print.c

   1 /* print.c
   2  * Routines for printing packet analysis trees.
   3  *
   4  * $Id$
   5  *
   6  * Gilbert Ramirez <gram@alumni.rice.edu>
   7  *
   8  * Wireshark - Network traffic analyzer
   9  * By Gerald Combs <gerald@wireshark.org>
  10  * Copyright 1998 Gerald Combs
  11  *
  12  * This program is free software; you can redistribute it and/or
  13  * modify it under the terms of the GNU General Public License
  14  * as published by the Free Software Foundation; either version 2
  15  * of the License, or (at your option) any later version.
  16  *
  17  * This program is distributed in the hope that it will be useful,
  18  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  19  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20  * GNU General Public License for more details.
  21  *
  22  * You should have received a copy of the GNU General Public License
  23  * along with this program; if not, write to the Free Software
  24  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  25  */
  26
  27 #ifdef HAVE_CONFIG_H
  28 # include "config.h"
  29 #endif
  30
  31 #include <stdio.h>
  32 #include <string.h>
  33
  34 #include <epan/epan.h>
  35 #include <epan/epan_dissect.h>
  36 #include <epan/tvbuff.h>
  37 #include <epan/packet.h>
  38 #include <epan/emem.h>
  39
  40 #include "packet-range.h"
  41 #include "print.h"
  42 #include "ps.h"
  43 #include "file_util.h"
  44 #include <epan/charsets.h>
  45 #include <epan/dissectors/packet-data.h>
  46 #include <epan/dissectors/packet-frame.h>
  47
  48 #define PDML_VERSION "0"
  49 #define PSML_VERSION "0"
  50
  51 typedef struct {
  52         int                     level;
  53         print_stream_t          *stream;
  54         gboolean                success;
  55         GSList                  *src_list;
  56         print_dissections_e     print_dissections;
  57         gboolean                print_hex_for_data;
  58         char_enc                encoding;
  59         epan_dissect_t          *edt;
  60 } print_data;
  61
  62 typedef struct {
  63         int                     level;
  64         FILE                    *fh;
  65         GSList                  *src_list;
  66         epan_dissect_t          *edt;
  67 } write_pdml_data;
  68
  69 typedef struct {
  70     output_fields_t* fields;
  71         epan_dissect_t          *edt;
  72 } write_field_data_t;
  73
  74 struct _output_fields {
  75     gboolean print_header;
  76     gchar separator;
  77     GPtrArray* fields;
  78     GHashTable* field_indicies;
  79     const gchar** field_values;
  80     gchar quote;
  81 };
  82
  83 static const gchar* get_field_hex_value(GSList* src_list, field_info *fi);
  84 static const gchar* get_node_field_value(field_info* fi, epan_dissect_t* edt);
  85 static void proto_tree_print_node(proto_node *node, gpointer data);
  86 static void proto_tree_write_node_pdml(proto_node *node, gpointer data);
  87 static const guint8 *get_field_data(GSList *src_list, field_info *fi);
  88 static void write_pdml_field_hex_value(write_pdml_data *pdata, field_info *fi);
  89 static gboolean print_hex_data_buffer(print_stream_t *stream, const guchar *cp,
  90     guint length, char_enc encoding);
  91 static void ps_clean_string(unsigned char *out, const unsigned char *in,
  92                         int outbuf_size);
  93 static void print_escaped_xml(FILE *fh, const char *unescaped_string);
  94
  95 static void print_pdml_geninfo(proto_tree *tree, FILE *fh);
  96
  97 static void proto_tree_get_node_field_values(proto_node *node, gpointer data);
  98
  99 static FILE *
 100 open_print_dest(int to_file, const char *dest)
 101 {
 102         FILE    *fh;
 103
 104         /* Open the file or command for output */
 105         if (to_file)
 106                 fh = eth_fopen(dest, "w");
 107         else
 108                 fh = popen(dest, "w");
 109
 110         return fh;
 111 }
 112
 113 static gboolean
 114 close_print_dest(int to_file, FILE *fh)
 115 {
 116         /* Close the file or command */
 117         if (to_file)
 118                 return (fclose(fh) == 0);
 119         else
 120                 return (pclose(fh) == 0);
 121 }
 122
 123 #define MAX_PS_LINE_LENGTH 256
 124
 125 gboolean
 126 proto_tree_print(print_args_t *print_args, epan_dissect_t *edt,
 127     print_stream_t *stream)
 128 {
 129         print_data data;
 130
 131         /* Create the output */
 132         data.level = 0;
 133         data.stream = stream;
 134         data.success = TRUE;
 135         data.src_list = edt->pi.data_src;
 136         data.encoding = edt->pi.fd->flags.encoding;
 137         data.print_dissections = print_args->print_dissections;
 138         /* If we're printing the entire packet in hex, don't
 139            print uninterpreted data fields in hex as well. */
 140         data.print_hex_for_data = !print_args->print_hex;
 141         data.edt = edt;
 142
 143         proto_tree_children_foreach(edt->tree, proto_tree_print_node, &data);
 144         return data.success;
 145 }
 146
 147 #define MAX_INDENT      160
 148
 149 /* Print a tree's data, and any child nodes. */
 150 static
 151 void proto_tree_print_node(proto_node *node, gpointer data)
 152 {
 153         field_info      *fi = PITEM_FINFO(node);
 154         print_data      *pdata = (print_data*) data;
 155         const guint8    *pd;
 156         gchar           label_str[ITEM_LABEL_LENGTH];
 157         gchar           *label_ptr;
 158
 159         /* Don't print invisible entries. */
 160         if (PROTO_ITEM_IS_HIDDEN(node))
 161                 return;
 162
 163         /* Give up if we've already gotten an error. */
 164         if (!pdata->success)
 165                 return;
 166
 167         /* was a free format label produced? */
 168         if (fi->rep) {
 169                 label_ptr = fi->rep->representation;
 170         }
 171         else { /* no, make a generic label */
 172                 label_ptr = label_str;
 173                 proto_item_fill_label(fi, label_str);
 174         }
 175
 176         if (PROTO_ITEM_IS_GENERATED(node)) {
 177                 label_ptr = g_strdup_printf("[%s]", label_ptr);
 178         }
 179
 180         if (!print_line(pdata->stream, pdata->level, label_ptr)) {
 181                 pdata->success = FALSE;
 182                 return;
 183         }
 184
 185         if (PROTO_ITEM_IS_GENERATED(node)) {
 186                 g_free(label_ptr);
 187         }
 188
 189         /* If it's uninterpreted data, dump it (unless our caller will
 190            be printing the entire packet in hex). */
 191         if (fi->hfinfo->id == proto_data && pdata->print_hex_for_data) {
 192                 /*
 193                  * Find the data for this field.
