2 * Routines for printing packet analysis trees.
4 * $Id: print.c,v 1.64 2003/12/06 06:09:10 gram Exp $
6 * Gilbert Ramirez <gram@alumni.rice.edu>
8 * Ethereal - Network traffic analyzer
9 * By Gerald Combs <gerald@ethereal.com>
10 * Copyright 1998 Gerald Combs
12 * This program is free software; you can redistribute it and/or
13 * modify it under the terms of the GNU General Public License
14 * as published by the Free Software Foundation; either version 2
15 * of the License, or (at your option) any later version.
17 * This program is distributed in the hope that it will be useful,
18 * but WITHOUT ANY WARRANTY; without even the implied warranty of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 * GNU General Public License for more details.
22 * You should have received a copy of the GNU General Public License
23 * along with this program; if not, write to the Free Software
24 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
34 #include <epan/epan.h>
35 #include <epan/epan_dissect.h>
36 #include <epan/tvbuff.h>
37 #include <epan/packet.h>
42 #include "packet-data.h"
43 #include "packet-frame.h"
45 #define PDML_VERSION "0"
47 static void proto_tree_print_node(proto_node *node, gpointer data);
48 static void proto_tree_print_node_pdml(proto_node *node, gpointer data);
49 static void print_hex_data_buffer(FILE *fh, register const guchar *cp,
50 register guint length, char_enc encoding, gint format);
51 static void ps_clean_string(unsigned char *out, const unsigned char *in,
58 gboolean print_all_levels;
59 gboolean print_hex_for_data;
65 static void print_pdml_geninfo(proto_tree *tree, print_data *pdata);
67 FILE *open_print_dest(int to_file, const char *dest)
71 /* Open the file or command for output */
73 fh = fopen(dest, "w");
75 fh = popen(dest, "w");
80 void close_print_dest(int to_file, FILE *fh)
82 /* Close the file or command */
91 proto_tree_print(print_args_t *print_args, epan_dissect_t *edt,
96 /* Create the output */
99 data.src_list = edt->pi.data_src;
100 data.encoding = edt->pi.fd->flags.encoding;
101 data.print_all_levels = print_args->expand_all;
102 data.print_hex_for_data = !print_args->print_hex;
103 /* If we're printing the entire packet in hex, don't
104 print uninterpreted data fields in hex as well. */
105 data.format = print_args->format;
108 if (data.format == PR_FMT_PDML) {
110 fprintf(fh, "<packet>\n");
112 /* Print a "geninfo" protocol as required by PDML */
113 print_pdml_geninfo(edt->tree, &data);
115 proto_tree_children_foreach(edt->tree, proto_tree_print_node_pdml, &data);
117 fprintf(fh, "</packet>\n\n");
120 proto_tree_children_foreach(edt->tree, proto_tree_print_node, &data);
125 * Find the data source for a specified field, and return a pointer
128 static const guint8 *
129 get_field_data(GSList *src_list, field_info *fi)
135 for (src_le = src_list; src_le != NULL; src_le = src_le->next) {
138 if (fi->ds_tvb == src_tvb) {
142 return tvb_get_ptr(src_tvb, fi->start, fi->length);
145 g_assert_not_reached();
146 return NULL; /* not found */
149 #define MAX_INDENT 160
151 #define MAX_PS_LINE_LENGTH 256
153 /* Print a tree's data, and any child nodes. */
155 void proto_tree_print_node(proto_node *node, gpointer data)
157 field_info *fi = PITEM_FINFO(node);
158 print_data *pdata = (print_data*) data;
160 gchar label_str[ITEM_LABEL_LENGTH];
163 /* Don't print invisible entries. */
167 /* was a free format label produced? */
169 label_ptr = fi->rep->representation;
171 else { /* no, make a generic label */
172 label_ptr = label_str;
173 proto_item_fill_label(fi, label_str);
176 print_line(pdata->fh, pdata->level, pdata->format, label_ptr);
178 /* If it's uninterpreted data, dump it (unless our caller will
179 be printing the entire packet in hex). */
180 if (fi->hfinfo->id == proto_data && pdata->print_hex_for_data) {
182 * Find the data for this field.
