<section>");
134 print_escaped_xml(fh, edt->pi.cinfo->col_title[i]);
135 fprintf(fh, "</section>\n");
138 fprintf(fh, "</structure>\n\n");
141 fprintf(fh, "<packet>\n");
143 for(i=0; i < edt->pi.cinfo->num_cols; i++) {
144 fprintf(fh, "<section>");
145 print_escaped_xml(fh, edt->pi.cinfo->col_data[i]);
146 fprintf(fh, "</section>\n");
149 fprintf(fh, "</packet>\n\n");
152 g_assert_not_reached();
157 * Find the data source for a specified field, and return a pointer
158 * to the data in it. Returns NULL if the data is out of bounds.
160 static const guint8 *
161 get_field_data(GSList *src_list, field_info *fi)
166 gint length, tvbuff_length;
168 for (src_le = src_list; src_le != NULL; src_le = src_le->next) {
171 if (fi->ds_tvb == src_tvb) {
175 * XXX - a field can have a length that runs past
176 * the end of the tvbuff. Ideally, that should
177 * be fixed when adding an item to the protocol
178 * tree, but checking the length when doing
179 * that could be expensive. Until we fix that,
180 * we'll do the check here.
182 tvbuff_length = tvb_length_remaining(src_tvb,
184 if (tvbuff_length < 0) {
188 if (length > tvbuff_length)
189 length = tvbuff_length;
190 return tvb_get_ptr(src_tvb, fi->start, length);
193 g_assert_not_reached();
194 return NULL; /* not found */
197 #define MAX_INDENT 160
199 #define MAX_PS_LINE_LENGTH 256
201 /* Print a tree's data, and any child nodes. */
203 void proto_tree_print_node(proto_node *node, gpointer data)
205 field_info *fi = PITEM_FINFO(node);
206 print_data *pdata = (print_data*) data;
208 gchar label_str[ITEM_LABEL_LENGTH];
211 /* Don't print invisible entries. */
212 if (PROTO_ITEM_IS_HIDDEN(node))
215 /* was a free format label produced? */
217 label_ptr = fi->rep->representation;
219 else { /* no, make a generic label */
220 label_ptr = label_str;
221 proto_item_fill_label(fi, label_str);
224 print_line(pdata->fh, pdata->level, pdata->format, label_ptr);
226 /* If it's uninterpreted data, dump it (unless our caller will
227 be printing the entire packet in hex). */
228 if (fi->hfinfo->id == proto_data && pdata->print_hex_for_data) {
230 * Find the data for this field.
232 pd = get_field_data(pdata->src_list, fi);
234 print_hex_data_buffer(pdata->fh, pd, fi->length,
235 pdata->encoding, pdata->format);
239 /* If we're printing all levels, or if this node is one with a
240 subtree and its subtree is expanded, recurse into the subtree,
242 g_assert(fi->tree_type >= -1 && fi->tree_type < num_tree_types);
243 if (pdata->print_dissections == print_dissections_expanded ||
244 (pdata->print_dissections == print_dissections_as_displayed &&
245 fi->tree_type >= 0 && tree_is_expanded[fi->tree_type])) {
246 if (node->first_child != NULL) {
248 proto_tree_children_foreach(node,
249 proto_tree_print_node, pdata);
255 /* Print a string, escaping out certain characters that need to
256 * escaped out for XML. */
258 print_escaped_xml(FILE *fh, char *unescaped_string)
262 for (p = unescaped_string; *p != '\0'; p++) {
283 print_field_hex_value(print_data *pdata, field_info *fi)
288 /* Find the data for this field. */
289 pd = get_field_data(pdata->src_list, fi);
292 /* Print a simple hex dump */
293 for (i = 0 ; i < fi->length; i++) {
294 fprintf(pdata->fh, "%02x", pd[i]);
300 /* Print a tree's data, and any child nodes, as PDML */
302 proto_tree_print_node_pdml(proto_node *node, gpointer data)
304 field_info *fi = PITEM_FINFO(node);
305 print_data *pdata = (print_data*) data;
307 gchar label_str[ITEM_LABEL_LENGTH];
308 char *dfilter_string;
312 for (i = -1; i < pdata->level; i++) {
313 fputs(" ", pdata->fh);
316 /* Text label. It's printed as a field with no name. */
317 if (fi->hfinfo->id == hf_text_only) {
320 label_ptr = fi->rep->representation;
326 fputs("<field show=\"", pdata->fh);
327 print_escaped_xml(pdata->fh, label_ptr);
329 fprintf(pdata->fh, "\" size=\"%d", fi->length);
330 fprintf(pdata->fh, "\" pos=\"%d", fi->start);
332 fputs("\" value=\"", pdata->fh);
333 print_field_hex_value(pdata, fi);
335 if (node->first_child != NULL) {
336 fputs("\">\n", pdata->fh);
339 fputs("\"/>\n", pdata->fh);
342 /* Uninterpreted data, i.e., the "Data" protocol, is
343 * printed as a field instead of a protocol. */
344 else if (fi->hfinfo->id == proto_data) {
346 fputs("<field name=\"data\" value=\"", pdata->fh);
348 print_field_hex_value(pdata, fi);
350 fputs("\"/>\n", pdata->fh);
353 /* Normal protocols and fields */
355 if (fi->hfinfo->type == FT_PROTOCOL) {
356 fputs("<proto name=\"", pdata->fh);
359 fputs("<field name=\"", pdata->fh);
361 print_escaped_xml(pdata->fh, fi->hfinfo->abbrev);
365 * http://analyzer.polito.it/30alpha/docs/dissectors/PDMLSpec.htm
367 * the show fields contains things in 'human readable' format
368 * showname: contains only the name of the field
369 * show: contains only the data of the field
370 * showdtl: contains additional details of the field data
371 * showmap: contains mappings of the field data (e.g. the hostname to an IP address)
373 * XXX - the showname shouldn't contain the field data itself
374 * (like it's contained in the fi->rep->representation).
