2 * Routines for printing packet analysis trees.
6 * Gilbert Ramirez <gram@alumni.rice.edu>
8 * Ethereal - Network traffic analyzer
9 * By Gerald Combs <gerald@ethereal.com>
10 * Copyright 1998 Gerald Combs
12 * This program is free software; you can redistribute it and/or
13 * modify it under the terms of the GNU General Public License
14 * as published by the Free Software Foundation; either version 2
15 * of the License, or (at your option) any later version.
17 * This program is distributed in the hope that it will be useful,
18 * but WITHOUT ANY WARRANTY; without even the implied warranty of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 * GNU General Public License for more details.
22 * You should have received a copy of the GNU General Public License
23 * along with this program; if not, write to the Free Software
24 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
34 #include <epan/epan.h>
35 #include <epan/epan_dissect.h>
36 #include <epan/tvbuff.h>
37 #include <epan/packet.h>
43 #include <epan/dissectors/packet-data.h>
44 #include <epan/dissectors/packet-frame.h>
46 #define PDML_VERSION "0"
47 #define PSML_VERSION "0"
53 print_dissections_e print_dissections;
54 gboolean print_hex_for_data;
67 static void proto_tree_print_node(proto_node *node, gpointer data);
68 static void proto_tree_write_node_pdml(proto_node *node, gpointer data);
69 static const guint8 *get_field_data(GSList *src_list, field_info *fi);
70 static void write_pdml_field_hex_value(write_pdml_data *pdata, field_info *fi);
71 static void print_hex_data_buffer(FILE *fh, register const guchar *cp,
72 register guint length, char_enc encoding, print_format_e format);
73 static void ps_clean_string(unsigned char *out, const unsigned char *in,
75 static void print_escaped_xml(FILE *fh, char *unescaped_string);
77 static void print_pdml_geninfo(proto_tree *tree, FILE *fh);
79 FILE *open_print_dest(int to_file, const char *dest)
83 /* Open the file or command for output */
85 fh = fopen(dest, "w");
87 fh = popen(dest, "w");
92 gboolean close_print_dest(int to_file, FILE *fh)
94 /* Close the file or command */
96 return (fclose(fh) == 0);
98 return (pclose(fh) == 0);
101 #define MAX_PS_LINE_LENGTH 256
103 /* Some formats need stuff at the beginning of the output */
105 print_preamble(FILE *fh, print_format_e format, gchar *filename)
107 char psbuffer[MAX_PS_LINE_LENGTH]; /* static sized buffer! */
117 print_ps_preamble(fh);
119 fputs("%% Set the font to 10 point\n", fh);
120 fputs("/Courier findfont 10 scalefont setfont\n", fh);
122 fputs("%% the page title\n", fh);
123 ps_clean_string(psbuffer, filename, MAX_PS_LINE_LENGTH);
124 fprintf(fh, "/eth_pagetitle (%s - Ethereal) def\n", psbuffer);
129 g_assert_not_reached();
134 proto_tree_print(print_args_t *print_args, epan_dissect_t *edt,
139 /* Create the output */
142 data.src_list = edt->pi.data_src;
143 data.encoding = edt->pi.fd->flags.encoding;
144 data.print_dissections = print_args->print_dissections;
145 /* If we're printing the entire packet in hex, don't
146 print uninterpreted data fields in hex as well. */
147 data.print_hex_for_data = !print_args->print_hex;
148 data.format = print_args->format;
151 proto_tree_children_foreach(edt->tree, proto_tree_print_node, &data);
154 #define MAX_INDENT 160
156 /* Print a tree's data, and any child nodes. */
158 void proto_tree_print_node(proto_node *node, gpointer data)
160 field_info *fi = PITEM_FINFO(node);
161 print_data *pdata = (print_data*) data;
163 gchar label_str[ITEM_LABEL_LENGTH];
166 /* Don't print invisible entries. */
167 if (PROTO_ITEM_IS_HIDDEN(node))
170 /* was a free format label produced? */
172 label_ptr = fi->rep->representation;
174 else { /* no, make a generic label */
175 label_ptr = label_str;
176 proto_item_fill_label(fi, label_str);
179 print_line(pdata->fh, pdata->level, pdata->format, label_ptr);
181 /* If it's uninterpreted data, dump it (unless our caller will
182 be printing the entire packet in hex). */
183 if (fi->hfinfo->id == proto_data && pdata->print_hex_for_data) {
185 * Find the data for this field.