 194                  */
 195                 pd = get_field_data(pdata->src_list, fi);
 196                 if (pd) {
 197                         if (!print_hex_data_buffer(pdata->stream, pd,
 198                             fi->length, pdata->encoding)) {
 199                                 pdata->success = FALSE;
 200                                 return;
 201                         }
 202                 }
 203         }
 204
 205         /* If we're printing all levels, or if this node is one with a
 206            subtree and its subtree is expanded, recurse into the subtree,
 207            if it exists. */
 208         g_assert(fi->tree_type >= -1 && fi->tree_type < num_tree_types);
 209         if (pdata->print_dissections == print_dissections_expanded ||
 210             (pdata->print_dissections == print_dissections_as_displayed &&
 211                 fi->tree_type >= 0 && tree_is_expanded[fi->tree_type])) {
 212                 if (node->first_child != NULL) {
 213                         pdata->level++;
 214                         proto_tree_children_foreach(node,
 215                                 proto_tree_print_node, pdata);
 216                         pdata->level--;
 217                         if (!pdata->success)
 218                                 return;
 219                 }
 220         }
 221 }
 222
 223 void
 224 write_pdml_preamble(FILE *fh)
 225 {
 226         fputs("<?xml version=\"1.0\"?>\n", fh);
 227         fputs("<pdml version=\"" PDML_VERSION "\" ", fh);
 228         fprintf(fh, "creator=\"%s/%s\">\n", PACKAGE, VERSION);
 229 }
 230
 231 void
 232 proto_tree_write_pdml(epan_dissect_t *edt, FILE *fh)
 233 {
 234         write_pdml_data data;
 235
 236         /* Create the output */
 237         data.level = 0;
 238         data.fh = fh;
 239         data.src_list = edt->pi.data_src;
 240         data.edt = edt;
 241
 242         fprintf(fh, "<packet>\n");
 243
 244         /* Print a "geninfo" protocol as required by PDML */
 245         print_pdml_geninfo(edt->tree, fh);
 246
 247         proto_tree_children_foreach(edt->tree, proto_tree_write_node_pdml,
 248             &data);
 249
 250         fprintf(fh, "</packet>\n\n");
 251 }
 252
 253 /* Write out a tree's data, and any child nodes, as PDML */
 254 static void
 255 proto_tree_write_node_pdml(proto_node *node, gpointer data)
 256 {
 257         field_info      *fi = PITEM_FINFO(node);
 258         write_pdml_data *pdata = (write_pdml_data*) data;
 259         const gchar     *label_ptr;
 260         gchar           label_str[ITEM_LABEL_LENGTH];
 261         char            *dfilter_string;
 262         int             chop_len;
 263         int             i;
 264
 265         for (i = -1; i < pdata->level; i++) {
 266                 fputs("  ", pdata->fh);
 267         }
 268
 269         /* Text label. It's printed as a field with no name. */
 270         if (fi->hfinfo->id == hf_text_only) {
 271                 /* Get the text */
 272                 if (fi->rep) {
 273                         label_ptr = fi->rep->representation;
 274                 }
 275                 else {
 276                         label_ptr = "";
 277                 }
 278
 279                 /* Show empty name since it is a required field */
 280                 fputs("<field name=\"", pdata->fh);
 281                 fputs("\" show=\"", pdata->fh);
 282                 print_escaped_xml(pdata->fh, label_ptr);
 283
 284                 fprintf(pdata->fh, "\" size=\"%d", fi->length);
 285                 fprintf(pdata->fh, "\" pos=\"%d", fi->start);
 286
 287                 fputs("\" value=\"", pdata->fh);
 288                 write_pdml_field_hex_value(pdata, fi);
 289
 290                 if (node->first_child != NULL) {
 291                         fputs("\">\n", pdata->fh);
 292                 }
 293                 else {
 294                         fputs("\"/>\n", pdata->fh);
 295                 }
 296         }
 297         /* Uninterpreted data, i.e., the "Data" protocol, is
 298          * printed as a field instead of a protocol. */
 299         else if (fi->hfinfo->id == proto_data) {
 300
 301                 fputs("<field name=\"data\" value=\"", pdata->fh);
 302
 303                 write_pdml_field_hex_value(pdata, fi);
 304
 305                 fputs("\"/>\n", pdata->fh);
 306
 307         }
 308         /* Normal protocols and fields */
 309         else {
 310                 if (fi->hfinfo->type == FT_PROTOCOL) {
 311                         fputs("<proto name=\"", pdata->fh);
 312                 }
 313                 else {
 314                         fputs("<field name=\"", pdata->fh);
 315                 }
 316                 print_escaped_xml(pdata->fh, fi->hfinfo->abbrev);
 317
 318 #if 0
 319         /* PDML spec, see:
 320          * http://analyzer.polito.it/30alpha/docs/dissectors/PDMLSpec.htm
 321          *
 322          * the show fields contains things in 'human readable' format
 323          * showname: contains only the name of the field
 324          * show: contains only the data of the field
 325          * showdtl: contains additional details of the field data
 326          * showmap: contains mappings of the field data (e.g. the hostname to an IP address)
 327          *
 328          * XXX - the showname shouldn't contain the field data itself
 329          * (like it's contained in the fi->rep->representation).
 330          * Unfortunately, we don't have the field data representation for
 331          * all fields, so this isn't currently possible */
 332                 fputs("\" showname=\"", pdata->fh);
 333                 print_escaped_xml(pdata->fh, fi->hfinfo->name);
 334 #endif
 335
 336                 if (fi->rep) {
 337                         fputs("\" showname=\"", pdata->fh);
 338                         print_escaped_xml(pdata->fh, fi->rep->representation);
 339                 }
 340                 else {
 341                         label_ptr = label_str;
 342                         proto_item_fill_label(fi, label_str);
 343                         fputs("\" showname=\"", pdata->fh);
 344                         print_escaped_xml(pdata->fh, label_ptr);
 345                 }
 346
 347                 if (PROTO_ITEM_IS_HIDDEN(node))
 348                         fprintf(pdata->fh, "\" hide=\"yes");
 349
 350                 fprintf(pdata->fh, "\" size=\"%d", fi->length);
 351                 fprintf(pdata->fh, "\" pos=\"%d", fi->start);
 352 /*              fprintf(pdata->fh, "\" id=\"%d", fi->hfinfo->id);*/
 353
 354                 /* show, value, and unmaskedvalue attributes */
 355                 switch (fi->hfinfo->type)
 356                 {
 357                 case FT_PROTOCOL:
 358                         break;
 359                 case FT_NONE:
 360                         fputs("\" show=\"\" value=\"",  pdata->fh);
 361                         break;
 362                 default:
 363                         /* XXX - this is a hack until we can just call
 364                          * fvalue_to_string_repr() for *all* FT_* types. */
 365                         dfilter_string = proto_construct_match_selected_string(fi,
 366                             pdata->edt);
 367                         if (dfilter_string != NULL) {
 368                                 chop_len = strlen(fi->hfinfo->abbrev) + 4; /* for " == " */
 369
 370                                 /* XXX - Remove double-quotes. Again, once we
 371                                  * can call fvalue_to_string_repr(), we can
 372                                  * ask it not to produce the version for
 373                                  * display-filters, and thus, no
 374                                  * double-quotes. */
 375                                 if (dfilter_string[strlen(dfilter_string)-1] == '"') {
 376                                         dfilter_string[strlen(dfilter_string)-1] = '\0';
 377                                         chop_len++;
 378                                 }
 379
 380                                 fputs("\" show=\"", pdata->fh);
 381                                 print_escaped_xml(pdata->fh, &dfilter_string[chop_len]);
 382                         }
 383
 384                         /*
 385                          * XXX - should we omit "value" for any fields?
