diff options
Diffstat (limited to 'source3/utils')
| -rw-r--r-- | source3/utils/log2pcaphex.c | 146 |
1 files changed, 131 insertions, 15 deletions
diff --git a/source3/utils/log2pcaphex.c b/source3/utils/log2pcaphex.c index d284fa5c54..4e44161ebe 100644 --- a/source3/utils/log2pcaphex.c +++ b/source3/utils/log2pcaphex.c @@ -5,7 +5,13 @@ Copyright (C) Jelmer Vernooij 2003 Thanks to Tim Potter for the genial idea - Example use: log2pcaphex < samba-log-file | text2pcap -T 139,139 - foo.pcap + Portions (from capconvert.c) (C) Andrew Tridgell 1997 + Portions (from text2pcap.c) (C) Ashok Narayanan 2001 + + Example use with -h parameter: + log2pcaphex < samba-log-file | text2pcap -T 139,139 - foo.pcap + + TODO: Have correct IP and TCP checksums. This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by @@ -26,21 +32,124 @@ #include <assert.h> int quiet = 0; +int hexformat = 0; #define itoa(a) ((a) < 0xa?'0'+(a):'A' + (a-0xa)) -void print_packet(FILE *out, unsigned char *data, long length) +#include <stdlib.h> +#include <unistd.h> +#include <memory.h> +#include <sys/time.h> +#include <stdio.h> +#include <fcntl.h> + +#define TCPDUMP_MAGIC 0xa1b2c3d4 + +/* tcpdump file format */ +struct tcpdump_file_header { + uint32 magic; + uint16 major; + uint16 minor; + int32 zone; + uint32 sigfigs; + uint32 snaplen; + uint32 linktype; +}; + +struct tcpdump_packet { + struct timeval ts; + uint32 caplen; + uint32 len; +}; + +typedef struct { + uint8 ver_hdrlen; + uint8 dscp; + uint16 packet_length; + uint16 identification; + uint8 flags; + uint8 fragment; + uint8 ttl; + uint8 protocol; + uint16 hdr_checksum; + uint32 src_addr; + uint32 dest_addr; +} hdr_ip_t; + +static hdr_ip_t HDR_IP = {0x45, 0, 0, 0x3412, 0, 0, 0xff, 6, 0, 0x01010101, 0x02020202}; + +typedef struct { + uint16 source_port; + uint16 dest_port; + uint32 seq_num; + uint32 ack_num; + uint8 hdr_length; + uint8 flags; + uint16 window; + uint16 checksum; + uint16 urg; +} hdr_tcp_t; + +static hdr_tcp_t HDR_TCP = {139, 139, 0, 0, 0x50, 0, 0, 0, 0}; + +void print_pcap_header(FILE *out) { -long i,cur = 0;int tmp; -while(cur < length) { - fprintf(out, "%06X ", cur); - for(i = cur; i < length && i < cur + 16; i++) { - fprintf(out, "%02x ", data[i]); - } + struct tcpdump_file_header h; + h.magic = TCPDUMP_MAGIC; + h.major = 2; + h.minor = 4; + h.zone = 0; + h.sigfigs = 0; + h.snaplen = 102400; /* As long packets as possible */ + h.linktype = 101; /* Raw IP */ + fwrite(&h, sizeof(struct tcpdump_file_header), 1, out); +} + +void print_pcap_packet(FILE *out, unsigned char *data, long length, long caplen) +{ + static int i = 0; + struct tcpdump_packet p; + i++; + p.ts.tv_usec = 0; + p.ts.tv_sec = 0; + p.caplen = caplen; + p.len = length; + fwrite(&p, sizeof(struct tcpdump_packet), 1, out); + fwrite(data, sizeof(unsigned char), caplen, out); +} + +void print_hex_packet(FILE *out, unsigned char *data, long length) +{ + long i,cur = 0;int tmp; + while(cur < length) { + fprintf(out, "%06X ", cur); + for(i = cur; i < length && i < cur + 16; i++) { + fprintf(out, "%02x ", data[i]); + } - cur = i; - fprintf(out, "\n"); + cur = i; + fprintf(out, "\n"); + } } + +void print_netbios_packet(FILE *out, unsigned char *data, long length, long actual_length) +{ + unsigned char *newdata; long offset = 0; + long newlen; + + newlen = length+sizeof(HDR_IP)+sizeof(HDR_TCP); + newdata = malloc(newlen); + + HDR_IP.packet_length = htons(newlen); + HDR_TCP.window = htons(0x2000); + HDR_TCP.source_port = HDR_TCP.dest_port = htons(139); + + memcpy(newdata+offset, &HDR_IP, sizeof(HDR_IP));offset+=sizeof(HDR_IP); + memcpy(newdata+offset, &HDR_TCP, sizeof(HDR_TCP));offset+=sizeof(HDR_TCP); + memcpy(newdata+offset,data,length); + + print_pcap_packet(out, newdata, newlen, actual_length+offset); + free(newdata); } unsigned char *curpacket = NULL; @@ -84,7 +193,7 @@ void read_log_msg(FILE *in, unsigned char **_buffer, long *buffersize, long *dat *_buffer = buffer; } -void read_log_data(FILE *in, unsigned char *buffer, long data_length) +long read_log_data(FILE *in, unsigned char *buffer, long data_length) { long i, addr; char real[2][16]; int ret; unsigned char tmp; @@ -96,16 +205,17 @@ void read_log_data(FILE *in, unsigned char *buffer, long data_length) ret = fscanf(in, " [%03X]", &addr); if(!ret) { if(!quiet)fprintf(stderr, "Only first %d bytes are logged, packet trace will be incomplete\nTry a higher log level\n", i); - return; + return i-1; } assert(addr == i); } if(!fscanf(in, "%02X", &tmp)) { if(!quiet)fprintf(stderr, "Only first %d bytes are logged, packet trace will be incomplete\nTry a higher log level\n", i-1); - return; + return i-1; } buffer[i] = tmp; } + return data_length; } int main (int argc, char **argv) @@ -117,10 +227,13 @@ int main (int argc, char **argv) poptContext pc; char buffer[4096]; long data_offset, data_length; + long data_bytes_read; int in_packet = 0; + int i; struct poptOption long_options[] = { POPT_AUTOHELP { "quiet", 'q', POPT_ARG_NONE, &quiet, 0, "Be quiet, don't output warnings" }, + { "hex", 'h', POPT_ARG_NONE, &hexformat, 0, "Output format readable by text2pcap" }, POPT_TABLEEND }; @@ -158,6 +271,8 @@ int main (int argc, char **argv) if(!outfile) out = stdout; + if(!hexformat)print_pcap_header(out); + while(!feof(in)) { fgets(buffer, sizeof(buffer), in); if(buffer[0] == '[') { /* Header */ @@ -166,10 +281,11 @@ int main (int argc, char **argv) if(in_packet == 1)continue; read_log_msg(in, &curpacket, &curpacket_len, &data_offset, &data_length); } else if(in_packet && strstr(buffer, "dump_data")) { - read_log_data(in, curpacket+data_offset, data_length); + data_bytes_read = read_log_data(in, curpacket+data_offset, data_length); } else { if(in_packet){ - print_packet(out, curpacket, curpacket_len); + if(hexformat) { print_hex_packet(out, curpacket, curpacket_len); return; } + else print_netbios_packet(out, curpacket, curpacket_len, data_bytes_read+data_offset); free(curpacket); } in_packet = 0; |