187 pd = get_field_data(pdata->src_list, fi);
189 print_hex_data_buffer(pdata->fh, pd, fi->length,
190 pdata->encoding, pdata->format);
194 /* If we're printing all levels, or if this node is one with a
195 subtree and its subtree is expanded, recurse into the subtree,
197 g_assert(fi->tree_type >= -1 && fi->tree_type < num_tree_types);
198 if (pdata->print_dissections == print_dissections_expanded ||
199 (pdata->print_dissections == print_dissections_as_displayed &&
200 fi->tree_type >= 0 && tree_is_expanded[fi->tree_type])) {
201 if (node->first_child != NULL) {
203 proto_tree_children_foreach(node,
204 proto_tree_print_node, pdata);
210 /* Some formats need stuff at the end of the output */
212 print_finale(FILE *fh, print_format_e format)
225 g_assert_not_reached();
230 write_pdml_preamble(FILE *fh)
232 fputs("<?xml version=\"1.0\"?>\n", fh);
233 fputs("<pdml version=\"" PDML_VERSION "\" ", fh);
234 fprintf(fh, "creator=\"%s/%s\">\n", PACKAGE, VERSION);
238 proto_tree_write_pdml(epan_dissect_t *edt, FILE *fh)
240 write_pdml_data data;
242 /* Create the output */
245 data.src_list = edt->pi.data_src;
248 fprintf(fh, "<packet>\n");
250 /* Print a "geninfo" protocol as required by PDML */
251 print_pdml_geninfo(edt->tree, fh);
253 proto_tree_children_foreach(edt->tree, proto_tree_write_node_pdml,
256 fprintf(fh, "</packet>\n\n");
259 /* Write out a tree's data, and any child nodes, as PDML */
261 proto_tree_write_node_pdml(proto_node *node, gpointer data)
263 field_info *fi = PITEM_FINFO(node);
264 write_pdml_data *pdata = (write_pdml_data*) data;
266 gchar label_str[ITEM_LABEL_LENGTH];
267 char *dfilter_string;
271 for (i = -1; i < pdata->level; i++) {
272 fputs(" ", pdata->fh);
275 /* Text label. It's printed as a field with no name. */
276 if (fi->hfinfo->id == hf_text_only) {
279 label_ptr = fi->rep->representation;
285 fputs("<field show=\"", pdata->fh);
286 print_escaped_xml(pdata->fh, label_ptr);
288 fprintf(pdata->fh, "\" size=\"%d", fi->length);
289 fprintf(pdata->fh, "\" pos=\"%d", fi->start);
291 fputs("\" value=\"", pdata->fh);
292 write_pdml_field_hex_value(pdata, fi);
294 if (node->first_child != NULL) {
295 fputs("\">\n", pdata->fh);
298 fputs("\"/>\n", pdata->fh);
301 /* Uninterpreted data, i.e., the "Data" protocol, is
302 * printed as a field instead of a protocol. */
303 else if (fi->hfinfo->id == proto_data) {
305 fputs("<field name=\"data\" value=\"", pdata->fh);
307 write_pdml_field_hex_value(pdata, fi);
309 fputs("\"/>\n", pdata->fh);
312 /* Normal protocols and fields */
314 if (fi->hfinfo->type == FT_PROTOCOL) {
315 fputs("<proto name=\"", pdata->fh);
318 fputs("<field name=\"", pdata->fh);
320 print_escaped_xml(pdata->fh, fi->hfinfo->abbrev);
324 * http://analyzer.polito.it/30alpha/docs/dissectors/PDMLSpec.htm
326 * the show fields contains things in 'human readable' format
327 * showname: contains only the name of the field
328 * show: contains only the data of the field
329 * showdtl: contains additional details of the field data
330 * showmap: contains mappings of the field data (e.g. the hostname to an IP address)
332 * XXX - the showname shouldn't contain the field data itself
333 * (like it's contained in the fi->rep->representation).