 386                          * What should we do for fields whose length is 0?
 387                          * They might come from a pseudo-header or from
 388                          * the capture header (e.g., time stamps), or
 389                          * they might be generated fields.
 390                          */
 391                         if (fi->length > 0) {
 392                                 fputs("\" value=\"", pdata->fh);
 393
 394                                 if (fi->hfinfo->bitmask!=0) {
 395                                         fprintf(pdata->fh, "%X", fvalue_get_uinteger(&fi->value));
 396                                         fputs("\" unmaskedvalue=\"", pdata->fh);
 397                                         write_pdml_field_hex_value(pdata, fi);
 398                                 }
 399                                 else {
 400                                         write_pdml_field_hex_value(pdata, fi);
 401                                 }
 402                         }
 403                 }
 404
 405                 if (node->first_child != NULL) {
 406                         fputs("\">\n", pdata->fh);
 407                 }
 408                 else if (fi->hfinfo->id == proto_data) {
 409                         fputs("\">\n", pdata->fh);
 410                 }
 411                 else {
 412                         fputs("\"/>\n", pdata->fh);
 413                 }
 414         }
 415
 416         /* We always print all levels for PDML. Recurse here. */
 417         if (node->first_child != NULL) {
 418                 pdata->level++;
 419                 proto_tree_children_foreach(node,
 420                                 proto_tree_write_node_pdml, pdata);
 421                 pdata->level--;
 422         }
 423
 424         if (node->first_child != NULL) {
 425                 for (i = -1; i < pdata->level; i++) {
 426                         fputs("  ", pdata->fh);
 427                 }
 428                 if (fi->hfinfo->type == FT_PROTOCOL) {
 429                         fputs("</proto>\n", pdata->fh);
 430                 }
 431                 else {
 432                         fputs("</field>\n", pdata->fh);
 433                 }
 434         }
 435 }
 436
 437 /* Print info for a 'geninfo' pseudo-protocol. This is required by
 438  * the PDML spec. The information is contained in Wireshark's 'frame' protocol,
 439  * but we produce a 'geninfo' protocol in the PDML to conform to spec.
 440  * The 'frame' protocol follows the 'geninfo' protocol in the PDML. */
 441 static void
 442 print_pdml_geninfo(proto_tree *tree, FILE *fh)
 443 {
 444         guint32 num, len, caplen;
 445         nstime_t *timestamp;
 446         GPtrArray *finfo_array;
 447         field_info *frame_finfo;
 448
 449         /* Get frame protocol's finfo. */
 450         finfo_array = proto_find_finfo(tree, proto_frame);
 451         if (g_ptr_array_len(finfo_array) < 1) {
 452                 return;
 453         }
 454         frame_finfo = finfo_array->pdata[0];
 455         g_ptr_array_free(finfo_array, FALSE);
 456
 457         /* frame.number --> geninfo.num */
 458         finfo_array = proto_find_finfo(tree, hf_frame_number);
 459         if (g_ptr_array_len(finfo_array) < 1) {
 460                 return;
 461         }
 462         num = fvalue_get_uinteger(&((field_info*)finfo_array->pdata[0])->value);
 463         g_ptr_array_free(finfo_array, FALSE);
 464
 465         /* frame.pkt_len --> geninfo.len */
 466         finfo_array = proto_find_finfo(tree, hf_frame_packet_len);
 467         if (g_ptr_array_len(finfo_array) < 1) {
 468                 return;
 469         }
 470         len = fvalue_get_uinteger(&((field_info*)finfo_array->pdata[0])->value);
 471         g_ptr_array_free(finfo_array, FALSE);
 472
 473         /* frame.cap_len --> geninfo.caplen */
 474         finfo_array = proto_find_finfo(tree, hf_frame_capture_len);
 475         if (g_ptr_array_len(finfo_array) < 1) {
 476                 return;
 477         }
 478         caplen = fvalue_get_uinteger(&((field_info*)finfo_array->pdata[0])->value);
 479         g_ptr_array_free(finfo_array, FALSE);
 480
 481         /* frame.time --> geninfo.timestamp */
 482         finfo_array = proto_find_finfo(tree, hf_frame_arrival_time);
 483         if (g_ptr_array_len(finfo_array) < 1) {
 484                 return;
 485         }
 486         timestamp = fvalue_get(&((field_info*)finfo_array->pdata[0])->value);
 487         g_ptr_array_free(finfo_array, FALSE);
 488
 489         /* Print geninfo start */
 490         fprintf(fh,
 491 "  <proto name=\"geninfo\" pos=\"0\" showname=\"General information\" size=\"%u\">\n",
 492                 frame_finfo->length);
 493
 494         /* Print geninfo.num */
 495         fprintf(fh,
 496 "    <field name=\"num\" pos=\"0\" show=\"%u\" showname=\"Number\" value=\"%x\" size=\"%u\"/>\n",
 497                 num, num, frame_finfo->length);
 498
 499         /* Print geninfo.len */
 500         fprintf(fh,
 501 "    <field name=\"len\" pos=\"0\" show=\"%u\" showname=\"Packet Length\" value=\"%x\" size=\"%u\"/>\n",
 502                 len, len, frame_finfo->length);
 503
 504         /* Print geninfo.caplen */
 505         fprintf(fh,
 506 "    <field name=\"caplen\" pos=\"0\" show=\"%u\" showname=\"Captured Length\" value=\"%x\" size=\"%u\"/>\n",
 507                 caplen, caplen, frame_finfo->length);
 508
 509         /* Print geninfo.timestamp */
 510         fprintf(fh,
 511 "    <field name=\"timestamp\" pos=\"0\" show=\"%s\" showname=\"Captured Time\" value=\"%d.%09d\" size=\"%u\"/>\n",
 512                 abs_time_to_str(timestamp), (int) timestamp->secs, timestamp->nsecs, frame_finfo->length);
 513
 514         /* Print geninfo end */
 515         fprintf(fh,
 516 "  </proto>\n");
 517 }
 518
 519 void
 520 write_pdml_finale(FILE *fh)
 521 {
 522         fputs("</pdml>\n", fh);
 523 }
 524
 525 void
 526 write_psml_preamble(FILE *fh)
 527 {
 528         fputs("<?xml version=\"1.0\"?>\n", fh);
 529         fputs("<psml version=\"" PSML_VERSION "\" ", fh);