184 pd = get_field_data(pdata->src_list, fi);
185 print_hex_data_buffer(pdata->fh, pd, fi->length,
186 pdata->encoding, pdata->format);
189 /* If we're printing all levels, or if this node is one with a
190 subtree and its subtree is expanded, recurse into the subtree,
192 g_assert(fi->tree_type >= -1 && fi->tree_type < num_tree_types);
193 if (pdata->print_all_levels ||
194 (fi->tree_type >= 0 && tree_is_expanded[fi->tree_type])) {
195 if (node->first_child != NULL) {
197 proto_tree_children_foreach(node,
198 proto_tree_print_node, pdata);
204 /* Print a string, escaping out certain characters that need to
205 * escaped out for XML. */
207 print_escaped_xml(FILE *fh, char *unescaped_string)
211 for (p = unescaped_string; *p != '\0'; p++) {
232 print_field_hex_value(print_data *pdata, field_info *fi)
237 /* Find the data for this field. */
238 pd = get_field_data(pdata->src_list, fi);
240 /* Print a simple hex dump */
241 for (i = 0 ; i < fi->length; i++) {
242 fprintf(pdata->fh, "%02x", pd[i]);
247 /* Print a tree's data, and any child nodes, as PDML */
249 proto_tree_print_node_pdml(proto_node *node, gpointer data)
251 field_info *fi = PITEM_FINFO(node);
252 print_data *pdata = (print_data*) data;
254 gchar label_str[ITEM_LABEL_LENGTH];
255 char *dfilter_string;
259 for (i = -1; i < pdata->level; i++) {
260 fputs(" ", pdata->fh);
263 /* Text label. It's printed as a field with no name. */
264 if (fi->hfinfo->id == hf_text_only) {
267 label_ptr = fi->rep->representation;
273 fputs("<field show=\"", pdata->fh);
274 print_escaped_xml(pdata->fh, label_ptr);
276 fprintf(pdata->fh, "\" size=\"%d", fi->length);
277 fprintf(pdata->fh, "\" pos=\"%d", fi->start);
279 fputs("\" value=\"", pdata->fh);
280 print_field_hex_value(pdata, fi);
282 if (node->first_child != NULL) {
283 fputs("\">\n", pdata->fh);
286 fputs("\"/>\n", pdata->fh);
289 /* Uninterpreted data, i.e., the "Data" protocol, is
290 * printed as a field instead of a protocol. */
291 else if (fi->hfinfo->id == proto_data) {
293 fputs("<field name=\"data\" value=\"", pdata->fh);
295 print_field_hex_value(pdata, fi);
297 fputs("\"/>\n", pdata->fh);
300 /* Normal protocols and fields */
302 if (fi->hfinfo->type == FT_PROTOCOL) {
303 fputs("<proto name=\"", pdata->fh);
306 fputs("<field name=\"", pdata->fh);
308 print_escaped_xml(pdata->fh, fi->hfinfo->abbrev);
311 fputs("\" showname=\"", pdata->fh);
312 print_escaped_xml(pdata->fh, fi->rep->representation);
315 label_ptr = label_str;
316 proto_item_fill_label(fi, label_str);
317 fputs("\" showname=\"", pdata->fh);
318 print_escaped_xml(pdata->fh, label_ptr);
321 fprintf(pdata->fh, "\" size=\"%d", fi->length);
322 fprintf(pdata->fh, "\" pos=\"%d", fi->start);
323 /* fprintf(pdata->fh, "\" id=\"%d", fi->hfinfo->id);*/
325 if (fi->hfinfo->type != FT_PROTOCOL) {
328 /* XXX - this is a hack until we can juse call
329 * fvalue_to_string_repr() for *all* FT_* types. */
330 dfilter_string = proto_construct_dfilter_string(fi,
332 chop_len = strlen(fi->hfinfo->abbrev) + 4; /* for " == " */
334 /* XXX - Remove double-quotes. Again, once we can call
335 * fvalue_to_string_repr(), we can ask it not to
336 * produce the version for display-filters, and thus,
337 * no double-quotes. */
338 if (dfilter_string[strlen(dfilter_string)-1] == '"') {
339 dfilter_string[strlen(dfilter_string)-1] = '\0';
343 fputs("\" show=\"", pdata->fh);
344 print_escaped_xml(pdata->fh, &dfilter_string[chop_len]);
347 if (fi->hfinfo->type != FT_PROTOCOL && fi->length > 0) {
348 fputs("\" value=\"", pdata->fh);
349 print_field_hex_value(pdata, fi);
352 if (node->first_child != NULL) {
353 fputs("\">\n", pdata->fh);
355 else if (fi->hfinfo->id == proto_data) {
356 fputs("\">\n", pdata->fh);
359 fputs("\"/>\n", pdata->fh);
363 /* We always pring all levels for PDML. Recurse here. */
364 if (node->first_child != NULL) {
366 proto_tree_children_foreach(node,
367 proto_tree_print_node_pdml, pdata);
371 if (node->first_child != NULL) {
372 for (i = -1; i < pdata->level; i++) {
373 fputs(" ", pdata->fh);
375 if (fi->hfinfo->type == FT_PROTOCOL) {
376 fputs("</proto>\n", pdata->fh);
379 fputs("</field>\n", pdata->fh);
384 /* Print info for a 'geninfo' pseudo-protocol. This is required by
385 * the PDML spec. The information is contained in Ethereal's 'frame' protocol,
386 * but we produce a 'geninfo' protocol in the PDML to conform to spec.