334 * Unfortunately, we don't have the field data representation for
335 * all fields, so this isn't currently possible */
336 fputs("\" showname=\"", pdata->fh);
337 print_escaped_xml(pdata->fh, fi->hfinfo->name);
341 fputs("\" showname=\"", pdata->fh);
342 print_escaped_xml(pdata->fh, fi->rep->representation);
345 label_ptr = label_str;
346 proto_item_fill_label(fi, label_str);
347 fputs("\" showname=\"", pdata->fh);
348 print_escaped_xml(pdata->fh, label_ptr);
351 if (PROTO_ITEM_IS_HIDDEN(node))
352 fprintf(pdata->fh, "\" hide=\"yes");
354 fprintf(pdata->fh, "\" size=\"%d", fi->length);
355 fprintf(pdata->fh, "\" pos=\"%d", fi->start);
356 /* fprintf(pdata->fh, "\" id=\"%d", fi->hfinfo->id);*/
358 if (fi->hfinfo->type != FT_PROTOCOL) {
361 /* XXX - this is a hack until we can just call
362 * fvalue_to_string_repr() for *all* FT_* types. */
363 dfilter_string = proto_construct_dfilter_string(fi,
365 if (dfilter_string != NULL) {
366 chop_len = strlen(fi->hfinfo->abbrev) + 4; /* for " == " */
368 /* XXX - Remove double-quotes. Again, once we
369 * can call fvalue_to_string_repr(), we can
370 * ask it not to produce the version for
371 * display-filters, and thus, no
373 if (dfilter_string[strlen(dfilter_string)-1] == '"') {
374 dfilter_string[strlen(dfilter_string)-1] = '\0';
378 fputs("\" show=\"", pdata->fh);
379 print_escaped_xml(pdata->fh, &dfilter_string[chop_len]);
381 if (fi->length > 0) {
382 fputs("\" value=\"", pdata->fh);
383 write_pdml_field_hex_value(pdata, fi);
387 if (node->first_child != NULL) {
388 fputs("\">\n", pdata->fh);
390 else if (fi->hfinfo->id == proto_data) {
391 fputs("\">\n", pdata->fh);
394 fputs("\"/>\n", pdata->fh);
398 /* We always print all levels for PDML. Recurse here. */
399 if (node->first_child != NULL) {
401 proto_tree_children_foreach(node,
402 proto_tree_write_node_pdml, pdata);
406 if (node->first_child != NULL) {
407 for (i = -1; i < pdata->level; i++) {
408 fputs(" ", pdata->fh);
410 if (fi->hfinfo->type == FT_PROTOCOL) {
411 fputs("</proto>\n", pdata->fh);
414 fputs("</field>\n", pdata->fh);
419 /* Print info for a 'geninfo' pseudo-protocol. This is required by
420 * the PDML spec. The information is contained in Ethereal's 'frame' protocol,
421 * but we produce a 'geninfo' protocol in the PDML to conform to spec.
