Add ability to output native pcap files without the requirement for text2pcap.

IP and TCP checksums are not calculated, but that should not matter.
(This used to be commit aa96f780015c031e0c5a0e8773f192502c10c919)

1 files changed, 131 insertions, 15 deletions

diff --git a/source3/utils/log2pcaphex.c b/source3/utils/log2pcaphex.c
index d284fa5c54..4e44161ebe 100644
--- a/source3/utils/log2pcaphex.c
+++ b/source3/utils/log2pcaphex.c
@@ -5,7 +5,13 @@
    Copyright (C) Jelmer Vernooij 2003
    Thanks to Tim Potter for the genial idea
 
-   Example use: log2pcaphex < samba-log-file | text2pcap -T 139,139 - foo.pcap
+   Portions (from capconvert.c) (C) Andrew Tridgell 1997
+   Portions (from text2pcap.c) (C) Ashok Narayanan 2001
+
+   Example use with -h parameter: 
+   	log2pcaphex < samba-log-file | text2pcap -T 139,139 - foo.pcap
+
+   TODO: Have correct IP and TCP checksums.
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -26,21 +32,124 @@
 #include <assert.h>
 
 int quiet = 0;
+int hexformat = 0;
 
 #define itoa(a) ((a) < 0xa?'0'+(a):'A' + (a-0xa))
 
-void print_packet(FILE *out, unsigned char *data, long length)
+#include <stdlib.h>
+#include <unistd.h>
+#include <memory.h>
+#include <sys/time.h>
+#include <stdio.h>
+#include <fcntl.h>
+
+#define TCPDUMP_MAGIC 0xa1b2c3d4
+
+/* tcpdump file format */
+struct tcpdump_file_header {
+	uint32 magic;
+	uint16 major;
+	uint16 minor;
+	int32 zone;
+	uint32 sigfigs;
+	uint32 snaplen;
+	uint32 linktype;
+};
+
+struct tcpdump_packet {
+	struct timeval ts;
+	uint32 caplen;
+	uint32 len;
+};
+
+typedef struct {
+    uint8  ver_hdrlen;
+    uint8  dscp;
+    uint16 packet_length;
+    uint16 identification;
+    uint8  flags;
+    uint8  fragment;
+    uint8  ttl;
+    uint8  protocol;
+    uint16 hdr_checksum;
+    uint32 src_addr;
+    uint32 dest_addr;
+} hdr_ip_t;
+
+static hdr_ip_t HDR_IP = {0x45, 0, 0, 0x3412, 0, 0, 0xff, 6, 0, 0x01010101, 0x02020202};
+
+typedef struct {
+    uint16 source_port;
+    uint16 dest_port;
+    uint32 seq_num;
+    uint32 ack_num;
+    uint8  hdr_length;
+    uint8  flags;
+    uint16 window;
+    uint16 checksum;
+    uint16 urg;
+} hdr_tcp_t;
+
+static hdr_tcp_t HDR_TCP = {139, 139, 0, 0, 0x50, 0, 0, 0, 0};
+
+void print_pcap_header(FILE *out)
 {
-long i,cur = 0;int tmp;
-while(cur < length) {
-	fprintf(out, "%06X ", cur);
-	for(i = cur; i < length && i < cur + 16; i++) {
-		fprintf(out, "%02x ", data[i]);
-	}
+	struct tcpdump_file_header h;
+	h.magic = TCPDUMP_MAGIC;
+	h.major = 2;
+	h.minor = 4;
+	h.zone = 0;
+	h.sigfigs = 0;
+	h.snaplen = 102400; /* As long packets as possible */
+	h.linktype = 101; /* Raw IP */
+	fwrite(&h, sizeof(struct tcpdump_file_header), 1, out);
+}
+
+void print_pcap_packet(FILE *out, unsigned char *data, long length, long caplen)
+{
+	static int i = 0;
+	struct tcpdump_packet p;
+	i++;
+	p.ts.tv_usec = 0;
+	p.ts.tv_sec = 0;
+	p.caplen = caplen;
+	p.len = length;
+	fwrite(&p, sizeof(struct tcpdump_packet), 1, out);
+	fwrite(data, sizeof(unsigned char), caplen, out);
+}
+
+void print_hex_packet(FILE *out, unsigned char *data, long length)
+{
+	long i,cur = 0;int tmp;
+	while(cur < length) {
+		fprintf(out, "%06X ", cur);
+		for(i = cur; i < length && i < cur + 16; i++) {
+			fprintf(out, "%02x ", data[i]);
+		}
 	
