6 * Wireshark - Network traffic analyzer
7 * By Gerald Combs <gerald@wireshark.org>
8 * Copyright 1998 Gerald Combs
10 * This program is free software; you can redistribute it and/or
11 * modify it under the terms of the GNU General Public License
12 * as published by the Free Software Foundation; either version 2
13 * of the License, or (at your option) any later version.
15 * This program is distributed in the hope that it will be useful,
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 * GNU General Public License for more details.
20 * You should have received a copy of the GNU General Public License
21 * along with this program; if not, write to the Free Software
22 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
44 #include <epan/address.h>
45 #include <epan/addr_resolv.h>
46 #include <epan/strutil.h>
51 * Collect command-line arguments as a string consisting of the arguments,
52 * separated by spaces.
55 get_args_as_string(int argc, char **argv, int optindex)
62 * Find out how long the string will be.
65 for (i = optindex; i < argc; i++) {
66 len += (int) strlen(argv[i]);
67 len++; /* space, or '\0' if this is the last argument */
71 * Allocate the buffer for the string.
73 argstring = (char *)g_malloc(len);
76 * Now construct the string.
81 g_strlcat(argstring, argv[i], len);
85 g_strlcat(argstring, " ", len);
90 /* Compute the difference between two seconds/microseconds time stamps. */
92 compute_timestamp_diff(gint *diffsec, gint *diffusec,
93 guint32 sec1, guint32 usec1, guint32 sec2, guint32 usec2)
96 /* The seconds part of the first time is the same as the seconds
97 part of the second time, so if the microseconds part of the first
98 time is less than the microseconds part of the second time, the
99 first time is before the second time. The microseconds part of
100 the delta should just be the difference between the microseconds
101 part of the first time and the microseconds part of the second
102 time; don't adjust the seconds part of the delta, as it's OK if
103 the microseconds part is negative. */
105 *diffsec = sec1 - sec2;
106 *diffusec = usec1 - usec2;
107 } else if (sec1 <= sec2) {
108 /* The seconds part of the first time is less than the seconds part
109 of the second time, so the first time is before the second time.
111 Both the "seconds" and "microseconds" value of the delta
112 should have the same sign, so if the difference between the
113 microseconds values would be *positive*, subtract 1,000,000
114 from it, and add one to the seconds value. */
115 *diffsec = sec1 - sec2;
116 if (usec2 >= usec1) {
117 *diffusec = usec1 - usec2;
119 *diffusec = (usec1 - 1000000) - usec2;
123 /* Oh, good, we're not caught in a chronosynclastic infindibulum. */
124 *diffsec = sec1 - sec2;
125 if (usec2 <= usec1) {
126 *diffusec = usec1 - usec2;
128 *diffusec = (usec1 + 1000000) - usec2;
134 /* Remove any %<interface_name> from an IP address. */
135 static char *sanitize_filter_ip(char *hostname) {
139 ret = g_strdup(hostname);
143 end = strchr(ret, '%');
149 /* Try to figure out if we're remotely connected, e.g. via ssh or
150 Terminal Server, and create a capture filter that matches aspects of the
151 connection. We match the following environment variables:
153 SSH_CONNECTION (ssh): <remote IP> <remote port> <local IP> <local port>
154 SSH_CLIENT (ssh): <remote IP> <remote port> <local port>
155 REMOTEHOST (tcsh, others?): <remote name>
156 DISPLAY (x11): [remote name]:<display num>
157 SESSIONNAME (terminal server): <remote name>
160 const gchar *get_conn_cfilter(void) {
161 static GString *filter_str = NULL;
162 gchar *env, **tokens;
163 char *lastp, *lastc, *p;
164 char *pprotocol = NULL;
165 char *phostname = NULL;
169 if (filter_str == NULL) {
170 filter_str = g_string_new("");
172 if ((env = getenv("SSH_CONNECTION")) != NULL) {
173 tokens = g_strsplit(env, " ", 4);
175 remip = sanitize_filter_ip(tokens[0]);
176 locip = sanitize_filter_ip(tokens[2]);
177 g_string_printf(filter_str, "not (tcp port %s and %s host %s "
178 "and tcp port %s and %s host %s)", tokens[1], host_ip_af(remip), remip,
179 tokens[3], host_ip_af(locip), locip);
182 return filter_str->str;
184 } else if ((env = getenv("SSH_CLIENT")) != NULL) {
185 tokens = g_strsplit(env, " ", 3);
186 remip = sanitize_filter_ip(tokens[2]);
187 g_string_printf(filter_str, "not (tcp port %s and %s host %s "
188 "and tcp port %s)", tokens[1], host_ip_af(remip), tokens[0], remip);
190 return filter_str->str;
191 } else if ((env = getenv("REMOTEHOST")) != NULL) {
192 /* FreeBSD 7.0 sets REMOTEHOST to an empty string */
193 if (g_ascii_strcasecmp(env, "localhost") == 0 ||
194 strcmp(env, "127.0.0.1") == 0 ||
195 strcmp(env, "") == 0) {
198 remip = sanitize_filter_ip(env);
199 g_string_printf(filter_str, "not %s host %s", host_ip_af(remip), remip);
201 return filter_str->str;
202 } else if ((env = getenv("DISPLAY")) != NULL) {
204 * This mirrors what _X11TransConnectDisplay() does.