 530         fprintf(fh, "creator=\"%s/%s\">\n", PACKAGE, VERSION);
 531 }
 532
 533 void
 534 proto_tree_write_psml(epan_dissect_t *edt, FILE *fh)
 535 {
 536         gint    i;
 537
 538         /* if this is the first packet, we have to create the PSML structure output */
 539         if(edt->pi.fd->num == 1) {
 540             fprintf(fh, "<structure>\n");
 541
 542             for(i=0; i < edt->pi.cinfo->num_cols; i++) {
 543                 fprintf(fh, "<section>");
 544                 print_escaped_xml(fh, edt->pi.cinfo->col_title[i]);
 545                 fprintf(fh, "</section>\n");
 546             }
 547
 548             fprintf(fh, "</structure>\n\n");
 549         }
 550
 551         fprintf(fh, "<packet>\n");
 552
 553         for(i=0; i < edt->pi.cinfo->num_cols; i++) {
 554             fprintf(fh, "<section>");
 555             print_escaped_xml(fh, edt->pi.cinfo->col_data[i]);
 556             fprintf(fh, "</section>\n");
 557         }
 558
 559         fprintf(fh, "</packet>\n\n");
 560 }
 561
 562 void
 563 write_psml_finale(FILE *fh)
 564 {
 565         fputs("</psml>\n", fh);
 566 }
 567
 568 void
 569 write_csv_preamble(FILE *fh _U_)
 570 {
 571
 572 }
 573
 574 void
 575 proto_tree_write_csv(epan_dissect_t *edt, FILE *fh)
 576 {
 577         gint    i;
 578
 579         /* if this is the first packet, we have to write the CSV header */
 580         if(edt->pi.fd->num == 1) {
 581             for(i=0; i < edt->pi.cinfo->num_cols - 1; i++)
 582                 fprintf(fh, "\"%s\",", edt->pi.cinfo->col_title[i]);
 583
 584             fprintf(fh, "\"%s\"\n", edt->pi.cinfo->col_title[i]);
 585         }
 586
 587         for(i=0; i < edt->pi.cinfo->num_cols - 1; i++)
 588             fprintf(fh, "\"%s\",", edt->pi.cinfo->col_data[i]);
 589
 590         fprintf(fh, "\"%s\"\n", edt->pi.cinfo->col_data[i]);
 591 }
 592
 593 void
 594 write_csv_finale(FILE *fh _U_)
 595 {
 596
 597 }
 598
 599 /*
 600  * Find the data source for a specified field, and return a pointer
 601  * to the data in it. Returns NULL if the data is out of bounds.
 602  */
 603 static const guint8 *
 604 get_field_data(GSList *src_list, field_info *fi)
 605 {
 606         GSList *src_le;
 607         data_source *src;
 608         tvbuff_t *src_tvb;
 609         gint length, tvbuff_length;
 610
 611         for (src_le = src_list; src_le != NULL; src_le = src_le->next) {
 612                 src = src_le->data;
 613                 src_tvb = src->tvb;
 614                 if (fi->ds_tvb == src_tvb) {
 615                         /*
 616                          * Found it.
 617                          *
 618                          * XXX - a field can have a length that runs past
 619                          * the end of the tvbuff.  Ideally, that should
 620                          * be fixed when adding an item to the protocol
 621                          * tree, but checking the length when doing
 622                          * that could be expensive.  Until we fix that,
 623                          * we'll do the check here.
 624                          */
 625                         tvbuff_length = tvb_length_remaining(src_tvb,
 626                             fi->start);
 627                         if (tvbuff_length < 0) {
 628                                 return NULL;
 629                         }
 630                         length = fi->length;
 631                         if (length > tvbuff_length)
 632                                 length = tvbuff_length;
 633                         return tvb_get_ptr(src_tvb, fi->start, length);
 634                 }
 635         }
 636         g_assert_not_reached();
 637         return NULL;    /* not found */
 638 }
 639
 640 /* Print a string, escaping out certain characters that need to
 641  * escaped out for XML. */
 642 static void
 643 print_escaped_xml(FILE *fh, const char *unescaped_string)
 644 {
 645         const char *p;
 646
 647         for (p = unescaped_string; *p != '\0'; p++) {
 648                 switch (*p) {
 649                         case '&':
 650                                 fputs("&amp;", fh);
 651                                 break;
 652                         case '<':
 653                                 fputs("&lt;", fh);
 654                                 break;
 655                         case '>':
 656                                 fputs("&gt;", fh);
 657                                 break;
 658                         case '"':
 659                                 fputs("&quot;", fh);
 660                                 break;
 661                         case '\'':
 662                                 fputs("&apos;", fh);
 663                                 break;
 664                         default:
 665                                 fputc(*p, fh);
 666                 }
 667         }
 668 }
 669
 670 static void
 671 write_pdml_field_hex_value(write_pdml_data *pdata, field_info *fi)
 672 {
 673         int i;
 674         const guint8 *pd;
 675
 676         if (fi->length > tvb_length_remaining(fi->ds_tvb, fi->start)) {
 677                 fprintf(pdata->fh, "field length invalid!");
 678                 return;
 679         }
 680
 681         /* Find the data for this field. */
 682         pd = get_field_data(pdata->src_list, fi);
 683
 684         if (pd) {
 685                 /* Print a simple hex dump */
 686                 for (i = 0 ; i < fi->length; i++) {
 687                         fprintf(pdata->fh, "%02x", pd[i]);
 688                 }
 689         }
 690 }
 691
 692 gboolean
 693 print_hex_data(print_stream_t *stream, epan_dissect_t *edt)
 694 {
 695         gboolean multiple_sources;
 696         GSList *src_le;
 697         data_source *src;
 698         tvbuff_t *tvb;
 699         char *name;
 700         char *line;
 701         const guchar *cp;
 702         guint length;
 703
 704         /*
 705          * Set "multiple_sources" iff this frame has more than one
 706          * data source; if it does, we need to print the name of
 707          * the data source before printing the data from the
 708          * data source.
