/* print.c

 * Routines for printing packet analysis trees.

 *

 * Gilbert Ramirez <gram@alumni.rice.edu>

 *

 * Wireshark - Network traffic analyzer

 * By Gerald Combs <gerald@wireshark.org>

 * Copyright 1998 Gerald Combs

 *

 * SPDX-License-Identifier: GPL-2.0-or-later

 */

#include "config.h"

#include <stdio.h>

#include <string.h>

#include <epan/epan.h>

#include <epan/epan_dissect.h>

#include <epan/to_str.h>

#include <epan/expert.h>

#include <epan/column.h>

#include <epan/column-info.h>

#include <epan/color_filters.h>

#include <epan/dfilter/dfilter.h>

#include <epan/prefs.h>

#include <epan/print.h>

#include <wsutil/array.h>

#include <wsutil/json_dumper.h>

#include <wsutil/filesystem.h>

#include <wsutil/utf8_entities.h>

#include <wsutil/str_util.h>

#include <wsutil/ws_assert.h>

#include <epan/strutil.h>

#include <ftypes/ftypes.h>

#define PDML_VERSION "0"

#define PSML_VERSION "0"

typedef struct {

    int                  level;

    print_stream_t      *stream;

    bool                 success;

    GSList              *src_list;

    print_dissections_e  print_dissections;

    bool                 print_hex_for_data;

    packet_char_enc      encoding;

    GHashTable          *output_only_tables; /* output only these protocols */

} print_data;

typedef struct {

    int             level;

    FILE           *fh;

    GSList         *src_list;

    wmem_map_t     *filter;

} write_pdml_data;

typedef struct {

    GSList         *src_list;

    wmem_map_t     *filter;

    bool            print_hex;

    bool            print_text;

    proto_node_children_grouper_func node_children_grouper;

    json_dumper    *dumper;

    tvbuff_t       *cached_src_tvb;  /* last-hit data source tvb */

    struct data_source *cached_src;  /* last-hit data source */

    uint32_t        cached_src_idx;  /* last-hit data source index */

    GHashTable     *grouping_table; /* reusable hash table for key grouping */

} write_json_data;

typedef struct {

    output_fields_t *fields;

    epan_dissect_t  *edt;

} write_field_data_t;

struct _output_fields {

    bool          print_bom;

    bool          print_header;

    char          separator;

    char          occurrence;

    char          aggregator;

    GPtrArray    *fields;

    GPtrArray    *field_dfilters;

    GHashTable   *field_indicies;

    GPtrArray   **field_values;

    wmem_map_t   *protocolfilter;

    char          quote;

    bool          escape;

    bool          includes_col_fields;

    char         *split_by;       /* protocol abbreviation to split rows on */

};

static char *get_field_hex_value(GSList *src_list, field_info *fi);

static void proto_tree_print_node(proto_node *node, void *data);

static void proto_tree_write_node_pdml(proto_node *node, void *data);

static void proto_tree_write_node_ek(proto_node *node, write_json_data *data);

static struct data_source* get_field_data_source(GSList *src_list, field_info *fi, uint32_t *idx);

static struct data_source* get_field_data_source_cached(GSList *src_list, field_info *fi, uint32_t *idx, write_json_data *pdata);

static const uint8_t *get_field_data(GSList *src_list, field_info *fi);

static const uint8_t *get_field_data_cached(GSList *src_list, field_info *fi, write_json_data *pdata);

static void pdml_write_field_hex_value(write_pdml_data *pdata, field_info *fi);

static void json_write_field_hex_value(write_json_data *pdata, field_info *fi);

static bool print_hex_data_buffer(print_stream_t *stream, const unsigned char *cp,