422 * The 'frame' protocol follows the 'geninfo' protocol in the PDML. */
424 print_pdml_geninfo(proto_tree *tree, FILE *fh)
426 guint32 num, len, caplen;
428 GPtrArray *finfo_array;
429 field_info *frame_finfo;
431 /* Get frame protocol's finfo. */
432 finfo_array = proto_find_finfo(tree, proto_frame);
433 if (g_ptr_array_len(finfo_array) < 1) {
436 frame_finfo = finfo_array->pdata[0];
437 g_ptr_array_free(finfo_array, FALSE);
439 /* frame.number --> geninfo.num */
440 finfo_array = proto_find_finfo(tree, hf_frame_number);
441 if (g_ptr_array_len(finfo_array) < 1) {
444 num = fvalue_get_integer(&((field_info*)finfo_array->pdata[0])->value);
445 g_ptr_array_free(finfo_array, FALSE);
447 /* frame.pkt_len --> geninfo.len */
448 finfo_array = proto_find_finfo(tree, hf_frame_packet_len);
449 if (g_ptr_array_len(finfo_array) < 1) {
452 len = fvalue_get_integer(&((field_info*)finfo_array->pdata[0])->value);
453 g_ptr_array_free(finfo_array, FALSE);
455 /* frame.cap_len --> geninfo.caplen */
456 finfo_array = proto_find_finfo(tree, hf_frame_capture_len);
457 if (g_ptr_array_len(finfo_array) < 1) {
460 caplen = fvalue_get_integer(&((field_info*)finfo_array->pdata[0])->value);
461 g_ptr_array_free(finfo_array, FALSE);
463 /* frame.time --> geninfo.timestamp */
464 finfo_array = proto_find_finfo(tree, hf_frame_arrival_time);
465 if (g_ptr_array_len(finfo_array) < 1) {
468 timestamp = fvalue_get(&((field_info*)finfo_array->pdata[0])->value);
469 g_ptr_array_free(finfo_array, FALSE);
471 /* Print geninfo start */
473 " <proto name=\"geninfo\" pos=\"0\" showname=\"General information\" size=\"%u\">\n",
474 frame_finfo->length);
476 /* Print geninfo.num */
478 " <field name=\"num\" pos=\"0\" show=\"%u\" showname=\"Number\" value=\"%x\" size=\"%u\"/>\n",
479 num, num, frame_finfo->length);
481 /* Print geninfo.len */
483 " <field name=\"len\" pos=\"0\" show=\"%u\" showname=\"Packet Length\" value=\"%x\" size=\"%u\"/>\n",
484 len, len, frame_finfo->length);
486 /* Print geninfo.caplen */
488 " <field name=\"caplen\" pos=\"0\" show=\"%u\" showname=\"Captured Length\" value=\"%x\" size=\"%u\"/>\n",
489 caplen, caplen, frame_finfo->length);
491 /* Print geninfo.timestamp */
493 " <field name=\"timestamp\" pos=\"0\" show=\"%s\" showname=\"Captured Time\" value=\"%d.%09d\" size=\"%u\"/>\n",
494 abs_time_to_str(timestamp), (int) timestamp->secs, timestamp->nsecs, frame_finfo->length);
496 /* Print geninfo end */
502 write_pdml_finale(FILE *fh)
504 fputs("</pdml>\n", fh);
508 write_psml_preamble(FILE *fh)
510 fputs("<?xml version=\"1.0\"?>\n", fh);
511 fputs("<psml version=\"" PSML_VERSION "\" ", fh);
512 fprintf(fh, "creator=\"%s/%s\">\n", PACKAGE, VERSION);
516 proto_tree_write_psml(epan_dissect_t *edt, FILE *fh)
520 /* if this is the first packet, we have to create the PSML structure output */
521 if(edt->pi.fd->num == 1) {
522 fprintf(fh, "<structure>\n");
524 for(i=0; i < edt->pi.cinfo->num_cols; i++) {
525 fprintf(fh, "<section>");
526 print_escaped_xml(fh, edt->pi.cinfo->col_title[i]);
527 fprintf(fh, "</section>\n");
530 fprintf(fh, "</structure>\n\n");
533 fprintf(fh, "<packet>\n");
535 for(i=0; i < edt->pi.cinfo->num_cols; i++) {
536 fprintf(fh, "<section>");
537 print_escaped_xml(fh, edt->pi.cinfo->col_data[i]);
538 fprintf(fh, "</section>\n");
541 fprintf(fh, "</packet>\n\n");
545 write_psml_finale(FILE *fh)
547 fputs("</psml>\n", fh);
551 * Find the data source for a specified field, and return a pointer
552 * to the data in it. Returns NULL if the data is out of bounds.