 709          */
 710         multiple_sources = (edt->pi.data_src->next != NULL);
 711
 712         for (src_le = edt->pi.data_src; src_le != NULL;
 713             src_le = src_le->next) {
 714                 src = src_le->data;
 715                 tvb = src->tvb;
 716                 if (multiple_sources) {
 717                         name = src->name;
 718                         print_line(stream, 0, "");
 719                         line = g_malloc(strlen(name) + 2);      /* <name>:\0 */
 720                         strcpy(line, name);
 721                         strcat(line, ":");
 722                         print_line(stream, 0, line);
 723                         g_free(line);
 724                 }
 725                 length = tvb_length(tvb);
 726                 if (length == 0)
 727                     return TRUE;
 728                 cp = tvb_get_ptr(tvb, 0, length);
 729                 if (!print_hex_data_buffer(stream, cp, length,
 730                     edt->pi.fd->flags.encoding))
 731                         return FALSE;
 732         }
 733         return TRUE;
 734 }
 735
 736 /*
 737  * This routine is based on a routine created by Dan Lasley
 738  * <DLASLEY@PROMUS.com>.
 739  *
 740  * It was modified for Wireshark by Gilbert Ramirez and others.
 741  */
 742
 743 #define MAX_OFFSET_LEN  8       /* max length of hex offset of bytes */
 744 #define BYTES_PER_LINE  16      /* max byte values printed on a line */
 745 #define HEX_DUMP_LEN    (BYTES_PER_LINE*3)
 746                                 /* max number of characters hex dump takes -
 747                                    2 digits plus trailing blank */
 748 #define DATA_DUMP_LEN   (HEX_DUMP_LEN + 2 + BYTES_PER_LINE)
 749                                 /* number of characters those bytes take;
 750                                    3 characters per byte of hex dump,
 751                                    2 blanks separating hex from ASCII,
 752                                    1 character per byte of ASCII dump */
 753 #define MAX_LINE_LEN    (MAX_OFFSET_LEN + 2 + DATA_DUMP_LEN)
 754                                 /* number of characters per line;
 755                                    offset, 2 blanks separating offset
 756                                    from data dump, data dump */
 757
 758 static gboolean
 759 print_hex_data_buffer(print_stream_t *stream, const guchar *cp,
 760     guint length, char_enc encoding)
 761 {
 762         register unsigned int ad, i, j, k, l;
 763         guchar c;
 764         guchar line[MAX_LINE_LEN + 1];
 765         unsigned int use_digits;
 766         static guchar binhex[16] = {
 767                 '0', '1', '2', '3', '4', '5', '6', '7',
 768                 '8', '9', 'a', 'b', 'c', 'd', 'e', 'f'};
 769
 770         if (!print_line(stream, 0, ""))
 771                 return FALSE;
 772
 773         /*
 774          * How many of the leading digits of the offset will we supply?
 775          * We always supply at least 4 digits, but if the maximum offset
 776          * won't fit in 4 digits, we use as many digits as will be needed.
 777          */
 778         if (((length - 1) & 0xF0000000) != 0)
 779                 use_digits = 8; /* need all 8 digits */
 780         else if (((length - 1) & 0x0F000000) != 0)
 781                 use_digits = 7; /* need 7 digits */
 782         else if (((length - 1) & 0x00F00000) != 0)
 783                 use_digits = 6; /* need 6 digits */
 784         else if (((length - 1) & 0x000F0000) != 0)
 785                 use_digits = 5; /* need 5 digits */
 786         else
 787                 use_digits = 4; /* we'll supply 4 digits */
 788
 789         ad = 0;
 790         i = 0;
 791         j = 0;
 792         k = 0;
 793         while (i < length) {
 794                 if ((i & 15) == 0) {
 795                         /*
 796                          * Start of a new line.
 797                          */
 798                         j = 0;
 799                         k = 0;
 800                         l = use_digits;
 801                         do {
 802                                 l--;
 803                                 c = (ad >> (l*4)) & 0xF;
 804                                 line[j++] = binhex[c];
 805                         } while (l != 0);
 806                         line[j++] = ' ';
 807                         line[j++] = ' ';
 808                         memset(line+j, ' ', DATA_DUMP_LEN);
 809
 810                         /*
 811                          * Offset in line of ASCII dump.
 812                          */
 813                         k = j + HEX_DUMP_LEN + 2;
 814                 }
 815                 c = *cp++;
 816                 line[j++] = binhex[c>>4];
 817                 line[j++] = binhex[c&0xf];
 818                 j++;
 819                 if (encoding == CHAR_EBCDIC) {
 820                         c = EBCDIC_to_ASCII1(c);
 821                 }
 822                 line[k++] = c >= ' ' && c < 0x7f ? c : '.';
 823                 i++;
 824                 if ((i & 15) == 0 || i == length) {
 825                         /*
 826                          * We'll be starting a new line, or
 827                          * we're finished printing this buffer;
 828                          * dump out the line we've constructed,
 829                          * and advance the offset.