                                      unsigned length, packet_char_enc encoding,

                                      unsigned hexdump_options);

static void write_specified_fields(fields_format format,

                                   output_fields_t *fields,

                                   epan_dissect_t *edt, column_info *cinfo,

                                   FILE *fh,

                                   json_dumper *dumper);

static void print_escaped_xml(FILE *fh, const char *unescaped_string);

static void print_escaped_csv(FILE *fh, const char *unescaped_string, char delimiter, char quote_char, bool escape_wsp);

typedef void (*proto_node_value_writer)(proto_node *, write_json_data *);

static void write_json_index(json_dumper *dumper, epan_dissect_t *edt);

static void write_json_proto_node_list(GSList *proto_node_list_head, write_json_data *data);

static void write_json_proto_node(GSList *node_values_head,

                                  const char *suffix,

                                  proto_node_value_writer value_writer,

                                  write_json_data *data);

static void write_json_proto_node_value_list(GSList *node_values_head,

                                             proto_node_value_writer value_writer,

                                             write_json_data *data);

static void write_json_proto_node_filtered(proto_node *node, write_json_data *data);

static void write_json_proto_node_hex_dump(proto_node *node, write_json_data *data);

static void write_json_proto_node_dynamic(proto_node *node, write_json_data *data);

static void write_json_proto_node_children(proto_node *node, write_json_data *data);

static void write_json_proto_node_value(proto_node *node, write_json_data *data);

static void write_json_proto_node_no_value(proto_node *node, write_json_data *data);

static const char *proto_node_to_json_key(proto_node *node);

static void print_pdml_geninfo(epan_dissect_t *edt, FILE *fh);

static void write_ek_summary(column_info *cinfo, write_json_data *pdata);

static void proto_tree_get_node_field_values(proto_node *node, void *data);

/* Cache the protocols and field handles that the print functionality needs

   This helps break explicit dependency on the dissectors. */

static int proto_data;

static int proto_frame;

void print_cache_field_handles(void)

{

    proto_data = proto_get_id_by_short_name("Data");

    proto_frame = proto_get_id_by_short_name("Frame");

}

bool

proto_tree_print(print_dissections_e print_dissections, bool print_hex,

                 epan_dissect_t *edt, GHashTable *output_only_tables,

                 print_stream_t *stream)

{

    print_data data;

    /* Create the output */

    data.level              = 0;

    data.stream             = stream;

    data.success            = true;

    data.src_list           = edt->pi.data_src;

    data.encoding           = (packet_char_enc)edt->pi.fd->encoding;

    data.print_dissections  = print_dissections;

    /* If we're printing the entire packet in hex, don't

       print uninterpreted data fields in hex as well. */

    data.print_hex_for_data = !print_hex;

    data.output_only_tables = output_only_tables;

    proto_tree_children_foreach(edt->tree, proto_tree_print_node, &data);

    return data.success;

}

/* Print a tree's data, and any child nodes. */

static void

proto_tree_print_node(proto_node *node, void *data)

{

    field_info   *fi    = PNODE_FINFO(node);

    print_data   *pdata = (print_data*) data;

    const uint8_t *pd;

    char          label_str[ITEM_LABEL_LENGTH];

    char         *label_ptr;

    /* dissection with an invisible proto tree? */

    ws_assert(fi);

    /* Don't print invisible entries. */

    if (proto_item_is_hidden(node) && (prefs.display_hidden_proto_items == false))

        return;

    /* Give up if we've already gotten an error. */

    if (!pdata->success)

        return;

    /* was a free format label produced? */

    if (fi->rep) {

        label_ptr = fi->rep->representation;

    }

    else { /* no, make a generic label */

        label_ptr = label_str;

        proto_item_fill_label(fi, label_str, NULL);

    }

    if (proto_item_is_generated(node))

        label_ptr = g_strconcat("[", label_ptr, "]", NULL);

    pdata->success = print_line(pdata->stream, pdata->level, label_ptr);

    if (proto_item_is_generated(node))

        g_free(label_ptr);

    if (!pdata->success)

        return;

    /*

     * If -O is specified, only display the protocols which are in the

     * lookup table.  Only check on the first level: once we start printing

     * a tree, print the rest of the subtree.  Otherwise we won't print

     * subitems whose abbreviation doesn't match the protocol--for example

     * text items (whose abbreviation is simply "text").

     */

    if ((pdata->output_only_tables != NULL) && (pdata->level == 0)

        && (g_hash_table_lookup(pdata->output_only_tables, fi->hfinfo->abbrev) == NULL)) {

        return;

    }

    /* If it's uninterpreted data, dump it (unless our caller will

       be printing the entire packet in hex). */

    if ((fi->hfinfo->id == proto_data) && (pdata->print_hex_for_data)) {

        /*

         * Find the data for this field.