-	cur = i;
-	fprintf(out, "\n");
+		cur = i;
+		fprintf(out, "\n");
+	}
 }
+
+void print_netbios_packet(FILE *out, unsigned char *data, long length, long actual_length)
+{	
+	unsigned char *newdata; long offset = 0;
+	long newlen;
+	
+	newlen = length+sizeof(HDR_IP)+sizeof(HDR_TCP);
+	newdata = malloc(newlen);
+
+	HDR_IP.packet_length = htons(newlen);
+	HDR_TCP.window = htons(0x2000);
+	HDR_TCP.source_port = HDR_TCP.dest_port = htons(139);
+
+	memcpy(newdata+offset, &HDR_IP, sizeof(HDR_IP));offset+=sizeof(HDR_IP);
+	memcpy(newdata+offset, &HDR_TCP, sizeof(HDR_TCP));offset+=sizeof(HDR_TCP);
+	memcpy(newdata+offset,data,length);
+	
+	print_pcap_packet(out, newdata, newlen, actual_length+offset);
+	free(newdata);
 }
 
 unsigned char *curpacket = NULL;
@@ -84,7 +193,7 @@ void read_log_msg(FILE *in, unsigned char **_buffer, long *buffersize, long *dat
 	*_buffer = buffer;
 }
 
-void read_log_data(FILE *in, unsigned char *buffer, long data_length)
+long read_log_data(FILE *in, unsigned char *buffer, long data_length)
 {
 	long i, addr; char real[2][16]; int ret;
 	unsigned char tmp;
@@ -96,16 +205,17 @@ void read_log_data(FILE *in, unsigned char *buffer, long data_length)
 			ret = fscanf(in, "  [%03X]", &addr);
 			if(!ret) {
 				if(!quiet)fprintf(stderr, "Only first %d bytes are logged, packet trace will be incomplete\nTry a higher log level\n", i);
-				return;
+				return i-1;
 			}
 			assert(addr == i);
 		}
 		if(!fscanf(in, "%02X", &tmp)) {
 			if(!quiet)fprintf(stderr, "Only first %d bytes are logged, packet trace will be incomplete\nTry a higher log level\n", i-1);
-			return;
+			return i-1;
 		}
 		buffer[i] = tmp;
 	}
+	return data_length;
 }
 
 int main (int argc, char **argv)
@@ -117,10 +227,13 @@ int main (int argc, char **argv)
 	poptContext pc;
 	char buffer[4096];
 	long data_offset, data_length;
+	long data_bytes_read;
 	int in_packet = 0;
+	int i;
 	struct poptOption long_options[] = {
 		POPT_AUTOHELP
 		{ "quiet", 'q', POPT_ARG_NONE, &quiet, 0, "Be quiet, don't output warnings" },
+		{ "hex", 'h', POPT_ARG_NONE, &hexformat, 0, "Output format readable by text2pcap" },
 		POPT_TABLEEND
 	};
 	
@@ -158,6 +271,8 @@ int main (int argc, char **argv)
 
 	if(!outfile) out = stdout;
 
+	if(!hexformat)print_pcap_header(out);
+
 	while(!feof(in)) {
 		fgets(buffer, sizeof(buffer), in);
 		if(buffer[0] == '[') { /* Header */
@@ -166,10 +281,11 @@ int main (int argc, char **argv)
 				if(in_packet == 1)continue;
 				read_log_msg(in, &curpacket, &curpacket_len, &data_offset, &data_length);
 			} else if(in_packet && strstr(buffer, "dump_data")) {
-				read_log_data(in, curpacket+data_offset, data_length);
+				data_bytes_read = read_log_data(in, curpacket+data_offset, data_length);
 			}  else { 
 				if(in_packet){ 
-					print_packet(out, curpacket, curpacket_len); 
+					if(hexformat) { print_hex_packet(out, curpacket, curpacket_len); return; }
+					else print_netbios_packet(out, curpacket, curpacket_len, data_bytes_read+data_offset);
 					free(curpacket); 
 				}
 				in_packet = 0;