 830                          */
 831                         line[k] = '\0';
 832                         if (!print_line(stream, 0, line))
 833                                 return FALSE;
 834                         ad += 16;
 835                 }
 836         }
 837         return TRUE;
 838 }
 839
 840 static
 841 void ps_clean_string(unsigned char *out, const unsigned char *in,
 842                         int outbuf_size)
 843 {
 844         int rd, wr;
 845         char c;
 846
 847         for (rd = 0, wr = 0 ; wr < outbuf_size; rd++, wr++ ) {
 848                 c = in[rd];
 849                 switch (c) {
 850                         case '(':
 851                         case ')':
 852                         case '\\':
 853                                 out[wr] = '\\';
 854                                 out[++wr] = c;
 855                                 break;
 856
 857                         default:
 858                                 out[wr] = c;
 859                                 break;
 860                 }
 861
 862                 if (c == 0) {
 863                         break;
 864                 }
 865         }
 866 }
 867
 868 /* Some formats need stuff at the beginning of the output */
 869 gboolean
 870 print_preamble(print_stream_t *self, gchar *filename)
 871 {
 872         return (self->ops->print_preamble)(self, filename);
 873 }
 874
 875 gboolean
 876 print_line(print_stream_t *self, int indent, const char *line)
 877 {
 878         return (self->ops->print_line)(self, indent, line);
 879 }
 880
 881 /* Insert bookmark */
 882 gboolean
 883 print_bookmark(print_stream_t *self, const gchar *name, const gchar *title)
 884 {
 885         return (self->ops->print_bookmark)(self, name, title);
 886 }
 887
 888 gboolean
 889 new_page(print_stream_t *self)
 890 {
 891         return (self->ops->new_page)(self);
 892 }
 893
 894 /* Some formats need stuff at the end of the output */
 895 gboolean
 896 print_finale(print_stream_t *self)
 897 {
 898         return (self->ops->print_finale)(self);
 899 }
 900
 901 gboolean
 902 destroy_print_stream(print_stream_t *self)
 903 {
 904         return (self->ops->destroy)(self);
 905 }
 906
 907 typedef struct {
 908         int to_file;
 909         FILE *fh;
 910 } output_text;
 911
 912 static gboolean
 913 print_preamble_text(print_stream_t *self _U_, gchar *filename _U_)
 914 {
 915         /* do nothing */
 916         return TRUE;    /* always succeeds */
 917 }
 918
 919 static gboolean
 920 print_line_text(print_stream_t *self, int indent, const char *line)
 921 {
 922         output_text *output = self->data;
 923         char space[MAX_INDENT+1];
 924         int i;
 925         int num_spaces;
 926
 927         /* Prepare the tabs for printing, depending on tree level */
 928         num_spaces = indent * 4;
 929         if (num_spaces > MAX_INDENT) {
 930                 num_spaces = MAX_INDENT;
 931         }
 932         for (i = 0; i < num_spaces; i++) {
 933                 space[i] = ' ';
 934         }
 935         /* The string is NUL-terminated */
 936         space[num_spaces] = '\0';
 937
 938         fputs(space, output->fh);
 939         fputs(line, output->fh);
 940         putc('\n', output->fh);
 941         return !ferror(output->fh);
 942 }
 943
 944 static gboolean
 945 print_bookmark_text(print_stream_t *self _U_, const gchar *name _U_,
 946     const gchar *title _U_)
 947 {
 948         /* do nothing */
 949         return TRUE;
 950 }
 951
 952 static gboolean
 953 new_page_text(print_stream_t *self)
 954 {
 955         output_text *output = self->data;
 956
 957         fputs("\f", output->fh);
 958         return !ferror(output->fh);
 959 }
 960
 961 static gboolean
 962 print_finale_text(print_stream_t *self _U_)
 963 {
 964         /* do nothing */
 965         return TRUE;    /* always succeeds */
 966 }
 967
 968 static gboolean
 969 destroy_text(print_stream_t *self)
 970 {
 971         output_text *output = self->data;
 972         gboolean ret;
 973
 974         ret = close_print_dest(output->to_file, output->fh);
 975         g_free(output);
 976         g_free(self);
 977         return ret;
 978 }
 979
 980 static const print_stream_ops_t print_text_ops = {
 981         print_preamble_text,
 982         print_line_text,
 983         print_bookmark_text,
 984         new_page_text,
 985         print_finale_text,
 986         destroy_text
 987 };
 988
 989 print_stream_t *
 990 print_stream_text_new(int to_file, const char *dest)
 991 {
 992         FILE *fh;
 993         print_stream_t *stream;
 994         output_text *output;
 995
 996         fh = open_print_dest(to_file, dest);
 997         if (fh == NULL)
 998                 return NULL;
 999
1000         output = g_malloc(sizeof *output);
1001         output->to_file = to_file;
1002         output->fh = fh;
1003         stream = g_malloc(sizeof (print_stream_t));
1004         stream->ops = &print_text_ops;
1005         stream->data = output;
1006
1007         return stream;
1008 }
1009
1010 print_stream_t *
1011 print_stream_text_stdio_new(FILE *fh)
1012 {
1013         print_stream_t *stream;
1014         output_text *output;
1015
1016         output = g_malloc(sizeof *output);
1017         output->to_file = TRUE;
1018         output->fh = fh;
1019         stream = g_malloc(sizeof (print_stream_t));
1020         stream->ops = &print_text_ops;
1021         stream->data = output;
1022
1023         return stream;
1024 }
1025
1026 typedef struct {
1027         int to_file;
1028         FILE *fh;
1029 } output_ps;
1030
1031 static gboolean
1032 print_preamble_ps(print_stream_t *self, gchar *filename)
1033 {
1034         output_ps *output = self->data;
1035         unsigned char psbuffer[MAX_PS_LINE_LENGTH]; /* static sized buffer! */
1036
1037         print_ps_preamble(output->fh);
1038
1039         fputs("%% Set the font to 10 point\n", output->fh);
1040         fputs("/Courier findfont 10 scalefont setfont\n", output->fh);
1041         fputs("\n", output->fh);
1042         fputs("%% the page title\n", output->fh);
1043         ps_clean_string(psbuffer, filename, MAX_PS_LINE_LENGTH);
1044         fprintf(output->fh, "/eth_pagetitle (%s - Wireshark) def\n", psbuffer);
1045         fputs("\n", output->fh);
1046         return !ferror(output->fh);
1047 }
1048
1049 static gboolean
1050 print_line_ps(print_stream_t *self, int indent, const char *line)
1051 {
1052         output_ps *output = self->data;
1053         unsigned char psbuffer[MAX_PS_LINE_LENGTH]; /* static sized buffer! */
1054
1055         ps_clean_string(psbuffer, line, MAX_PS_LINE_LENGTH);
1056         fprintf(output->fh, "%d (%s) putline\n", indent, psbuffer);
1057         return !ferror(output->fh);
1058 }
1059
1060 static gboolean
1061 print_bookmark_ps(print_stream_t *self, const gchar *name, const gchar *title)
1062 {
1063         output_ps *output = self->data;
1064         unsigned char psbuffer[MAX_PS_LINE_LENGTH]; /* static sized buffer! */
1065
1066         /*
1067          * See the Adobe "pdfmark reference":
1068          *
1069          *      http://partners.adobe.com/asn/acrobat/docs/pdfmark.pdf
1070          *
1071          * The pdfmark stuff tells code that turns PostScript into PDF
1072          * things that it should do.
1073          *
1074          * The /OUT stuff creates a bookmark that goes to the
1075          * destination with "name" as the name and "title" as the title.
1076          *
1077          * The "/DEST" creates the destination.