         */

        pd = get_field_data(pdata->src_list, fi);

        if (pd) {

            if (!print_line(pdata->stream, 0, "")) {

                pdata->success = false;

                return;

            }

            if (!print_hex_data_buffer(pdata->stream, pd,

                                       fi->length, pdata->encoding, HEXDUMP_ASCII_INCLUDE)) {

                pdata->success = false;

                return;

            }

        }

    }

    /* If we're printing all levels, or if this node is one with a

       subtree and its subtree is expanded, recurse into the subtree,

       if it exists. */

    ws_assert((fi->tree_type >= -1) && (fi->tree_type < num_tree_types));

    if ((pdata->print_dissections == print_dissections_expanded) ||

        ((pdata->print_dissections == print_dissections_as_displayed) &&

         (fi->tree_type >= 0) && tree_expanded(fi->tree_type))) {

        if (node->first_child != NULL) {

            pdata->level++;

            proto_tree_children_foreach(node,

                                        proto_tree_print_node, pdata);

            pdata->level--;

            if (!pdata->success)

                return;

        }

    }

}

#define PDML2HTML_XSL "pdml2html.xsl"

#define PDML2HTML_URL "https://gitlab.com/wireshark/wireshark/-/tree/master/resources/share/doc/wireshark/"

void

write_pdml_preamble(FILE *fh, const char *filename, const char* doc_dir)

{

    time_t t = time(NULL);

    struct tm * timeinfo;

    char *fmt_ts;

    const char *ts;

    /* Create the output */

    timeinfo = localtime(&t);

    if (timeinfo != NULL) {

        fmt_ts = asctime(timeinfo);

        fmt_ts[strlen(fmt_ts)-1] = 0; /* overwrite \n */

        ts = fmt_ts;

    } else

        ts = "Not representable";

    fprintf(fh, "<?xml version=\"1.0\" encoding=\"utf-8\"?>\n");

    fprintf(fh, "<?xml-stylesheet type=\"text/xsl\" href=\"" PDML2HTML_XSL "\"?>\n");

    fprintf(fh, "<!-- You can find " PDML2HTML_XSL " in %s or at "PDML2HTML_URL PDML2HTML_XSL ". -->\n", doc_dir);

    fprintf(fh, "<pdml version=\"" PDML_VERSION "\" creator=\"%s/%s\" time=\"%s\" capture_file=\"", PACKAGE, VERSION, ts);

    if (filename) {

        /* \todo filename should be converted to UTF-8. */

        print_escaped_xml(fh, filename);

    }

    fprintf(fh, "\">\n");

}

/* Check if the str matches the protocolfilter.

 *

 * @param[in]  protocolfilter a map of field abbreviations that pass the filter

 * to the flags for that field, or NULL if no filter (so all fields pass)

 * @param[in]  str the field abbreviation to lookup in the map.

 * @param[out] flags if not NULL, gets set to the value in the map for

 * the given key if found (undefined if return is false.)

 * @return     true if the filter passes the string, false if the filter

 * filters out the string.

 */

static bool check_protocolfilter(wmem_map_t *protocolfilter, const char *str, pf_flags *flags)

{

    bool res = false;

    void *value;

    if (protocolfilter == NULL) {

        if (flags) {

            *flags = PF_NONE;

        }

        return true;

    }

    if (str == NULL) {

        return false;

    }

    res = wmem_map_lookup_extended(protocolfilter, str, NULL, &value);

    if (res && flags) {

        *flags = GPOINTER_TO_UINT(value);

    }

    return res;

}

void

write_pdml_proto_tree(output_fields_t* fields, epan_dissect_t *edt, column_info *cinfo, FILE *fh, bool use_color)

{

    write_pdml_data data;

    const color_filter_t *cfp;

    ws_assert(edt);

    ws_assert(fh);

    cfp = edt->pi.fd->color_filter;

    /* Create the output */

    if (use_color && (cfp != NULL)) {

        fprintf(fh, "<packet foreground='#%06x' background='#%06x'>\n",

            color_t_to_rgb(&cfp->fg_color),

            color_t_to_rgb(&cfp->bg_color));

