2 * Routines for packet disassembly
4 * $Id: packet.c,v 1.52 1999/10/29 02:25:54 guy Exp $
6 * Ethereal - Network traffic analyzer
7 * By Gerald Combs <gerald@zing.org>
8 * Copyright 1998 Gerald Combs
11 * This program is free software; you can redistribute it and/or
12 * modify it under the terms of the GNU General Public License
13 * as published by the Free Software Foundation; either version 2
14 * of the License, or (at your option) any later version.
16 * This program is distributed in the hope that it will be useful,
17 * but WITHOUT ANY WARRANTY; without even the implied warranty of
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 * GNU General Public License for more details.
21 * You should have received a copy of the GNU General Public License
22 * along with this program; if not, write to the Free Software
23 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
30 #ifdef HAVE_SYS_TYPES_H
31 # include <sys/types.h>
34 #ifdef HAVE_SYS_SOCKET_H
35 #include <sys/socket.h>
50 #ifdef NEED_SNPRINTF_H
51 # include "snprintf.h"
54 #ifdef HAVE_NETINET_IN_H
55 # include <netinet/in.h>
58 #include <arpa/inet.h>
60 #ifdef NEED_INET_V6DEFS_H
61 # include "inet_v6defs.h"
68 extern capture_file cf;
70 gboolean tree_is_expanded[NUM_TREE_TYPES];
73 int hf_frame_arrival_time = -1;
74 int hf_frame_time_delta = -1;
75 int hf_frame_number = -1;
76 int hf_frame_packet_len = -1;
77 int hf_frame_capture_len = -1;
80 ether_to_str(const guint8 *ad) {
81 static gchar str[3][18];
86 static const gchar hex_digits[16] = "0123456789abcdef";
88 if (cur == &str[0][0]) {
90 } else if (cur == &str[1][0]) {
100 *--p = hex_digits[octet&0xF];
102 *--p = hex_digits[octet&0xF];
112 ip_to_str(const guint8 *ad) {
113 static gchar str[3][16];
120 if (cur == &str[0][0]) {
122 } else if (cur == &str[1][0]) {
132 *--p = (octet%10) + '0';
136 if (digit != 0 || octet != 0)
149 ip6_to_str(struct e_in6_addr *ad) {
150 #ifndef INET6_ADDRSTRLEN
151 #define INET6_ADDRSTRLEN 46
153 static gchar buf[INET6_ADDRSTRLEN];
155 inet_ntop(AF_INET6, (u_char*)ad, (gchar*)buf, sizeof(buf));
160 #define PLURALIZE(n) (((n) > 1) ? "s" : "")
161 #define COMMA(do_it) ((do_it) ? ", " : "")
164 time_secs_to_str(guint32 time)
166 static gchar str[3][8+1+4+2+2+5+2+2+7+2+2+7+1];
167 static gchar *cur, *p;
168 int hours, mins, secs;
171 if (cur == &str[0][0]) {
173 } else if (cur == &str[1][0]) {
188 sprintf(p, "%u day%s", time, PLURALIZE(time));
194 sprintf(p, "%s%u hour%s", COMMA(do_comma), hours, PLURALIZE(hours));
200 sprintf(p, "%s%u minute%s", COMMA(do_comma), mins, PLURALIZE(mins));
206 sprintf(p, "%s%u second%s", COMMA(do_comma), secs, PLURALIZE(secs));
210 /* Max string length for displaying byte string. */
211 #define MAX_BYTE_STR_LEN 20
213 /* Turn an array of bytes into a string showing the bytes in hex. */
215 bytes_to_str(const guint8 *bd, int bd_len) {
216 static gchar str[3][MAX_BYTE_STR_LEN+3+1];
220 static const char hex[16] = { '0', '1', '2', '3', '4', '5', '6', '7',
221 '8', '9', 'A', 'B', 'C', 'D', 'E', 'F' };
223 if (cur == &str[0][0]) {
225 } else if (cur == &str[1][0]) {
231 len = MAX_BYTE_STR_LEN;
232 while (bd_len > 0 && len > 0) {
233 *p++ = hex[(*bd) >> 4];
234 *p++ = hex[(*bd) & 0xF];
240 /* Note that we're not showing the full string. */