554 static const guint8 *
555 get_field_data(GSList *src_list, field_info *fi)
560 gint length, tvbuff_length;
562 for (src_le = src_list; src_le != NULL; src_le = src_le->next) {
565 if (fi->ds_tvb == src_tvb) {
569 * XXX - a field can have a length that runs past
570 * the end of the tvbuff. Ideally, that should
571 * be fixed when adding an item to the protocol
572 * tree, but checking the length when doing
573 * that could be expensive. Until we fix that,
574 * we'll do the check here.
576 tvbuff_length = tvb_length_remaining(src_tvb,
578 if (tvbuff_length < 0) {
582 if (length > tvbuff_length)
583 length = tvbuff_length;
584 return tvb_get_ptr(src_tvb, fi->start, length);
587 g_assert_not_reached();
588 return NULL; /* not found */
591 /* Print a string, escaping out certain characters that need to
592 * escaped out for XML. */
594 print_escaped_xml(FILE *fh, char *unescaped_string)
598 for (p = unescaped_string; *p != '\0'; p++) {
622 write_pdml_field_hex_value(write_pdml_data *pdata, field_info *fi)
627 if (fi->length > tvb_length_remaining(fi->ds_tvb, fi->start)) {
628 fprintf(pdata->fh, "field length invalid!");
632 /* Find the data for this field. */
633 pd = get_field_data(pdata->src_list, fi);
636 /* Print a simple hex dump */
637 for (i = 0 ; i < fi->length; i++) {
638 fprintf(pdata->fh, "%02x", pd[i]);
644 void print_hex_data(FILE *fh, print_format_e format, epan_dissect_t *edt)
646 gboolean multiple_sources;
656 * Set "multiple_sources" iff this frame has more than one
657 * data source; if it does, we need to print the name of
658 * the data source before printing the data from the
661 multiple_sources = (edt->pi.data_src->next != NULL);
663 for (src_le = edt->pi.data_src; src_le != NULL;
664 src_le = src_le->next) {
667 if (multiple_sources) {
669 print_line(fh, 0, format, "");
670 line = g_malloc(strlen(name) + 2); /* <name>:\0 */
673 print_line(fh, 0, format, line);
676 length = tvb_length(tvb);
677 cp = tvb_get_ptr(tvb, 0, length);
678 print_hex_data_buffer(fh, cp, length,
679 edt->pi.fd->flags.encoding, format);
684 * This routine is based on a routine created by Dan Lasley
685 * <DLASLEY@PROMUS.com>.
687 * It was modified for Ethereal by Gilbert Ramirez and others.
690 #define MAX_OFFSET_LEN 8 /* max length of hex offset of bytes */
691 #define BYTES_PER_LINE 16 /* max byte values printed on a line */
692 #define HEX_DUMP_LEN (BYTES_PER_LINE*3)
693 /* max number of characters hex dump takes -
694 2 digits plus trailing blank */
695 #define DATA_DUMP_LEN (HEX_DUMP_LEN + 2 + BYTES_PER_LINE)
696 /* number of characters those bytes take;
697 3 characters per byte of hex dump,
698 2 blanks separating hex from ASCII,
699 1 character per byte of ASCII dump */
700 #define MAX_LINE_LEN (MAX_OFFSET_LEN + 2 + DATA_DUMP_LEN)
701 /* number of characters per line;
702 offset, 2 blanks separating offset
703 from data dump, data dump */
706 print_hex_data_buffer(FILE *fh, register const guchar *cp,
707 register guint length, char_enc encoding, print_format_e format)
709 register unsigned int ad, i, j, k, l;
711 guchar line[MAX_LINE_LEN + 1];
712 unsigned int use_digits;
713 static guchar binhex[16] = {
714 '0', '1', '2', '3', '4', '5', '6', '7',
715 '8', '9', 'a', 'b', 'c', 'd', 'e', 'f'};
717 print_line(fh, 0, format, "");
720 * How many of the leading digits of the offset will we supply?