    } else {

        fprintf(fh, "<packet>\n");

    }

    /* Print a "geninfo" protocol as required by PDML */

    print_pdml_geninfo(edt, fh);

    if (fields == NULL || fields->fields == NULL) {

        /* Write out all fields */

        data.level    = 0;

        data.fh       = fh;

        data.src_list = edt->pi.data_src;

        data.filter   = fields ? fields->protocolfilter : NULL;

        proto_tree_children_foreach(edt->tree, proto_tree_write_node_pdml,

                                    &data);

    } else {

        /* Write out specified fields */

        write_specified_fields(FORMAT_XML, fields, edt, cinfo, fh, NULL);

    }

    fprintf(fh, "</packet>\n\n");

}

void

write_ek_proto_tree(output_fields_t* fields,

                    bool print_summary, bool print_hex,

                    epan_dissect_t *edt,

                    column_info *cinfo,

                    FILE *fh)

{

    ws_assert(edt);

    ws_assert(fh);

    write_json_data data;

    json_dumper dumper = {

        .output_file = fh,

        .flags = JSON_DUMPER_DOT_TO_UNDERSCORE

    };

    data.dumper = &dumper;

    json_dumper_begin_object(&dumper);

    json_dumper_set_member_name_const(&dumper, "index");

    json_dumper_begin_object(&dumper);

    write_json_index(&dumper, edt);

    json_dumper_end_object(&dumper);

    json_dumper_end_object(&dumper);

    json_dumper_finish(&dumper);

    json_dumper_begin_object(&dumper);

    /* Timestamp added for time indexing in Elasticsearch */

    json_dumper_set_member_name_const(&dumper, "timestamp");

    json_dumper_value_anyf(&dumper, "\"%" PRIu64 "%03d\"", (uint64_t)edt->pi.abs_ts.secs, edt->pi.abs_ts.nsecs/1000000);

    if (print_summary)

        write_ek_summary(edt->pi.cinfo, &data);

    if (edt->tree) {

        json_dumper_set_member_name_const(&dumper, "layers");

        json_dumper_begin_object(&dumper);

        if (fields == NULL || fields->fields == NULL) {

            /* Write out all fields */

            data.src_list = edt->pi.data_src;

            data.filter = fields ? fields->protocolfilter : NULL;

            data.print_hex = print_hex;

            data.cached_src_tvb = edt->pi.data_src ?

                get_data_source_tvb((struct data_source *)edt->pi.data_src->data) : NULL;

            data.cached_src = edt->pi.data_src ?

                (struct data_source *)edt->pi.data_src->data : NULL;

            data.cached_src_idx = 0;

            proto_tree_write_node_ek(edt->tree, &data);

        } else {

            /* Write out specified fields */

            write_specified_fields(FORMAT_EK, fields, edt, cinfo, NULL, data.dumper);

        }

        json_dumper_end_object(&dumper);

    }

    json_dumper_end_object(&dumper);

    json_dumper_finish(&dumper);

}

void

write_fields_proto_tree(output_fields_t* fields, epan_dissect_t *edt, column_info *cinfo, FILE *fh)

{

    ws_assert(edt);

    ws_assert(fh);

    /* Create the output */

    write_specified_fields(FORMAT_CSV, fields, edt, cinfo, fh, NULL);

}

/* Indent to the correct level */

static void print_indent(int level, FILE *fh)

{

    /* Use a buffer pre-filled with spaces */

#define MAX_INDENT 2048

    static char spaces[MAX_INDENT];

    static bool inited = false;

    if (!inited) {

        for (int n=0; n < MAX_INDENT; n++) {

            spaces[n] = ' ';

        }

        inited = true;

    }

    if (fh == NULL) {

        return;

    }

    /* Temp terminate at right length and write to fh. */

    spaces[MIN(level*2, MAX_INDENT-1)] ='\0';

    fputs(spaces, fh);

    spaces[MIN(level*2, MAX_INDENT-1)] =' ';

}

/* Write out a tree's data, and any child nodes, as PDML */

static void

proto_tree_write_node_pdml(proto_node *node, void *data)