249 static const char *mon_names[12] = {
265 abs_time_to_str(struct timeval *abs_time)
269 static char str[3][3+1+2+2+4+1+2+1+2+1+2+1+4+1 + 5 /* extra */];
271 if (cur == &str[0][0]) {
273 } else if (cur == &str[1][0]) {
279 tmp = localtime(&abs_time->tv_sec);
280 sprintf(cur, "%s %2d, %d %02d:%02d:%02d.%04ld",
281 mon_names[tmp->tm_mon],
287 (long)abs_time->tv_usec/100);
293 rel_time_to_str(struct timeval *rel_time)
296 static char str[3][10+1+6+1];
298 if (cur == &str[0][0]) {
300 } else if (cur == &str[1][0]) {
306 sprintf(cur, "%ld.%06ld", (long)rel_time->tv_sec,
307 (long)rel_time->tv_usec);
313 * Given a pointer into a data buffer, and to the end of the buffer,
314 * find the end of the (putative) line at that position in the data
316 * Return a pointer to the EOL character(s) in "*eol".
319 find_line_end(const u_char *data, const u_char *dataend, const u_char **eol)
321 const u_char *lineend;
323 lineend = memchr(data, '\n', dataend - data);
324 if (lineend == NULL) {
326 * No LF - line is probably continued in next TCP segment.
332 * Is the LF at the beginning of the line?
334 if (lineend > data) {
336 * No - is it preceded by a carriage return?
337 * (Perhaps it's supposed to be, but that's not guaranteed....)
339 if (*(lineend - 1) == '\r') {
341 * Yes. The EOL starts with the CR.
346 * No. The EOL starts with the LF.
351 * I seem to remember that we once saw lines ending with LF-CR
352 * in an HTTP request or response, so check if it's *followed*
353 * by a carriage return.
355 if (lineend < (dataend - 1) && *(lineend + 1) == '\r') {
357 * It's <non-LF><LF><CR>; say it ends with the CR.
365 * Point to the character after the last character.
372 #define MAX_COLUMNS_LINE_DETAIL 62
375 * Get the length of the next token in a line, and the beginning of the
376 * next token after that (if any).
377 * Return 0 if there is no next token.
380 get_token_len(const u_char *linep, const u_char *lineend,
381 const u_char **next_token)
383 const u_char *tokenp;
389 * Search for a blank, a CR or an LF, or the end of the buffer.
391 while (linep < lineend && *linep != ' ' && *linep != '\r' && *linep != '\n')
393 token_len = linep - tokenp;
396 * Skip trailing blanks.
398 while (linep < lineend && *linep == ' ')
407 * Given a string, generate a string from it that shows non-printable
408 * characters as C-style escapes, and return a pointer to it.
411 format_text(const u_char *string, int len)
413 static gchar fmtbuf[MAX_COLUMNS_LINE_DETAIL + 3 + 4 + 1];
416 const u_char *stringend = string + len;
421 fmtbufp = &fmtbuf[0];
422 while (string < stringend) {
423 if (column >= MAX_COLUMNS_LINE_DETAIL) {
425 * Put "..." and quit.
427 strcpy(fmtbufp, " ...");
481 *fmtbufp++ = i + '0';
484 *fmtbufp++ = i + '0';
487 *fmtbufp++ = i + '0';
498 /* Tries to match val against each element in the value_string array vs.
499 Returns the associated string ptr on a match.
500 Formats val with fmt, and returns the resulting string, on failure. */
502 val_to_str(guint32 val, const value_string *vs, const char *fmt) {
504 static gchar str[3][64];
507 ret = match_strval(val, vs);
510 if (cur == &str[0][0]) {
512 } else if (cur == &str[1][0]) {
517 snprintf(cur, 64, fmt, val);
521 /* Tries to match val against each element in the value_string array vs.
