summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJelmer Vernooij <jelmer@samba.org>2003-08-15 05:31:46 +0000
committerJelmer Vernooij <jelmer@samba.org>2003-08-15 05:31:46 +0000
commit22535011e271412bd01fdc081f6ab7e8fcbadb0e (patch)
treee371c789c7a19be0b96e8586028594da940adb6c
parentaa39cc37dab9c4f8c3295d872bb8cc143890b378 (diff)
downloadsamba-22535011e271412bd01fdc081f6ab7e8fcbadb0e.tar.gz
samba-22535011e271412bd01fdc081f6ab7e8fcbadb0e.tar.bz2
samba-22535011e271412bd01fdc081f6ab7e8fcbadb0e.zip
Add ability to output native pcap files without the requirement for text2pcap.
IP and TCP checksums are not calculated, but that should not matter. (This used to be commit aa96f780015c031e0c5a0e8773f192502c10c919)
-rw-r--r--source3/Makefile.in2
-rw-r--r--source3/utils/log2pcaphex.c146
2 files changed, 132 insertions, 16 deletions
diff --git a/source3/Makefile.in b/source3/Makefile.in
index 4e3daa50a2..b49249a1ed 100644
--- a/source3/Makefile.in
+++ b/source3/Makefile.in
@@ -870,7 +870,7 @@ bin/smbiconv@EXEEXT@: $(SMBICONV_OBJ) @BUILD_POPT@ bin/.dummy
@echo Linking $@
@$(CC) $(FLAGS) -o $@ $(SMBICONV_OBJ) $(LDFLAGS) $(TERMLDFLAGS) $(TERMLIBS) $(DYNEXP) $(LIBS) @POPTLIBS@
-bin/log2pcaphex@EXEEXT@: $(LOG2PCAP_OBJ) @BUILD_POPT@ bin/.dummy
+bin/log2pcap@EXEEXT@: $(LOG2PCAP_OBJ) @BUILD_POPT@ bin/.dummy
@echo Linking $@
@$(CC) $(FLAGS) -o $@ $(LOG2PCAP_OBJ) $(LDFLAGS) @POPTLIBS@ $(LIBS)
diff --git a/source3/utils/log2pcaphex.c b/source3/utils/log2pcaphex.c
index d284fa5c54..4e44161ebe 100644
--- a/source3/utils/log2pcaphex.c
+++ b/source3/utils/log2pcaphex.c
@@ -5,7 +5,13 @@
Copyright (C) Jelmer Vernooij 2003
Thanks to Tim Potter for the genial idea
- Example use: log2pcaphex < samba-log-file | text2pcap -T 139,139 - foo.pcap
+ Portions (from capconvert.c) (C) Andrew Tridgell 1997
+ Portions (from text2pcap.c) (C) Ashok Narayanan 2001
+
+ Example use with -h parameter:
+ log2pcaphex < samba-log-file | text2pcap -T 139,139 - foo.pcap
+
+ TODO: Have correct IP and TCP checksums.
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
@@ -26,21 +32,124 @@
#include <assert.h>
int quiet = 0;
+int hexformat = 0;
#define itoa(a) ((a) < 0xa?'0'+(a):'A' + (a-0xa))
-void print_packet(FILE *out, unsigned char *data, long length)
+#include <stdlib.h>
+#include <unistd.h>
+#include <memory.h>
+#include <sys/time.h>
+#include <stdio.h>
+#include <fcntl.h>
+
+#define TCPDUMP_MAGIC 0xa1b2c3d4
+
+/* tcpdump file format */
+struct tcpdump_file_header {
+ uint32 magic;
+ uint16 major;
+ uint16 minor;
+ int32 zone;
+ uint32 sigfigs;
+ uint32 snaplen;
+ uint32 linktype;
+};
+
+struct tcpdump_packet {
+ struct timeval ts;
+ uint32 caplen;
+ uint32 len;
+};
+
+typedef struct {
+ uint8 ver_hdrlen;
+ uint8 dscp;
+ uint16 packet_length;
+ uint16 identification;
+ uint8 flags;
+ uint8 fragment;
+ uint8 ttl;
+ uint8 protocol;
+ uint16 hdr_checksum;
+ uint32 src_addr;
+ uint32 dest_addr;
+} hdr_ip_t;
+
+static hdr_ip_t HDR_IP = {0x45, 0, 0, 0x3412, 0, 0, 0xff, 6, 0, 0x01010101, 0x02020202};
+
+typedef struct {
+ uint16 source_port;
+ uint16 dest_port;
+ uint32 seq_num;
+ uint32 ack_num;
+ uint8 hdr_length;
+ uint8 flags;
+ uint16 window;
+ uint16 checksum;
+ uint16 urg;
+} hdr_tcp_t;
+
+static hdr_tcp_t HDR_TCP = {139, 139, 0, 0, 0x50, 0, 0, 0, 0};
+
+void print_pcap_header(FILE *out)
{
-long i,cur = 0;int tmp;
-while(cur < length) {
- fprintf(out, "%06X ", cur);
- for(i = cur; i < length && i < cur + 16; i++) {
- fprintf(out, "%02x ", data[i]);
- }
+ struct tcpdump_file_header h;
+ h.magic = TCPDUMP_MAGIC;
+ h.major = 2;
+ h.minor = 4;
+ h.zone = 0;
+ h.sigfigs = 0;