{

    field_info      *fi    = PNODE_FINFO(node);

    write_pdml_data *pdata = (write_pdml_data*) data;

    const char      *label_ptr;

    char             label_str[ITEM_LABEL_LENGTH];

    char            *dfilter_string;

    bool             wrap_in_fake_protocol;

    /* dissection with an invisible proto tree? */

    ws_assert(fi);

    /* Will wrap up top-level field items inside a fake protocol wrapper to

       preserve the PDML schema */

    wrap_in_fake_protocol =

        (((fi->hfinfo->type != FT_PROTOCOL) ||

          (fi->hfinfo->id == proto_data)) &&

         (pdata->level == 0));

    print_indent(pdata->level + 1, pdata->fh);

    if (wrap_in_fake_protocol) {

        /* Open fake protocol wrapper */

        fputs("<proto name=\"fake-field-wrapper\">\n", pdata->fh);

        pdata->level++;

        print_indent(pdata->level + 1, pdata->fh);

    }

    /* Text label. It's printed as a field with no name. */

    if (fi->hfinfo->id == hf_text_only) {

        /* Get the text */

        if (fi->rep) {

            label_ptr = fi->rep->representation;

        } else {

            label_ptr = "";

        }

        /* Show empty name since it is a required field */

        fputs("<field name=\"", pdata->fh);

        fputs("\" show=\"", pdata->fh);

        print_escaped_xml(pdata->fh, label_ptr);

        fprintf(pdata->fh, "\" size=\"%d", fi->length);

        if (node->parent && node->parent->finfo && (fi->start < node->parent->finfo->start)) {

            fprintf(pdata->fh, "\" pos=\"%d", node->parent->finfo->start + fi->start);

        } else {

            fprintf(pdata->fh, "\" pos=\"%d", fi->start);

        }

        if (fi->length > 0) {

            fputs("\" value=\"", pdata->fh);

            pdml_write_field_hex_value(pdata, fi);

        }

        if (node->first_child != NULL) {

            fputs("\">\n", pdata->fh);

        } else {

            fputs("\"/>\n", pdata->fh);

        }

    }

    /* Uninterpreted data, i.e., the "Data" protocol, is

     * printed as a field instead of a protocol. */

    else if (fi->hfinfo->id == proto_data) {

        /* Write out field with data */

        fputs("<field name=\"data\" value=\"", pdata->fh);

        pdml_write_field_hex_value(pdata, fi);

        fputs("\">\n", pdata->fh);

    } else {

        /* Normal protocols and fields */

        if ((fi->hfinfo->type == FT_PROTOCOL) && (fi->hfinfo->id != proto_expert)) {

            fputs("<proto name=\"", pdata->fh);

        } else {

            fputs("<field name=\"", pdata->fh);

        }

        print_escaped_xml(pdata->fh, fi->hfinfo->abbrev);

#if 0

        /* PDML spec, see:

         * https://wayback.archive.org/web/20150330045501/http://www.nbee.org/doku.php?id=netpdl:pdml_specification

         *

         * the show fields contains things in 'human readable' format

         * showname: contains only the name of the field

         * show: contains only the data of the field

         * showdtl: contains additional details of the field data

         * showmap: contains mappings of the field data (e.g. the hostname to an IP address)

         *

         * XXX - the showname shouldn't contain the field data itself

         * (like it's contained in the fi->rep->representation).

         * Unfortunately, we don't have the field data representation for

         * all fields, so this isn't currently possible */

        fputs("\" showname=\"", pdata->fh);

        print_escaped_xml(pdata->fh, fi->hfinfo->name);

#endif

        if (fi->rep) {

            fputs("\" showname=\"", pdata->fh);

            print_escaped_xml(pdata->fh, fi->rep->representation);

        } else {

            label_ptr = label_str;

            proto_item_fill_label(fi, label_str, NULL);

            fputs("\" showname=\"", pdata->fh);

            print_escaped_xml(pdata->fh, label_ptr);

        }

        if (proto_item_is_hidden(node) && (prefs.display_hidden_proto_items == false))

            fprintf(pdata->fh, "\" hide=\"yes");

        fprintf(pdata->fh, "\" size=\"%d", fi->length);

        if (node->parent && node->parent->finfo && (fi->start < node->parent->finfo->start)) {

            fprintf(pdata->fh, "\" pos=\"%d", node->parent->finfo->start + fi->start);