387 * The 'frame' protocol follows the 'geninfo' protocol in the PDML. */
389 print_pdml_geninfo(proto_tree *tree, print_data *pdata)
391 guint32 num, len, caplen;
393 GPtrArray *finfo_array;
394 field_info *frame_finfo;
396 /* Get frame protocol's finfo. */
397 finfo_array = proto_find_finfo(tree, proto_frame);
398 if (g_ptr_array_len(finfo_array) < 1) {
401 frame_finfo = finfo_array->pdata[0];
402 g_ptr_array_free(finfo_array, FALSE);
404 /* frame.number --> geninfo.num */
405 finfo_array = proto_find_finfo(tree, hf_frame_number);
406 if (g_ptr_array_len(finfo_array) < 1) {
409 num = fvalue_get_integer(&((field_info*)finfo_array->pdata[0])->value);
410 g_ptr_array_free(finfo_array, FALSE);
412 /* frame.pkt_len --> geninfo.len */
413 finfo_array = proto_find_finfo(tree, hf_frame_packet_len);
414 if (g_ptr_array_len(finfo_array) < 1) {
417 len = fvalue_get_integer(&((field_info*)finfo_array->pdata[0])->value);
418 g_ptr_array_free(finfo_array, FALSE);
420 /* frame.cap_len --> geninfo.caplen */
421 finfo_array = proto_find_finfo(tree, hf_frame_capture_len);
422 if (g_ptr_array_len(finfo_array) < 1) {
425 caplen = fvalue_get_integer(&((field_info*)finfo_array->pdata[0])->value);
426 g_ptr_array_free(finfo_array, FALSE);
428 /* frame.time --> geninfo.timestamp */
429 finfo_array = proto_find_finfo(tree, hf_frame_arrival_time);
430 if (g_ptr_array_len(finfo_array) < 1) {
433 timestamp = fvalue_get(&((field_info*)finfo_array->pdata[0])->value);
434 g_ptr_array_free(finfo_array, FALSE);
436 /* Print geninfo start */
438 " <proto name=\"geninfo\" pos=\"1\" showname=\"General information\" size=\"%u\">\n",
439 frame_finfo->length);
441 /* Print geninfo.num */
443 " <field name=\"num\" pos=\"1\" show=\"%u\" showname=\"Number\" value=\"%x\" size=\"%u\"/>\n",
444 num, num, frame_finfo->length);
446 /* Print geninfo.len */
448 " <field name=\"len\" pos=\"1\" show=\"%u\" showname=\"Packet Length\" value=\"%x\" size=\"%u\"/>\n",
449 len, len, frame_finfo->length);
451 /* Print geninfo.caplen */
453 " <field name=\"caplen\" pos=\"1\" show=\"%u\" showname=\"Captured Length\" value=\"%x\" size=\"%u\"/>\n",
454 caplen, caplen, frame_finfo->length);
456 /* Print geninfo.timestamp */
458 " <field name=\"timestamp\" pos=\"1\" show=\"%s\" showname=\"Captured Time\" value=\"%d.%09d\" size=\"%u\"/>\n",
459 abs_time_to_str(timestamp), (int) timestamp->secs, timestamp->nsecs, frame_finfo->length);
461 /* Print geninfo end */
467 void print_hex_data(FILE *fh, gint format, epan_dissect_t *edt)
469 gboolean multiple_sources;
479 * Set "multiple_sources" iff this frame has more than one
480 * data source; if it does, we need to print the name of
481 * the data source before printing the data from the
484 multiple_sources = (edt->pi.data_src->next != NULL);
486 for (src_le = edt->pi.data_src; src_le != NULL;
487 src_le = src_le->next) {
490 if (multiple_sources) {
492 print_line(fh, 0, format, "");
493 line = g_malloc(strlen(name) + 2); /* <name>:\0 */
496 print_line(fh, 0, format, line);
499 length = tvb_length(tvb);
500 cp = tvb_get_ptr(tvb, 0, length);
501 print_hex_data_buffer(fh, cp, length,
502 edt->pi.fd->flags.encoding, format);
507 * This routine is based on a routine created by Dan Lasley
508 * <DLASLEY@PROMUS.com>.