522 Returns the associated string ptr on a match, or NULL on failure. */
524 match_strval(guint32 val, const value_string *vs) {
527 while (vs[i].strptr) {
528 if (vs[i].value == val)
529 return(vs[i].strptr);
536 /* Generate, into "buf", a string showing the bits of a bitfield.
537 Return a pointer to the character after that string. */
539 decode_bitfield_value(char *buf, guint32 val, guint32 mask, int width)
547 bit = 1 << (width - 1);
550 /* This bit is part of the field. Show its value. */
556 /* This bit is not part of the field. */
571 /* Generate a string describing a Boolean bitfield (a one-bit field that
572 says something is either true of false). */
574 decode_boolean_bitfield(guint32 val, guint32 mask, int width,
575 const char *truedesc, const char *falsedesc)
577 static char buf[1025];
580 p = decode_bitfield_value(buf, val, mask, width);
584 strcpy(p, falsedesc);
588 /* Generate a string describing an enumerated bitfield (an N-bit field
589 with various specific values having particular names). */
591 decode_enumerated_bitfield(guint32 val, guint32 mask, int width,
592 const value_string *tab, const char *fmt)
594 static char buf[1025];
597 p = decode_bitfield_value(buf, val, mask, width);
598 sprintf(p, fmt, val_to_str(val & mask, tab, "Unknown"));
602 /* Generate a string describing a numeric bitfield (an N-bit field whose
603 value is just a number). */
605 decode_numeric_bitfield(guint32 val, guint32 mask, int width,
608 static char buf[1025];
612 /* Compute the number of bits we have to shift the bitfield right
613 to extract its value. */
614 while ((mask & (1<<shift)) == 0)
617 p = decode_bitfield_value(buf, val, mask, width);
618 sprintf(p, fmt, (val & mask) >> shift);
622 /* Checks to see if a particular packet information element is needed for
625 check_col(frame_data *fd, gint el) {
629 for (i = 0; i < fd->cinfo->num_cols; i++) {
630 if (fd->cinfo->fmt_matx[i][el])
637 /* Adds a vararg list to a packet info string. */
639 col_add_fstr(frame_data *fd, gint el, gchar *format, ...) {
644 va_start(ap, format);
645 for (i = 0; i < fd->cinfo->num_cols; i++) {
646 if (fd->cinfo->fmt_matx[i][el]) {
648 max_len = COL_MAX_INFO_LEN;
650 max_len = COL_MAX_LEN;
651 vsnprintf(fd->cinfo->col_data[i], max_len, format, ap);
657 col_add_str(frame_data *fd, gint el, const gchar* str) {
661 for (i = 0; i < fd->cinfo->num_cols; i++) {
662 if (fd->cinfo->fmt_matx[i][el]) {
664 max_len = COL_MAX_INFO_LEN;
666 max_len = COL_MAX_LEN;
667 strncpy(fd->cinfo->col_data[i], str, max_len);
668 fd->cinfo->col_data[i][max_len - 1] = 0;
673 /* Appends a vararg list to a packet info string. */
675 col_append_fstr(frame_data *fd, gint el, gchar *format, ...) {
680 va_start(ap, format);
681 for (i = 0; i < fd->cinfo->num_cols; i++) {
682 if (fd->cinfo->fmt_matx[i][el]) {
683 len = strlen(fd->cinfo->col_data[i]);
685 max_len = COL_MAX_INFO_LEN;
687 max_len = COL_MAX_LEN;
688 vsnprintf(&fd->cinfo->col_data[i][len], max_len - len, format, ap);
694 col_append_str(frame_data *fd, gint el, gchar* str) {
698 for (i = 0; i < fd->cinfo->num_cols; i++) {