721 * We always supply at least 4 digits, but if the maximum offset
722 * won't fit in 4 digits, we use as many digits as will be needed.
724 if (((length - 1) & 0xF0000000) != 0)
725 use_digits = 8; /* need all 8 digits */
726 else if (((length - 1) & 0x0F000000) != 0)
727 use_digits = 7; /* need 7 digits */
728 else if (((length - 1) & 0x00F00000) != 0)
729 use_digits = 6; /* need 6 digits */
730 else if (((length - 1) & 0x000F0000) != 0)
731 use_digits = 5; /* need 5 digits */
733 use_digits = 4; /* we'll supply 4 digits */
742 * Start of a new line.
749 c = (ad >> (l*4)) & 0xF;
750 line[j++] = binhex[c];
754 memset(line+j, ' ', DATA_DUMP_LEN);
757 * Offset in line of ASCII dump.
759 k = j + HEX_DUMP_LEN + 2;
762 line[j++] = binhex[c>>4];
763 line[j++] = binhex[c&0xf];
765 if (encoding == CHAR_EBCDIC) {
766 c = EBCDIC_to_ASCII1(c);
768 line[k++] = c >= ' ' && c < 0x7f ? c : '.';
770 if ((i & 15) == 0 || i == length) {
772 * We'll be starting a new line, or
773 * we're finished printing this buffer;
774 * dump out the line we've constructed,
775 * and advance the offset.
778 print_line(fh, 0, format, line);
785 void ps_clean_string(unsigned char *out, const unsigned char *in,
791 for (rd = 0, wr = 0 ; wr < outbuf_size; rd++, wr++ ) {
813 print_packet_header(FILE *fh, print_format_e format, guint32 number, gchar *summary) {
814 char psbuffer[MAX_PS_LINE_LENGTH]; /* static sized buffer! */
823 ps_clean_string(psbuffer, summary, MAX_PS_LINE_LENGTH);
824 fprintf(fh, "[/Dest /__frame%u__ /Title (%s) /OUT pdfmark\n", number, psbuffer);
825 fputs("[/View [/XYZ -4 currentpoint matrix currentmatrix matrix defaultmatrix\n", fh);
826 fputs("matrix invertmatrix matrix concatmatrix transform exch pop 20 add null]\n", fh);
827 fprintf(fh, "/Dest /__frame%u__ /DEST pdfmark\n", number);
831 g_assert_not_reached();
836 print_formfeed(FILE *fh, print_format_e format)
845 fputs("formfeed\n", fh);
849 g_assert_not_reached();
854 print_line(FILE *fh, int indent, print_format_e format, char *line)
856 char space[MAX_INDENT+1];
859 char psbuffer[MAX_PS_LINE_LENGTH]; /* static sized buffer! */
864 /* Prepare the tabs for printing, depending on tree level */
865 num_spaces = indent * 4;
866 if (num_spaces > MAX_INDENT) {
867 num_spaces = MAX_INDENT;
869 for (i = 0; i < num_spaces; i++) {
872 /* The string is NUL-terminated */
873 space[num_spaces] = '\0';
881 ps_clean_string(psbuffer, line, MAX_PS_LINE_LENGTH);
882 fprintf(fh, "%d (%s) putline\n", indent, psbuffer);
886 g_assert_not_reached();