375 * Unfortunately, we don't have the field data representation for
376 * all fields, so this isn't currently possible */
377 fputs("\" showname=\"", pdata->fh);
378 print_escaped_xml(pdata->fh, fi->hfinfo->name);
382 fputs("\" showname=\"", pdata->fh);
383 print_escaped_xml(pdata->fh, fi->rep->representation);
386 label_ptr = label_str;
387 proto_item_fill_label(fi, label_str);
388 fputs("\" showname=\"", pdata->fh);
389 print_escaped_xml(pdata->fh, label_ptr);
392 if(PROTO_ITEM_IS_HIDDEN(node)) {
393 fprintf(pdata->fh, "\" hide=\"yes");
396 fprintf(pdata->fh, "\" size=\"%d", fi->length);
397 fprintf(pdata->fh, "\" pos=\"%d", fi->start);
398 /* fprintf(pdata->fh, "\" id=\"%d", fi->hfinfo->id);*/
400 if (fi->hfinfo->type != FT_PROTOCOL) {
403 /* XXX - this is a hack until we can just call
404 * fvalue_to_string_repr() for *all* FT_* types. */
405 dfilter_string = proto_construct_dfilter_string(fi,
407 if (dfilter_string != NULL) {
408 chop_len = strlen(fi->hfinfo->abbrev) + 4; /* for " == " */
410 /* XXX - Remove double-quotes. Again, once we
411 * can call fvalue_to_string_repr(), we can
412 * ask it not to produce the version for
413 * display-filters, and thus, no
415 if (dfilter_string[strlen(dfilter_string)-1] == '"') {
416 dfilter_string[strlen(dfilter_string)-1] = '\0';
420 fputs("\" show=\"", pdata->fh);
421 print_escaped_xml(pdata->fh, &dfilter_string[chop_len]);
423 if (fi->length > 0) {
424 fputs("\" value=\"", pdata->fh);
425 print_field_hex_value(pdata, fi);
429 if (node->first_child != NULL) {
430 fputs("\">\n", pdata->fh);
432 else if (fi->hfinfo->id == proto_data) {
433 fputs("\">\n", pdata->fh);
436 fputs("\"/>\n", pdata->fh);
440 /* We always print all levels for PDML. Recurse here. */
441 if (node->first_child != NULL) {
443 proto_tree_children_foreach(node,
444 proto_tree_print_node_pdml, pdata);
448 if (node->first_child != NULL) {
449 for (i = -1; i < pdata->level; i++) {
450 fputs(" ", pdata->fh);
452 if (fi->hfinfo->type == FT_PROTOCOL) {
453 fputs("</proto>\n", pdata->fh);
456 fputs("</field>\n", pdata->fh);
461 /* Print info for a 'geninfo' pseudo-protocol. This is required by
462 * the PDML spec. The information is contained in Ethereal's 'frame' protocol,
463 * but we produce a 'geninfo' protocol in the PDML to conform to spec.