1078          */
1079         ps_clean_string(psbuffer, title, MAX_PS_LINE_LENGTH);
1080         fprintf(output->fh, "[/Dest /%s /Title (%s)   /OUT pdfmark\n", name,
1081             psbuffer);
1082         fputs("[/View [/XYZ -4 currentpoint matrix currentmatrix matrix defaultmatrix\n",
1083             output->fh);
1084         fputs("matrix invertmatrix matrix concatmatrix transform exch pop 20 add null]\n",
1085             output->fh);
1086         fprintf(output->fh, "/Dest /%s /DEST pdfmark\n", name);
1087         return !ferror(output->fh);
1088 }
1089
1090 static gboolean
1091 new_page_ps(print_stream_t *self)
1092 {
1093         output_ps *output = self->data;
1094
1095         fputs("formfeed\n", output->fh);
1096         return !ferror(output->fh);
1097 }
1098
1099 static gboolean
1100 print_finale_ps(print_stream_t *self)
1101 {
1102         output_ps *output = self->data;
1103
1104         print_ps_finale(output->fh);
1105         return !ferror(output->fh);
1106 }
1107
1108 static gboolean
1109 destroy_ps(print_stream_t *self)
1110 {
1111         output_ps *output = self->data;
1112         gboolean ret;
1113
1114         ret = close_print_dest(output->to_file, output->fh);
1115         g_free(output);
1116         g_free(self);
1117         return ret;
1118 }
1119
1120 static const print_stream_ops_t print_ps_ops = {
1121         print_preamble_ps,
1122         print_line_ps,
1123         print_bookmark_ps,
1124         new_page_ps,
1125         print_finale_ps,
1126         destroy_ps
1127 };
1128
1129 print_stream_t *
1130 print_stream_ps_new(int to_file, const char *dest)
1131 {
1132         FILE *fh;
1133         print_stream_t *stream;
1134         output_ps *output;
1135
1136         fh = open_print_dest(to_file, dest);
1137         if (fh == NULL)
1138                 return NULL;
1139
1140         output = g_malloc(sizeof *output);
1141         output->to_file = to_file;
1142         output->fh = fh;
1143         stream = g_malloc(sizeof (print_stream_t));
1144         stream->ops = &print_ps_ops;
1145         stream->data = output;
1146
1147         return stream;
1148 }
1149
1150 print_stream_t *
1151 print_stream_ps_stdio_new(FILE *fh)
1152 {
1153         print_stream_t *stream;
1154         output_ps *output;
1155
1156         output = g_malloc(sizeof *output);
1157         output->to_file = TRUE;
1158         output->fh = fh;
1159         stream = g_malloc(sizeof (print_stream_t));
1160         stream->ops = &print_ps_ops;
1161         stream->data = output;
1162
1163         return stream;
1164 }
1165
1166 output_fields_t* output_fields_new()
1167 {
1168     output_fields_t* fields = g_new(output_fields_t, 1);
1169     fields->print_header = FALSE;
1170     fields->separator = '\t';
1171     fields->fields = NULL; /*Do lazy initialisation */
1172     fields->field_indicies = NULL;
1173     fields->field_values = NULL;
1174     fields->quote='\0';
1175     return fields;
1176 }
1177
1178 gsize output_fields_num_fields(output_fields_t* fields)
1179 {
1180     g_assert(fields);
1181
1182     if(NULL == fields->fields) {
1183         return 0;
1184     } else {
1185         return fields->fields->len;
1186     }
1187 }
1188
1189 void output_fields_free(output_fields_t* fields)
1190 {
1191     g_assert(fields);
1192
1193     if(NULL != fields->field_indicies) {
1194         /* Keys are stored in fields->fields, values are
1195          * integers.
1196          */
1197         g_hash_table_destroy(fields->field_indicies);
1198     }
1199     if(NULL != fields->fields) {
1200         gsize i;
1201         for(i = 0; i < fields->fields->len; ++i) {
1202             gchar* field = g_ptr_array_index(fields->fields,i);
1203             g_free(field);
1204         }
1205         g_ptr_array_free(fields->fields, TRUE);
1206     }
1207
1208     g_free(fields);
1209 }
1210
1211 void output_fields_add(output_fields_t* fields, const gchar* field)
1212 {
1213     gchar* field_copy;
1214
1215     g_assert(fields);
1216     g_assert(field);
1217
1218
1219     if(NULL == fields->fields) {
1220         fields->fields = g_ptr_array_new();
1221     }
1222
1223     field_copy = g_strdup(field);
1224
1225     g_ptr_array_add(fields->fields, field_copy);
1226 }
1227
1228 gboolean output_fields_set_option(output_fields_t* info, gchar* option)
1229 {
1230     const gchar* option_name;
1231     const gchar* option_value;
1232
1233     g_assert(info);
1234     g_assert(option);
1235
1236     if('\0' == *option) {
1237         return FALSE; /* Is this guarded against by option parsing? */
1238     }
1239     option_name = strtok(option,"=");
1240     option_value = option + strlen(option_name) + 1;
1241     if(0 == strcmp(option_name, "header")) {
1242         switch(NULL == option_value ? '\0' : *option_value) {
1243         case 'n':
1244             info->print_header = FALSE;
1245             break;
1246         case 'y':
1247             info->print_header = TRUE;
1248             break;
1249         default:
1250             return FALSE;
1251         }
1252         return TRUE;
1253     }
1254
1255     if(0 == strcmp(option_name,"separator")) {
1256         switch(NULL == option_value ? '\0' : *option_value) {
1257         case '\0':
1258             return FALSE;
1259         case '/':
1260             switch(*++option_value) {
1261             case 't':
1262                 info->separator = '\t';
1263                 break;
1264             case 's':
1265                 info->separator = ' ';
1266                 break;
1267             default:
1268                 info->separator = '\\';
1269             }
1270             break;
1271         default:
1272             info->separator = *option_value;
1273             break;
1274         }
1275         return TRUE;
1276     }
1277
1278     if(0 == strcmp(option_name, "quote")) {
1279         switch(NULL == option_value ? '\0' : *option_value) {
1280         default: /* Fall through */
1281         case '\0':
1282             info->quote='\0';
1283             return FALSE;
1284         case 'd':
1285             info->quote='"';
1286             break;
1287         case 's':
1288             info->quote='\'';
1289             break;
1290         case 'n':
1291             info->quote='\0';
1292             break;
1293         }
1294         return TRUE;
1295     }
1296
1297     return FALSE;
1298 }
1299
1300 void output_fields_list_options(FILE *fh)
1301 {
1302     fprintf(fh, "TShark: The available options for field output \"E\" are:\n");
1303     fputs("header=y|n   Print field abbreviations as first line of output (def: N: no)\n", fh);
1304     fputs("separator=/t|/s|<character>   Set the separator to use; \"/t\" = tab,\n \"/s\" = space (def: /t: tab)\n", fh);
1305     fputs("quote=d|s|n   Print either d: double-quotes, s: single quotes or n: no quotes around field values (def: n: none)\n", fh);
1306 }
1307
1308
1309 void write_fields_preamble(output_fields_t* fields, FILE *fh)
1310 {
1311     gsize i;
1312
1313     g_assert(fields);
1314     g_assert(fh);
1315
1316     if(!fields->print_header) {
1317         return;
1318     }
1319
1320     for(i = 0; i < fields->fields->len; ++i) {
