print_util.c

该软件根据网络数据生成NetFlow记录。NetFlow可用于网络规划、负载均衡、安全监控等

  sprintf(addr, "%hu.%hu.%hu", 
	  card, vpi, vci);

  return addr;
}

void 
print_flow(FILE *f, flow_inner_t *tc, int way)
{
  unsigned int srcaddr, dstaddr;
  unsigned short srcport, dstport;
  unsigned int srcatmdata, dstatmdata;

  if (way == CLIENT)
    {
      srcaddr = (unsigned int)tc->srcaddr;
      dstaddr = (unsigned int)tc->dstaddr;
      srcport = ntohs(tc->srcport);
      dstport = ntohs(tc->dstport);
      srcatmdata = tc->src_atmdata;
      dstatmdata = tc->dst_atmdata;
    }
  else
    {
      srcaddr = (unsigned int)tc->dstaddr;
      dstaddr = (unsigned int)tc->srcaddr;
      srcport = ntohs(tc->dstport);
      dstport = ntohs(tc->srcport);
      srcatmdata = tc->dst_atmdata;
      dstatmdata = tc->src_atmdata;
    }

  fprintf(f, "%s:%hu > ", intoa(srcaddr), srcport);
  fprintf(f, "%s:%hu ", intoa(dstaddr), dstport);
  fprintf(f, "(%s > ", get_atmaddr(srcatmdata));
  fprintf(f, "%s)\n", get_atmaddr(dstatmdata));

  return;
}

/*
 * Return string rep. of file record type
 */

char *
np_rectype_str(unsigned char type)
{
  static char buf[128];
  char *c = buf;
  char *c1;
  
  c += sprintf(c, "REC_");
  if (type >= REC_TCP_MIN && type < REC_TCP_MAX)
    c += sprintf(c, "TCP_");
  else if (type >= REC_UDP_MIN && type < REC_UDP_MAX)
    c += sprintf(c, "UDP_");
  else
    c += sprintf(c, "?_");

  switch (type & 0xFC)
    {
    case REC_TCP_ALL: c1 = "ALL"; break;
    case REC_TCP_HTTP: c1 = "HTTP"; break;
    case REC_TCP_FTP: c1 = "FTP"; break;
    default: c1 = "?"; break;
    }
  c += sprintf(c, "%s", c1);

  if (type & OPEN_BIT)
    c += sprintf(c, "OPEN");
  if (type & OPEN_BIT)
    c += sprintf(c, "HDRS");

  return buf;
}



/*
 * Print TCP hdr record 
 */

void 
print_hdr_rec(FILE *f, struct tcp_dumphdr *hdr, us_clock_t *atm)
{
  us_clock_t abstm = 0LL;
  char *col;
  assert (hdr->way == SERVER || hdr->way == CLIENT);

  if (hdr->way == SERVER)
    col = csf_w;
  else 
    col = csf_g;

  if (atm)
    abstm = *atm;
  
  cfprintf(f, col, "  %s %c %12lu + %4hu ", us_clock_ts_string(abstm + hdr->rtm), 
	  hdr->way == CLIENT ? '>' : '<',
	  (unsigned long)hdr->seq,
	  hdr->len);
  if (hdr->flags & TH_ACK)
    cfprintf(f, col, "ack %12lu ", (unsigned long)hdr->ack);

  cfprintf(f, col, "w:%4hu ", hdr->window);
  print_tcp_flags(hdr->flags, f);
  fprintf(f, "\n");

  return;
}



char *
method_string(unsigned char meth)
{
  switch (meth)
    {
    case HTTP_METHOD_GET: return "GET"; break;
    case HTTP_METHOD_HEAD: return "HEAD"; break;
    case HTTP_METHOD_POST: return "POST"; break;
    case HTTP_METHOD_OPTIONS: return "OPTIONS"; break;
    case HTTP_METHOD_PUT: return "PUT"; break;
    case HTTP_METHOD_DELETE: return "DELETE"; break;
    case HTTP_METHOD_TRACE: return "TRACE"; break;
    case HTTP_METHOD_CONNECT: return "CONNECT"; break;
    case HTTP_METHOD_MOVE: return "MOVE"; break;
    case HTTP_METHOD_BMOVE: return "BMOVE"; break;
    case HTTP_METHOD_PROPFIND: return "PROPFIND"; break;
    case HTTP_METHOD_PROPPATCH: return "PROPPATCH"; break;
    case HTTP_METHOD_UNRECOGNISED: return "*UNRECOGNISED*"; break;
    case  HTTP_METHOD_UNKNOWN:
      /* DROP THROUGH */
    default: return "unknown"; break;
    }
}

char *
status_string(short code)
{
  if (code == HTTP_SERVER_RETCODE_UNKNOWN) 
    return "unknown";