        } else {

            fprintf(pdata->fh, "\" pos=\"%d", fi->start);

        }

/*      fprintf(pdata->fh, "\" id=\"%d", fi->hfinfo->id);*/

        /* show, value, and unmaskedvalue attributes */

        switch (fi->hfinfo->type)

        {

        case FT_PROTOCOL:

            break;

        case FT_NONE:

            fputs("\" show=\"\" value=\"",  pdata->fh);

            break;

        default:

            dfilter_string = fvalue_to_string_repr(NULL, fi->value, FTREPR_DISPLAY, fi->hfinfo->display);

            /* XXX - doc/README.xml-output describes the show attribute as:

             * show - the representation of the packet data ('value') as it

             *        would appear in a display filter.

             *

             * which (along with the name of the variable) would argue for using

             * FTREPR_DFILTER. However, FTREPR_DFILTER adds quotes to some but

             * not all field types, so it could not be used. The treatment of

             * FT_ABSOLUTE_VALUE is particularly different between DISPLAY and

             * DFILTER, though.

             */

            if (dfilter_string != NULL) {

                fputs("\" show=\"", pdata->fh);

                print_escaped_xml(pdata->fh, dfilter_string);

            }

            wmem_free(NULL, dfilter_string);

            /*

             * XXX - should we omit "value" for any fields?

             * What should we do for fields whose length is 0?

             * They might come from a pseudo-header or from

             * the capture header (e.g., time stamps), or

             * they might be generated fields.

             */

            if (fi->length > 0) {

                fputs("\" value=\"", pdata->fh);

                if (fi->hfinfo->bitmask!=0) {

                    switch (fvalue_type_ftenum(fi->value)) {

                        case FT_INT8:

                        case FT_INT16:

                        case FT_INT24:

                        case FT_INT32:

                            fprintf(pdata->fh, "%X", (unsigned) fvalue_get_sinteger(fi->value));

                            break;

                        case FT_CHAR:

                        case FT_UINT8:

                        case FT_UINT16:

                        case FT_UINT24:

                        case FT_UINT32:

                            fprintf(pdata->fh, "%X", fvalue_get_uinteger(fi->value));

                            break;

                        case FT_INT40:

                        case FT_INT48:

                        case FT_INT56:

                        case FT_INT64:

                            fprintf(pdata->fh, "%" PRIX64, fvalue_get_sinteger64(fi->value));

                            break;

                        case FT_UINT40:

                        case FT_UINT48:

                        case FT_UINT56:

                        case FT_UINT64:

                        case FT_BOOLEAN:

                            fprintf(pdata->fh, "%" PRIX64, fvalue_get_uinteger64(fi->value));

                            break;

                        default:

                            ws_assert_not_reached();

                    }

                    fputs("\" unmaskedvalue=\"", pdata->fh);

                    pdml_write_field_hex_value(pdata, fi);

                } else {

                    pdml_write_field_hex_value(pdata, fi);

                }

            }

        }

        if (node->first_child != NULL) {

            fputs("\">\n", pdata->fh);

        } else if (fi->hfinfo->id == proto_data) {

            fputs("\">\n", pdata->fh);

        } else {

            fputs("\"/>\n", pdata->fh);

        }

    }

    /* We print some levels for PDML. Recurse here. */

    if (node->first_child != NULL) {

        pf_flags filter_flags = PF_NONE;

        if (pdata->filter == NULL || check_protocolfilter(pdata->filter, fi->hfinfo->abbrev, &filter_flags)) {

            wmem_map_t *_filter = NULL;

            /* Remove protocol filter for children, if children should be included */

            if ((filter_flags&PF_INCLUDE_CHILDREN) == PF_INCLUDE_CHILDREN) {

                _filter = pdata->filter;

                pdata->filter = NULL;

            }

            pdata->level++;

            proto_tree_children_foreach(node,

                                        proto_tree_write_node_pdml, pdata);

            pdata->level--;

            /* Put protocol filter back */

            if ((filter_flags&PF_INCLUDE_CHILDREN) == PF_INCLUDE_CHILDREN) {

                pdata->filter = _filter;

            }

        } else {

            print_indent(pdata->level + 2, pdata->fh);