510 * It was modified for Ethereal by Gilbert Ramirez and others.
513 #define MAX_OFFSET_LEN 8 /* max length of hex offset of bytes */
514 #define BYTES_PER_LINE 16 /* max byte values printed on a line */
515 #define HEX_DUMP_LEN (BYTES_PER_LINE*3)
516 /* max number of characters hex dump takes -
517 2 digits plus trailing blank */
518 #define DATA_DUMP_LEN (HEX_DUMP_LEN + 2 + BYTES_PER_LINE)
519 /* number of characters those bytes take;
520 3 characters per byte of hex dump,
521 2 blanks separating hex from ASCII,
522 1 character per byte of ASCII dump */
523 #define MAX_LINE_LEN (MAX_OFFSET_LEN + 2 + DATA_DUMP_LEN)
524 /* number of characters per line;
525 offset, 2 blanks separating offset
526 from data dump, data dump */
529 print_hex_data_buffer(FILE *fh, register const guchar *cp,
530 register guint length, char_enc encoding, gint format)
532 register unsigned int ad, i, j, k, l;
534 guchar line[MAX_LINE_LEN + 1];
535 unsigned int use_digits;
536 static guchar binhex[16] = {
537 '0', '1', '2', '3', '4', '5', '6', '7',
538 '8', '9', 'a', 'b', 'c', 'd', 'e', 'f'};
540 print_line(fh, 0, format, "");
543 * How many of the leading digits of the offset will we supply?
544 * We always supply at least 4 digits, but if the maximum offset
545 * won't fit in 4 digits, we use as many digits as will be needed.
547 if (((length - 1) & 0xF0000000) != 0)
548 use_digits = 8; /* need all 8 digits */
549 else if (((length - 1) & 0x0F000000) != 0)
550 use_digits = 7; /* need 7 digits */
551 else if (((length - 1) & 0x00F00000) != 0)
552 use_digits = 6; /* need 6 digits */
553 else if (((length - 1) & 0x000F0000) != 0)
554 use_digits = 5; /* need 5 digits */
556 use_digits = 4; /* we'll supply 4 digits */
565 * Start of a new line.
572 c = (ad >> (l*4)) & 0xF;
573 line[j++] = binhex[c];
577 memset(line+j, ' ', DATA_DUMP_LEN);
580 * Offset in line of ASCII dump.
582 k = j + HEX_DUMP_LEN + 2;
585 line[j++] = binhex[c>>4];
586 line[j++] = binhex[c&0xf];
588 if (encoding == CHAR_EBCDIC) {
589 c = EBCDIC_to_ASCII1(c);
591 line[k++] = c >= ' ' && c < 0x7f ? c : '.';
593 if ((i & 15) == 0 || i == length) {
595 * We'll be starting a new line, or
596 * we're finished printing this buffer;
597 * dump out the line we've constructed,
598 * and advance the offset.
601 print_line(fh, 0, format, line);
608 void ps_clean_string(unsigned char *out, const unsigned char *in,
614 for (rd = 0, wr = 0 ; wr < outbuf_size; rd++, wr++ ) {
635 /* Some formats need stuff at the beginning of the output */
637 print_preamble(FILE *fh, gint format)
639 if (format == PR_FMT_PS)
640 print_ps_preamble(fh);
641 else if (format == PR_FMT_PDML) {
642 fputs("<?xml version=\"1.0\"?>\n", fh);
643 fputs("<pdml version=\"" PDML_VERSION "\" ", fh);
644 fprintf(fh, "creator=\"%s/%s\">\n", PACKAGE, VERSION);
648 /* Some formats need stuff at the end of the output */
650 print_finale(FILE *fh, gint format)
652 if (format == PR_FMT_PS)
654 else if (format == PR_FMT_PDML) {
655 fputs("</pdml>\n", fh);
660 print_line(FILE *fh, int indent, gint format, char *line)
662 char space[MAX_INDENT+1];
665 char psbuffer[MAX_PS_LINE_LENGTH]; /* static sized buffer! */
667 if (format == PR_FMT_PS) {
668 ps_clean_string(psbuffer, line, MAX_PS_LINE_LENGTH);
669 fprintf(fh, "%d (%s) putline\n", indent, psbuffer);
671 else if (format == PR_FMT_TEXT) {
672 /* Prepare the tabs for printing, depending on tree level */
673 num_spaces = indent * 4;
674 if (num_spaces > MAX_INDENT) {
675 num_spaces = MAX_INDENT;
677 for (i = 0; i < num_spaces; i++) {
680 /* The string is NUL-terminated */
681 space[num_spaces] = '\0';
688 g_assert_not_reached();