205 * Note that, on some systems, the hostname can
206 * begin with "/", which means that it's a pathname
207 * of a UNIX domain socket to connect to.
209 * The comments mirror those in _X11TransConnectDisplay(),
212 * Display names may be of the following format:
214 * [protoco./] [hostname] : [:] displaynumber [.screennumber]
216 * A string with exactly two colons separating hostname
217 * from the display indicates a DECnet style name. Colons
218 * in the hostname may occur if an IPv6 numeric address
219 * is used as the hostname. An IPv6 numeric address may
220 * also end in a double colon, so three colons in a row
221 * indicates an IPv6 address ending in :: followed by
222 * :display. To make it easier for people to read, an
223 * IPv6 numeric address hostname may be surrounded by []
224 * in a similar fashion to the IPv6 numeric address URL
225 * syntax defined by IETF RFC 2732.
227 * If no hostname and no protocol is specified, the string
228 * is interpreted as the most efficient local connection
229 * to a server on the same machine. This is usually:
233 * o UNIX domain socket
234 * o TCP to local host.
240 * Step 0, find the protocol. This is delimited by
241 * the optional slash ('/').
243 for (lastp = p; *p != '\0' && *p != ':' && *p != '/'; p++)
246 return ""; /* must have a colon */
248 if (p != lastp && *p != ':') { /* protocol given? */
253 if (p - lastp != 3 || g_ascii_strncasecmp(lastp, "tcp", 3) != 0)
254 return ""; /* not TCP */
255 p++; /* skip the '/' */
257 p = env; /* reset the pointer in
258 case no protocol was given */
261 * Step 1, find the hostname. This is delimited either by
262 * one colon, or two colons in the case of DECnet (DECnet
263 * Phase V allows a single colon in the hostname). (See
264 * note above regarding IPv6 numeric addresses with
265 * triple colons or [] brackets.)
269 for (; *p != '\0'; p++)
274 return ""; /* must have a colon */
276 if ((lastp != lastc) && (*(lastc - 1) == ':')
277 && (((lastc - 1) == lastp) || (*(lastc - 2) != ':'))) {
278 /* DECnet display specified */
281 hostlen = lastc - lastp;
284 return ""; /* no hostname supplied */
286 phostname = (char *)g_malloc(hostlen + 1);
287 memcpy(phostname, lastp, hostlen);
288 phostname[hostlen] = '\0';
290 if (pprotocol == NULL) {
292 * No protocol was explicitly specified, so it
293 * could be a local connection over a transport
296 * Does the host name refer to the local host?
297 * If so, the connection would probably be a
300 * XXX - compare against our host name?
301 * _X11TransConnectDisplay() does.
303 if (g_ascii_strcasecmp(phostname, "localhost") == 0 ||
304 strcmp(phostname, "127.0.0.1") == 0) {
310 * A host name of "unix" (case-sensitive) also
311 * causes a local connection.
313 if (strcmp(phostname, "unix") == 0) {
319 * Does the host name begin with "/"? If so,
320 * it's presumed to be the pathname of a
321 * UNIX domain socket.
323 if (phostname[0] == '/') {
329 g_string_printf(filter_str, "not %s host %s",
330 host_ip_af(phostname), phostname);
332 return filter_str->str;
334 } else if (GetSystemMetrics(SM_REMOTESESSION)) {
335 /* We have a remote session: http://msdn.microsoft.com/en-us/library/aa380798%28VS.85%29.aspx */
336 g_string_printf(filter_str, "not tcp port 3389");
337 return filter_str->str;