            /* print dummy field */

            fputs("<field name=\"filtered\" value=\"", pdata->fh);

            print_escaped_xml(pdata->fh, fi->hfinfo->abbrev);

            fputs("\" />\n", pdata->fh);

        }

    }

    /* Take back the extra level we added for fake wrapper protocol */

    if (wrap_in_fake_protocol) {

        pdata->level--;

    }

    if (node->first_child != NULL) {

        print_indent(pdata->level + 1, pdata->fh);

        /* Close off current element */

        /* Data and expert "protocols" use simple tags */

        if ((fi->hfinfo->id != proto_data) && (fi->hfinfo->id != proto_expert)) {

            if (fi->hfinfo->type == FT_PROTOCOL) {

                fputs("</proto>\n", pdata->fh);

            } else {

                fputs("</field>\n", pdata->fh);

            }

        } else {

            fputs("</field>\n", pdata->fh);

        }

    }

    /* Close off fake wrapper protocol */

    if (wrap_in_fake_protocol) {

        print_indent(pdata->level + 1, pdata->fh);

        fputs("</proto>\n", pdata->fh);

    }

}

json_dumper

write_json_preamble(FILE *fh, bool compact)

{

    json_dumper dumper = {

        .output_file = fh,

        .flags = compact ? 0 : JSON_DUMPER_FLAGS_PRETTY_PRINT

    };

    json_dumper_begin_array(&dumper);

    return dumper;

}

void

write_json_finale(json_dumper *dumper)

{

    json_dumper_end_array(dumper);

    json_dumper_finish(dumper);

}

static void

write_json_index(json_dumper *dumper, epan_dissect_t *edt)

{

    char ts[30];

    struct tm * timeinfo;

    char* str;

    timeinfo = localtime(&edt->pi.abs_ts.secs);

    if (timeinfo != NULL) {

        strftime(ts, sizeof(ts), "%Y-%m-%d", timeinfo);

    } else {

        (void) g_strlcpy(ts, "XXXX-XX-XX", sizeof(ts)); /* XXX - better way of saying "Not representable"? */

    }

    json_dumper_set_member_name_const(dumper, "_index");

    str = ws_strdup_printf("packets-%s", ts);

    json_dumper_value_string_noesc(dumper, str, strlen(str));

    g_free(str);

}

void

write_json_proto_tree(output_fields_t* fields,

                      print_dissections_e print_dissections,

                      bool print_hex,

                      epan_dissect_t *edt, column_info *cinfo,

                      proto_node_children_grouper_func node_children_grouper,

                      json_dumper *dumper)

{

    write_json_data data;

    data.dumper = dumper;

    json_dumper_begin_object(dumper);

    write_json_index(dumper, edt);

    json_dumper_set_member_name_const(dumper, "_score");

    json_dumper_value_string(dumper, NULL);

    json_dumper_set_member_name_const(dumper, "_source");

    json_dumper_begin_object(dumper);

    json_dumper_set_member_name_const(dumper, "layers");

    if (fields == NULL || fields->fields == NULL) {

        /* Write out all fields */

        data.src_list = edt->pi.data_src;

        data.filter = fields ? fields->protocolfilter : NULL;

        data.print_hex = print_hex;

        data.print_text = true;

        if (print_dissections == print_dissections_none) {

            data.print_text = false;

        }

        data.node_children_grouper = node_children_grouper;

        data.cached_src_tvb = edt->pi.data_src ?

            get_data_source_tvb((struct data_source *)edt->pi.data_src->data) : NULL;

        data.cached_src = edt->pi.data_src ?

            (struct data_source *)edt->pi.data_src->data : NULL;

        data.cached_src_idx = 0;

        data.grouping_table = g_hash_table_new(g_direct_hash, g_direct_equal);

        write_json_proto_node_children(edt->tree, &data);

        g_hash_table_destroy(data.grouping_table);

    } else {

        write_specified_fields(FORMAT_JSON, fields, edt, cinfo, NULL, dumper);

    }

    json_dumper_end_object(dumper);

    json_dumper_end_object(dumper);

}

/**

 * Returns a boolean telling us whether that node list contains any node which has children

 */

static bool

any_has_children(GSList *node_values_list)

{

    GSList *current_node = node_values_list;

    while (current_node != NULL) {

        proto_node *current_value = (proto_node *) current_node->data;

        if (current_value->first_child != NULL) {

            return true;

        }

        current_node = current_node->next;

    }

    return false;

}

/**

 * Write a json object containing a list of key:value pairs where each key:value pair corresponds to a different json

 * key and its associated nodes in the proto_tree.