  switch (code/100)
    {
    case 1:
      switch (code % 100)
	{
	case 0: return "continue"; break;
	case 1: return "switching protocols"; break;
	default:return "unknown informational code"; break;
	}
      break;
    case 2:
      switch (code % 100)
	{
	case 0: return "OK"; break;
	case 1: return "created"; break;
	case 2: return "accepted"; break;
	case 3: return "non_authorititive info"; break;
	case 4: return "no content"; break;
	case 5: return "reset content"; break;
	case 6: return "partial content"; break;
	default: return "unknown success code"; break;
	}
      break;
    case 3:
      switch (code % 100)
	{
	case 0: return "multiple choices"; break;
	case 1: return "moved permanently"; break;
	case 2: return "moved temporarily"; break;
	case 3: return "see other"; break;
	case 4: return "not modified"; break;
	case 5: return "use proxy"; break;
	default: return "unknown redirection code"; break;
	}
      break;
    case 4:
      switch (code % 100)
	{
	case 0: return "bad request"; break;
	case 1: return "unauthorised"; break;
	case 2: return "payment required"; break;
	case 3: return "forbidden"; break;
	case 4: return "not found"; break;
	case 5: return "method not allowed"; break;
	case 6: return "not acceptable"; break;
	case 7: return "proxy authority required"; break;
	case 8: return "request timeout"; break;
	case 9: return "conflict"; break;
	case 10: return "gone"; break;
	case 11: return "length required"; break;
	case 12: return "precondition failed"; break;
	case 13: return "request entity too large"; break;
	case 14: return "request URI too long"; break;
	case 15: return "unsupported media type"; break;
	default: return "unknown client error code"; break;
	}
      break;
    case 5:
      switch (code % 100)
	{
	case 0: return "Internal server error"; break;
	case 1: return "not implemented"; break;
	case 2: return "bad gateway"; break;
	case 3: return "service unavailable"; break;
	case 4: return "gateway timeout"; break;
	case 5: return "HTTP version not supported"; break;
	default: return "unknown server error code"; break;
	}
      break;
    default:
      return "XXXXX unknown status code"; break;
    }
}

void 
print_http_versions(unsigned int vers, FILE *f)
{
  fprintf(f, "c v");
  if (vers & HTTP_VERS_1_0)
    fprintf(f, "1.0 ");
  else if (vers & HTTP_VERS_1_1)
    fprintf(f, "1.1 ");
  else if (vers & HTTP_VERS_0_9)
    fprintf(f, "0.9 ");
  else
    fprintf(f, "? ");
  fprintf(f, "s v");
  if (vers & (HTTP_VERS_1_0 * 8))
    fprintf(f, "1.0 ");
  else if (vers & (HTTP_VERS_1_1 * 8))
    fprintf(f, "1.1 ");
  else if (vers & (HTTP_VERS_0_9 * 8))
    fprintf(f, "0.9 ");
  else
    fprintf(f, "? ");

  return;
}

char * 
http_versions_string(unsigned int vers)
{
  static char str[10];
  char *b = str;

  if (vers & HTTP_VERS_1_0)
    b += sprintf(b, "1.0");
  else if (vers & HTTP_VERS_1_1)
    b += sprintf(b, "1.1");
  else if (vers & HTTP_VERS_0_9)
    b += sprintf(b, "0.9");
  else
    b += sprintf(b, "?");
  b += sprintf(b, "/");
  if (vers & (HTTP_VERS_1_0 * 8))
    b += sprintf(b, "1.0");
  else if (vers & (HTTP_VERS_1_1 * 8))
    b += sprintf(b, "1.1");
  else if (vers & (HTTP_VERS_0_9 * 8))
    b += sprintf(b, "0.9");
  else
    b += sprintf(b, "?");

  return str;
}

char *tcp_pload_string(unsigned char plt)
{
  switch (plt)
    {
    case TCP_SERV_HTTP: return "HTTP"; break;
    case TCP_SERV_FTP: return "FTP"; break;
    case TCP_SERV_FTP_DATA: return "FTP data "; break;
    case TCP_SERV_OTHER: return "Other "; break;
    case TCP_SERV_TEST: return "Test "; break;
    case TCP_SERV_TELNET: return "Telnet "; break;
    case TCP_SERV_SMTP: return "SMTP "; break;
    case TCP_SERV_POP3: return "POP3 "; break;
    case TCP_SERV_NNTP: return "NNTP "; break;
    case TCP_SERV_NETBIOS_SSN: return "Netbios ssn "; break;
    case TCP_SERV_RTSP: return "RTSP "; break;
    case TCP_SERV_PNM: return "PNM "; break;
    default: return "ERROR TCP payload type unknown"; break;
    }