1321         const gchar* field = g_ptr_array_index(fields->fields,i);
1322         if(i != 0 ) {
1323             fputc(fields->separator, fh);
1324         }
1325         fputs(field, fh);
1326     }
1327     fputc('\n', fh);
1328 }
1329
1330
1331
1332
1333 static void proto_tree_get_node_field_values(proto_node *node, gpointer data)
1334 {
1335     write_field_data_t *call_data;
1336         field_info      *fi;
1337     gpointer field_index;
1338
1339     call_data = data;
1340     fi = PITEM_FINFO(node);
1341
1342     field_index = g_hash_table_lookup(call_data->fields->field_indicies, fi->hfinfo->abbrev);
1343     if(NULL != field_index) {
1344         const gchar* value;
1345
1346         value = get_node_field_value(fi, call_data->edt); /* ep_alloced string */
1347
1348         if(NULL != value && '\0' != *value) {
1349             guint actual_index;
1350             actual_index = GPOINTER_TO_UINT(field_index);
1351             /* Unwrap change made to disambiguiate zero / null */
1352             call_data->fields->field_values[actual_index - 1] = value;
1353         }
1354     }
1355
1356         /* Recurse here. */
1357         if (node->first_child != NULL) {
1358                 proto_tree_children_foreach(node,
1359                                 proto_tree_get_node_field_values, call_data);
1360         }
1361 }
1362
1363 void proto_tree_write_fields(output_fields_t* fields, epan_dissect_t *edt, FILE *fh)
1364 {
1365     gsize i;
1366
1367     write_field_data_t data;
1368
1369     g_assert(fields);
1370     g_assert(edt);
1371     g_assert(fh);
1372
1373     data.fields = fields;
1374     data.edt = edt;
1375
1376     if(NULL == fields->field_indicies) {
1377         /* Prepare a lookup table from string abbreviation for field to its index. */
1378         fields->field_indicies = g_hash_table_new(g_str_hash, g_str_equal);
1379
1380         i = 0;
1381         while( i < fields->fields->len) {
1382             gchar* field = g_ptr_array_index(fields->fields, i);
1383              /* Store field indicies +1 so that zero is not a valid value,
1384               * and can be distinguished from NULL as a pointer.
1385               */
1386             ++i;
1387             g_hash_table_insert(fields->field_indicies, field, GUINT_TO_POINTER(i));
1388         }
1389     }
1390
1391     /* Buffer to store values for this packet */
1392     fields->field_values = ep_alloc_array0(const gchar*, fields->fields->len);
1393
1394         proto_tree_children_foreach(edt->tree, proto_tree_get_node_field_values,
1395             &data);
1396
1397     for(i = 0; i < fields->fields->len; ++i) {
1398         if(0 != i) {
1399             fputc(fields->separator, fh);
1400         }
1401         if(NULL != fields->field_values[i]) {
1402             if(fields->quote != '\0') {
1403                 fputc(fields->quote, fh);
1404             }
1405             fputs(fields->field_values[i], fh);
1406             if(fields->quote != '\0') {
1407                 fputc(fields->quote, fh);
1408             }
1409         }
1410     }
1411 }
1412
1413 void write_fields_finale(output_fields_t* fields _U_ , FILE *fh _U_)
1414 {
1415     /* Nothing to do */
1416 }
1417
1418 /* Returns an ep_alloced string or a static constant*/
1419 static const gchar* get_node_field_value(field_info* fi, epan_dissect_t* edt)
1420 {
1421         /* Text label. */
1422         if (fi->hfinfo->id == hf_text_only) {
1423                 /* Get the text */
1424                 if (fi->rep) {
1425             return fi->rep->representation;
1426                 }
1427                 else {
1428                         return get_field_hex_value(edt->pi.data_src, fi);
1429                 }
1430         }
1431         /* Uninterpreted data, i.e., the "Data" protocol, is
1432          * printed as a field instead of a protocol. */
1433         else if (fi->hfinfo->id == proto_data) {
1434         return get_field_hex_value(edt->pi.data_src, fi);
1435         }
1436
1437         /* Normal protocols and fields */
1438         else {
1439         gchar           *dfilter_string;
1440             gint                chop_len;
1441
1442                 switch (fi->hfinfo->type)
1443                 {
1444                 case FT_PROTOCOL:
1445             /* Print out the full details for the protocol. */
1446                     if (fi->rep) {
1447                 return fi->rep->representation;
1448                     } else {
1449                 /* Just print out the protocol abbreviation */
1450                 return fi->hfinfo->abbrev;;
1451             }
1452                 case FT_NONE:
1453                         return NULL;
1454                 default:
1455                         /* XXX - this is a hack until we can just call
1456                          * fvalue_to_string_repr() for *all* FT_* types. */
1457                         dfilter_string = proto_construct_match_selected_string(fi,
1458                             edt);
1459                         if (dfilter_string != NULL) {
1460                                 chop_len = strlen(fi->hfinfo->abbrev) + 4; /* for " == " */
1461
1462                                 /* XXX - Remove double-quotes. Again, once we
1463                                  * can call fvalue_to_string_repr(), we can
1464                                  * ask it not to produce the version for
1465                                  * display-filters, and thus, no
1466                                  * double-quotes. */
1467                                 if (dfilter_string[strlen(dfilter_string)-1] == '"') {
1468                                         dfilter_string[strlen(dfilter_string)-1] = '\0';
1469                                         chop_len++;
1470                                 }
1471
1472                 return &(dfilter_string[chop_len]);
1473                         } else {
1474                         return get_field_hex_value(edt->pi.data_src, fi);
1475             }
1476                 }
1477     }
1478 }
1479
1480 static const gchar*
1481 get_field_hex_value(GSList* src_list, field_info *fi)
1482 {
1483         const guint8 *pd;
1484
1485         if (fi->length > tvb_length_remaining(fi->ds_tvb, fi->start)) {
1486                 return "field length invalid!";
1487         }
1488
1489         /* Find the data for this field. */
1490         pd = get_field_data(src_list, fi);
1491
1492         if (pd) {
1493         int i;
1494         gchar* buffer;
1495         gchar* p;
1496         int len;
1497         const int chars_per_byte = 2;
1498
1499         len = chars_per_byte * fi->length;
1500         buffer = ep_alloc_array(gchar, len + 1);
1501         buffer[len] = '\0'; /* Ensure NULL termination in bad cases */
1502         p = buffer;
1503                 /* Print a simple hex dump */
1504                 for (i = 0 ; i < fi->length; i++) {
1505                         g_snprintf(p, len, "%02x", pd[i]);
1506             p += chars_per_byte;
1507             len -= chars_per_byte;
1508                 }
1509         return buffer;
1510         } else {
1511         return NULL;
1512     }
1513 }