464 * The 'frame' protocol follows the 'geninfo' protocol in the PDML. */
466 print_pdml_geninfo(proto_tree *tree, print_data *pdata)
468 guint32 num, len, caplen;
470 GPtrArray *finfo_array;
471 field_info *frame_finfo;
473 /* Get frame protocol's finfo. */
474 finfo_array = proto_find_finfo(tree, proto_frame);
475 if (g_ptr_array_len(finfo_array) < 1) {
478 frame_finfo = finfo_array->pdata[0];
479 g_ptr_array_free(finfo_array, FALSE);
481 /* frame.number --> geninfo.num */
482 finfo_array = proto_find_finfo(tree, hf_frame_number);
483 if (g_ptr_array_len(finfo_array) < 1) {
486 num = fvalue_get_integer(&((field_info*)finfo_array->pdata[0])->value);
487 g_ptr_array_free(finfo_array, FALSE);
489 /* frame.pkt_len --> geninfo.len */
490 finfo_array = proto_find_finfo(tree, hf_frame_packet_len);
491 if (g_ptr_array_len(finfo_array) < 1) {
494 len = fvalue_get_integer(&((field_info*)finfo_array->pdata[0])->value);
495 g_ptr_array_free(finfo_array, FALSE);
497 /* frame.cap_len --> geninfo.caplen */
498 finfo_array = proto_find_finfo(tree, hf_frame_capture_len);
499 if (g_ptr_array_len(finfo_array) < 1) {
502 caplen = fvalue_get_integer(&((field_info*)finfo_array->pdata[0])->value);
503 g_ptr_array_free(finfo_array, FALSE);
505 /* frame.time --> geninfo.timestamp */
506 finfo_array = proto_find_finfo(tree, hf_frame_arrival_time);
507 if (g_ptr_array_len(finfo_array) < 1) {
510 timestamp = fvalue_get(&((field_info*)finfo_array->pdata[0])->value);
511 g_ptr_array_free(finfo_array, FALSE);
513 /* Print geninfo start */
515 " <proto name=\"geninfo\" pos=\"0\" showname=\"General information\" size=\"%u\">\n",
516 frame_finfo->length);
518 /* Print geninfo.num */
520 " <field name=\"num\" pos=\"0\" show=\"%u\" showname=\"Number\" value=\"%x\" size=\"%u\"/>\n",
521 num, num, frame_finfo->length);
523 /* Print geninfo.len */
525 " <field name=\"len\" pos=\"0\" show=\"%u\" showname=\"Packet Length\" value=\"%x\" size=\"%u\"/>\n",
526 len, len, frame_finfo->length);
528 /* Print geninfo.caplen */
530 " <field name=\"caplen\" pos=\"0\" show=\"%u\" showname=\"Captured Length\" value=\"%x\" size=\"%u\"/>\n",
531 caplen, caplen, frame_finfo->length);
533 /* Print geninfo.timestamp */
535 " <field name=\"timestamp\" pos=\"0\" show=\"%s\" showname=\"Captured Time\" value=\"%d.%09d\" size=\"%u\"/>\n",
536 abs_time_to_str(timestamp), (int) timestamp->secs, timestamp->nsecs, frame_finfo->length);
538 /* Print geninfo end */
544 void print_hex_data(FILE *fh, print_format_e format, epan_dissect_t *edt)
546 gboolean multiple_sources;
556 * Set "multiple_sources" iff this frame has more than one
557 * data source; if it does, we need to print the name of
558 * the data source before printing the data from the
561 multiple_sources = (edt->pi.data_src->next != NULL);
563 for (src_le = edt->pi.data_src; src_le != NULL;
564 src_le = src_le->next) {
567 if (multiple_sources) {
569 print_line(fh, 0, format, "");
570 line = g_malloc(strlen(name) + 2); /* <name>:\0 */
573 print_line(fh, 0, format, line);
576 length = tvb_length(tvb);
577 cp = tvb_get_ptr(tvb, 0, length);
578 print_hex_data_buffer(fh, cp, length,
579 edt->pi.fd->flags.encoding, format);
584 * This routine is based on a routine created by Dan Lasley
585 * <DLASLEY@PROMUS.com>.
587 * It was modified for Ethereal by Gilbert Ramirez and others.
590 #define MAX_OFFSET_LEN 8 /* max length of hex offset of bytes */
591 #define BYTES_PER_LINE 16 /* max byte values printed on a line */
592 #define HEX_DUMP_LEN (BYTES_PER_LINE*3)
593 /* max number of characters hex dump takes -
594 2 digits plus trailing blank */
595 #define DATA_DUMP_LEN (HEX_DUMP_LEN + 2 + BYTES_PER_LINE)
596 /* number of characters those bytes take;
597 3 characters per byte of hex dump,
598 2 blanks separating hex from ASCII,
599 1 character per byte of ASCII dump */
600 #define MAX_LINE_LEN (MAX_OFFSET_LEN + 2 + DATA_DUMP_LEN)
601 /* number of characters per line;
602 offset, 2 blanks separating offset
603 from data dump, data dump */
606 print_hex_data_buffer(FILE *fh, register const guchar *cp,
607 register guint length, char_enc encoding, print_format_e format)
609 register unsigned int ad, i, j, k, l;
611 guchar line[MAX_LINE_LEN + 1];
612 unsigned int use_digits;
613 static guchar binhex[16] = {
614 '0', '1', '2', '3', '4', '5', '6', '7',
615 '8', '9', 'a', 'b', 'c', 'd', 'e', 'f'};
617 print_line(fh, 0, format, "");
620 * How many of the leading digits of the offset will we supply?