  /* NOT REACHED */
  return NULL;
}

char *udp_pload_string(unsigned char plt)
{
  switch (plt)
    {
    case UDP_SERV_NFS: return "NFS"; break;
    case UDP_SERV_DNS: return "DNS"; break;
    case UDP_SERV_OTHER: return "Other"; break;
    default: return "ERROR UDP payload type unknown"; break;
    }

  /* NOT REACHED */
  return NULL;
}

/*
 * Print character sequence as a string, checking for non-printables
 * Return No. non-printing characters
 */
int 
print_seq2str(FILE *f, char *seq, unsigned char len)
{
  char *cp = seq, *end = cp + len;
  char buff[(6*len) + 3];
  char *bufp = buff;
  int nonprints = 0;

  //putchar('\"');
  *bufp++ = '\"';
  while (cp < end)
    {
      if (isprint(*cp))
	{
	  //putchar(*cp);
	  *bufp++ = *cp;
	}
      else
	{
	  //printf("[%hd]", *cp & 0xff);
	  bufp += sprintf(bufp, "[%hd]", *cp & 0xff);
	  nonprints++;
	}
      cp++;
    }
  //putchar('\"');
  *bufp++ = '\"';
  *bufp = '\0';
  fprintf(f, "%s", buff);
  
  return nonprints;
}

#ifdef WREAD

/*
 * Return string for link record type 
 */
char *
link_rec_type_string(unsigned short type)
{
  switch (type)
    {
    case LR_INLINE: return "Inline"; break;
    case LR_LINK: return "Link"; break;
    case LR_UNKNOWN: return "?"; break;
    case LR_SCRIPTED_INLINE: return "Scr. Inline"; break;
    case LR_SCRIPTED_LINK: return "Sr. Link"; break;
    case LR_SCRIPTED_UNKNOWN: return "Scr. ?"; break;
    case LR_REL_BASE: return "Base"; break;
    case LR_END_BASE: return "End base"; break;
    case LR_TS: return "Timestamp"; break;
    case LR_REL_SCRIPT_BASE: return "Code base"; break;
    case LR_END_SCRIPT_BASE: return "End code base"; break;
    case LR_SCRIPT_ARCHIVE: return "Archive"; break;
    case LR_REDIRECT_INLINE: return "Redirect auto"; break;
    case LR_REDIRECT_LINK: return "Redirect link"; break;
    case LR_REFRESH_SELF: return "Refresh self"; break;
    case LR_REFRESH_URL: return "Refresh url"; break;
    default: return "Unknown code"; break;
    }

  return "";
}


/*
 * Print out in-line image references and time stamps 
 */
#define URL_LINE_LEN 60
void 
print_links_buf(FILE *f, unsigned char *buf, int buflen, char *label)
{
  int line_len = 0;
  unsigned short ltype;
  long per;
  unsigned char *cp = buf;
  unsigned char *end = buf + buflen;
  int ts;
#if 0
  int nrefs = _http_get_nurls(buf, buflen);
  int ndistrefs = _http_get_ndist_urls(buf, buflen);

  fprintf(f, "      %s (%d/%d):-\n        \"", label, ndistrefs, nrefs);
#endif

  fprintf(f, "  %s", label);

  while (cp < end)
    {
      if (*cp == LR_HIGH)
	{
	  cp++;
	  ltype = *cp << 8;
	}
      else
	{
	  ltype = (unsigned short)*cp;
	}
      
	  
      fprintf(f, "\n%14s  ", link_rec_type_string(ltype));
      switch (ltype)
	{
	case LR_REFRESH_URL:
	case LR_REFRESH_SELF:
	  per = *((int *)(cp+1));
	  cp += sizeof(int);
	  fprintf(f, "%lds ", per);
	  break;
	default:
	  break;
	}
      
      switch (ltype)
	{
	case LR_INLINE:
	case LR_LINK:
	case LR_UNKNOWN:
	case LR_SCRIPTED_INLINE:
	case LR_SCRIPTED_LINK:
	case LR_SCRIPTED_UNKNOWN:
	case LR_REL_BASE:
	case LR_REL_SCRIPT_BASE:
	case LR_SCRIPT_ARCHIVE:
	case LR_REDIRECT_INLINE:
	case  LR_REDIRECT_LINK:
	case LR_REFRESH_URL:
	  line_len = 0;
	  while (*(++cp) != '\0')
	    {
	      if (isprint(*cp))
		putc(*cp, f);
	      else
		fprintf(f, "[%d]", *cp);
	      if (line_len++ > URL_LINE_LEN)
		{
		  fprintf(f, "\n%14s  ", "");
		  line_len = 0;
		}
	    }
	  cp++;
	  break;
	case LR_TS:
	  ts = *((int *)++cp);
	  fprintf(f, "%7d", ts/1000);
	  fprintf(f, ". %03u ms", abs(ts%1000));