699 if (fd->cinfo->fmt_matx[i][el]) {
700 len = strlen(fd->cinfo->col_data[i]);
702 max_len = COL_MAX_LEN;
704 max_len = COL_MAX_INFO_LEN;
705 strncat(fd->cinfo->col_data[i], str, max_len - len);
706 fd->cinfo->col_data[i][max_len - 1] = 0;
711 void blank_packetinfo(void)
713 pi.dl_src.type = AT_NONE;
714 pi.dl_dst.type = AT_NONE;
715 pi.net_src.type = AT_NONE;
716 pi.net_dst.type = AT_NONE;
717 pi.src.type = AT_NONE;
718 pi.dst.type = AT_NONE;
725 /* this routine checks the frame type from the cf structure */
727 dissect_packet(const u_char *pd, frame_data *fd, proto_tree *tree)
733 /* Put in frame header information. */
735 ti = proto_tree_add_item_format(tree, proto_frame, 0, fd->cap_len,
736 NULL, "Frame (%d on wire, %d captured)", fd->pkt_len, fd->cap_len);
738 fh_tree = proto_item_add_subtree(ti, ETT_FRAME);
740 tv.tv_sec = fd->abs_secs;
741 tv.tv_usec = fd->abs_usecs;
743 proto_tree_add_item(fh_tree, hf_frame_arrival_time,
746 tv.tv_sec = fd->del_secs;
747 tv.tv_usec = fd->del_usecs;
749 proto_tree_add_item(fh_tree, hf_frame_time_delta,
752 proto_tree_add_item(fh_tree, hf_frame_number,
755 proto_tree_add_item_format(fh_tree, hf_frame_packet_len,
756 0, 0, fd->pkt_len, "Packet Length: %d byte%s", fd->pkt_len,
757 plurality(fd->pkt_len, "", "s"));
759 proto_tree_add_item_format(fh_tree, hf_frame_capture_len,
760 0, 0, fd->cap_len, "Capture Length: %d byte%s", fd->cap_len,
761 plurality(fd->cap_len, "", "s"));
766 /* Set the initial payload to the packet length, and the initial
767 captured payload to the capture length (other protocols may
768 reduce them if their headers say they're less). */
769 pi.len = fd->pkt_len;
770 pi.captured_len = fd->cap_len;
773 case WTAP_ENCAP_ETHERNET :
774 dissect_eth(pd, 0, fd, tree);
776 case WTAP_ENCAP_FDDI :
777 dissect_fddi(pd, fd, tree, FALSE);
779 case WTAP_ENCAP_FDDI_BITSWAPPED :
780 dissect_fddi(pd, fd, tree, TRUE);
783 dissect_tr(pd, 0, fd, tree);
785 case WTAP_ENCAP_NULL :
786 dissect_null(pd, fd, tree);
788 case WTAP_ENCAP_PPP :
789 dissect_ppp(pd, fd, tree);
791 case WTAP_ENCAP_LAPB :
792 dissect_lapb(pd, fd, tree);
794 case WTAP_ENCAP_RAW_IP :
795 dissect_raw(pd, fd, tree);
797 case WTAP_ENCAP_LINUX_ATM_CLIP :
798 dissect_clip(pd, fd, tree);
800 case WTAP_ENCAP_ATM_SNIFFER :
801 dissect_atm(pd, fd, tree);
803 case WTAP_ENCAP_ASCEND :
804 dissect_ascend(pd, fd, tree);
810 proto_register_frame(void)
812 static hf_register_info hf[] = {
813 { &hf_frame_arrival_time,
814 { "Arrival Time", "frame.time", FT_ABSOLUTE_TIME, BASE_NONE, NULL, 0x0,
817 { &hf_frame_time_delta,
818 { "Time delta from previous packet", "frame.time_delta", FT_RELATIVE_TIME, BASE_NONE, NULL,
823 { "Frame Number", "frame.number", FT_UINT32, BASE_DEC, NULL, 0x0,
826 { &hf_frame_packet_len,
827 { "Total Frame Length", "frame.pkt_len", FT_UINT32, BASE_DEC, NULL, 0x0,
830 { &hf_frame_capture_len,
831 { "Capture Frame Length", "frame.cap_len", FT_UINT32, BASE_DEC, NULL, 0x0,
835 proto_frame = proto_register_protocol("Frame", "frame");
836 proto_register_field_array(proto_frame, hf, array_length(hf));