621 * We always supply at least 4 digits, but if the maximum offset
622 * won't fit in 4 digits, we use as many digits as will be needed.
624 if (((length - 1) & 0xF0000000) != 0)
625 use_digits = 8; /* need all 8 digits */
626 else if (((length - 1) & 0x0F000000) != 0)
627 use_digits = 7; /* need 7 digits */
628 else if (((length - 1) & 0x00F00000) != 0)
629 use_digits = 6; /* need 6 digits */
630 else if (((length - 1) & 0x000F0000) != 0)
631 use_digits = 5; /* need 5 digits */
633 use_digits = 4; /* we'll supply 4 digits */
642 * Start of a new line.
649 c = (ad >> (l*4)) & 0xF;
650 line[j++] = binhex[c];
654 memset(line+j, ' ', DATA_DUMP_LEN);
657 * Offset in line of ASCII dump.
659 k = j + HEX_DUMP_LEN + 2;
662 line[j++] = binhex[c>>4];
663 line[j++] = binhex[c&0xf];
665 if (encoding == CHAR_EBCDIC) {
666 c = EBCDIC_to_ASCII1(c);
668 line[k++] = c >= ' ' && c < 0x7f ? c : '.';
670 if ((i & 15) == 0 || i == length) {
672 * We'll be starting a new line, or
673 * we're finished printing this buffer;
674 * dump out the line we've constructed,
675 * and advance the offset.
678 print_line(fh, 0, format, line);
685 void ps_clean_string(unsigned char *out, const unsigned char *in,
691 for (rd = 0, wr = 0 ; wr < outbuf_size; rd++, wr++ ) {
712 /* Some formats need stuff at the beginning of the output */
714 print_preamble(FILE *fh, print_format_e format, gchar *filename)
716 char psbuffer[MAX_PS_LINE_LENGTH]; /* static sized buffer! */
724 print_ps_preamble(fh);
726 fputs("%% Set the font to 10 point\n", fh);
727 fputs("/Courier findfont 10 scalefont setfont\n", fh);
729 fputs("%% the page title\n", fh);
730 ps_clean_string(psbuffer, filename, MAX_PS_LINE_LENGTH);
731 fprintf(fh, "/eth_pagetitle (%s - Ethereal) def\n", psbuffer);
735 fputs("<?xml version=\"1.0\"?>\n", fh);
736 fputs("<pdml version=\"" PDML_VERSION "\" ", fh);
737 fprintf(fh, "creator=\"%s/%s\">\n", PACKAGE, VERSION);
740 fputs("<?xml version=\"1.0\"?>\n", fh);
741 fputs("<psml version=\"" PSML_VERSION "\" ", fh);
742 fprintf(fh, "creator=\"%s/%s\">\n", PACKAGE, VERSION);
745 g_assert_not_reached();
750 print_packet_header(FILE *fh, print_format_e format, guint32 number, gchar *summary) {
751 char psbuffer[MAX_PS_LINE_LENGTH]; /* static sized buffer! */
759 ps_clean_string(psbuffer, summary, MAX_PS_LINE_LENGTH);
760 fprintf(fh, "[/Dest /__frame%u__ /Title (%s) /OUT pdfmark\n", number, psbuffer);
761 fputs("[/View [/XYZ -4 currentpoint matrix currentmatrix matrix defaultmatrix\n", fh);
762 fputs("matrix invertmatrix matrix concatmatrix transform exch pop 20 add null]\n", fh);
763 fprintf(fh, "/Dest /__frame%u__ /DEST pdfmark\n", number);
772 g_assert_not_reached();
777 print_formfeed(FILE *fh, print_format_e format) {
783 fputs("formfeed\n", fh);
792 g_assert_not_reached();
796 /* Some formats need stuff at the end of the output */
798 print_finale(FILE *fh, print_format_e format)
808 fputs("</pdml>\n", fh);
811 fputs("</psml>\n", fh);
814 g_assert_not_reached();
819 print_line(FILE *fh, int indent, print_format_e format, char *line)
821 char space[MAX_INDENT+1];
824 char psbuffer[MAX_PS_LINE_LENGTH]; /* static sized buffer! */
828 /* Prepare the tabs for printing, depending on tree level */
829 num_spaces = indent * 4;
830 if (num_spaces > MAX_INDENT) {
831 num_spaces = MAX_INDENT;
833 for (i = 0; i < num_spaces; i++) {
836 /* The string is NUL-terminated */
837 space[num_spaces] = '\0';
844 ps_clean_string(psbuffer, line, MAX_PS_LINE_LENGTH);
845 fprintf(fh, "%d (%s) putline\n", indent, psbuffer);
854 g_assert_not_reached();