+ h.snaplen = 102400; /* As long packets as possible */
+ h.linktype = 101; /* Raw IP */
+ fwrite(&h, sizeof(struct tcpdump_file_header), 1, out);
+}
+
+void print_pcap_packet(FILE *out, unsigned char *data, long length, long caplen)
+{
+ static int i = 0;
+ struct tcpdump_packet p;
+ i++;
+ p.ts.tv_usec = 0;
+ p.ts.tv_sec = 0;
+ p.caplen = caplen;
+ p.len = length;
+ fwrite(&p, sizeof(struct tcpdump_packet), 1, out);
+ fwrite(data, sizeof(unsigned char), caplen, out);
+}
+
+void print_hex_packet(FILE *out, unsigned char *data, long length)
+{
+ long i,cur = 0;int tmp;
+ while(cur < length) {
+ fprintf(out, "%06X ", cur);
+ for(i = cur; i < length && i < cur + 16; i++) {
+ fprintf(out, "%02x ", data[i]);
+ }
- cur = i;
- fprintf(out, "\n");
+ cur = i;
+ fprintf(out, "\n");
+ }
}
+
+void print_netbios_packet(FILE *out, unsigned char *data, long length, long actual_length)
+{
+ unsigned char *newdata; long offset = 0;
+ long newlen;
+
+ newlen = length+sizeof(HDR_IP)+sizeof(HDR_TCP);
+ newdata = malloc(newlen);
+
+ HDR_IP.packet_length = htons(newlen);
+ HDR_TCP.window = htons(0x2000);
+ HDR_TCP.source_port = HDR_TCP.dest_port = htons(139);
+
+ memcpy(newdata+offset, &HDR_IP, sizeof(HDR_IP));offset+=sizeof(HDR_IP);
+ memcpy(newdata+offset, &HDR_TCP, sizeof(HDR_TCP));offset+=sizeof(HDR_TCP);
+ memcpy(newdata+offset,data,length);
+
+ print_pcap_packet(out, newdata, newlen, actual_length+offset);
+ free(newdata);
}
unsigned char *curpacket = NULL;
@@ -84,7 +193,7 @@ void read_log_msg(FILE *in, unsigned char **_buffer, long *buffersize, long *dat
*_buffer = buffer;
}
-void read_log_data(FILE *in, unsigned char *buffer, long data_length)
+long read_log_data(FILE *in, unsigned char *buffer, long data_length)
{
long i, addr; char real[2][16]; int ret;
unsigned char tmp;
@@ -96,16 +205,17 @@ void read_log_data(FILE *in, unsigned char *buffer, long data_length)
ret = fscanf(in, " [%03X]", &addr);
if(!ret) {
if(!quiet)fprintf(stderr, "Only first %d bytes are logged, packet trace will be incomplete\nTry a higher log level\n", i);
- return;
+ return i-1;
}
assert(addr == i);
}
if(!fscanf(in, "%02X", &tmp)) {
if(!quiet)fprintf(stderr, "Only first %d bytes are logged, packet trace will be incomplete\nTry a higher log level\n", i-1);
- return;
+ return i-1;
}
buffer[i] = tmp;
}
+ return data_length;
}
int main (int argc, char **argv)
@@ -117,10 +227,13 @@ int main (int argc, char **argv)
poptContext pc;
char buffer[4096];
long data_offset, data_length;
+ long data_bytes_read;
int in_packet = 0;
+ int i;
struct poptOption long_options[] = {
POPT_AUTOHELP
{ "quiet", 'q', POPT_ARG_NONE, &quiet, 0, "Be quiet, don't output warnings" },
+ { "hex", 'h', POPT_ARG_NONE, &hexformat, 0, "Output format readable by text2pcap" },
POPT_TABLEEND
};
@@ -158,6 +271,8 @@ int main (int argc, char **argv)
if(!outfile) out = stdout;
+ if(!hexformat)print_pcap_header(out);
+
while(!feof(in)) {
fgets(buffer, sizeof(buffer), in);
if(buffer[0] == '[') { /* Header */
@@ -166,10 +281,11 @@ int main (int argc, char **argv)
if(in_packet == 1)continue;
read_log_msg(in, &curpacket, &curpacket_len, &data_offset, &data_length);
} else if(in_packet && strstr(buffer, "dump_data")) {
- read_log_data(in, curpacket+data_offset, data_length);
+ data_bytes_read = read_log_data(in, curpacket+data_offset, data_length);
} else {
if(in_packet){
- print_packet(out, curpacket, curpacket_len);
+ if(hexformat) { print_hex_packet(out, curpacket, curpacket_len); return; }
+ else print_netbios_packet(out, curpacket, curpacket_len, data_bytes_read+data_offset);
free(curpacket);
}
in_packet = 0;