 * @param proto_node_list_head A 2-dimensional list containing a list of values for each different node json key. The

 * elements themselves are a linked list of values associated with the same json key.

 * @param pdata json writing metadata

 */

static void

write_json_proto_node_list(GSList *proto_node_list_head, write_json_data *pdata)

{

    GSList *current_node = proto_node_list_head;

    json_dumper_begin_object(pdata->dumper);

    // Loop over each list of nodes (differentiated by json key) and write the associated json key:value pair in the

    // output.

    while (current_node != NULL) {

        // Get the list of values for the current json key.

        GSList *node_values_list = (GSList *) current_node->data;

        // Retrieve the json key from the first value.

        proto_node *first_value = (proto_node *) node_values_list->data;

        const char *json_key = proto_node_to_json_key(first_value);

        // Check if the current json key is filtered from the output with the "-j" cli option.

        pf_flags filter_flags = PF_NONE;

        bool is_filtered = pdata->filter != NULL && !check_protocolfilter(pdata->filter, json_key, &filter_flags);

        field_info *fi = first_value->finfo;

        char *value_string_repr = fvalue_to_string_repr(NULL, fi->value, FTREPR_JSON, fi->hfinfo->display);

        bool has_children = any_has_children(node_values_list);

        // We assume all values of a json key have roughly the same layout. Thus we can use the first value to derive

        // attributes of all the values.

        bool has_value = value_string_repr != NULL;

        bool is_pseudo_text_field = fi->hfinfo->id == hf_text_only;

        wmem_free(NULL, value_string_repr); // fvalue_to_string_repr returns allocated buffer

        // "-x" command line option. A "_raw" suffix is added to the json key so the textual value can be printed

        // with the original json key. If both hex and text writing are enabled the raw information of fields whose

        // length is equal to 0 is not written to the output. If the field is a special text pseudo field no raw

        // information is written either.

        if (pdata->print_hex && (!pdata->print_text || fi->length > 0) && !is_pseudo_text_field) {

            write_json_proto_node(node_values_list, "_raw", write_json_proto_node_hex_dump, pdata);

        }

        if (pdata->print_text && has_value) {

            write_json_proto_node(node_values_list, "", write_json_proto_node_value, pdata);

        }

        if (has_children) {

            // If a node has both a value and a set of children we print the value and the children in separate

            // key:value pairs. These can't have the same key so whenever a value is already printed with the node

            // json key we print the children with the same key with a "_tree" suffix added.

            char *suffix = has_value ? "_tree": "";

            if (is_filtered) {

                write_json_proto_node(node_values_list, suffix, write_json_proto_node_filtered, pdata);

            } else {

                // Remove protocol filter for children, if children should be included. This functionality is enabled

                // with the "-J" command line option. We save the filter so it can be reenabled when we are done with

                // the current key:value pair.

                wmem_map_t *_filter = NULL;

                if ((filter_flags&PF_INCLUDE_CHILDREN) == PF_INCLUDE_CHILDREN) {

                    _filter = pdata->filter;

                    pdata->filter = NULL;

                }

                // has_children is true if any of the nodes have children. So we're not 100% sure whether this

                // particular node has children or not => use the 'dynamic' version of 'write_json_proto_node'

                write_json_proto_node(node_values_list, suffix, write_json_proto_node_dynamic, pdata);

                // Put protocol filter back

                if ((filter_flags&PF_INCLUDE_CHILDREN) == PF_INCLUDE_CHILDREN) {

                    pdata->filter = _filter;

                }

            }

        }

        if (!has_value && !has_children && (pdata->print_text || (pdata->print_hex && is_pseudo_text_field))) {

            write_json_proto_node(node_values_list, "", write_json_proto_node_no_value, pdata);

        }

        current_node = current_node->next;

    }