source/utils/log2pcaphex.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Utility to extract pcap files from samba (log level 10) log files
   4
   5    Copyright (C) Jelmer Vernooij 2003
   6    Thanks to Tim Potter for the genial idea
   7
   8    Portions (from capconvert.c) (C) Andrew Tridgell 1997
   9    Portions (from text2pcap.c) (C) Ashok Narayanan 2001
  10
  11    Example use with -h parameter:
  12         log2pcaphex < samba-log-file | text2pcap -T 139,139 - foo.pcap
  13
  14    TODO: Have correct IP and TCP checksums.
  15
  16    This program is free software; you can redistribute it and/or modify
  17    it under the terms of the GNU General Public License as published by
  18    the Free Software Foundation; either version 3 of the License, or
  19    (at your option) any later version.
  20
  21    This program is distributed in the hope that it will be useful,
  22    but WITHOUT ANY WARRANTY; without even the implied warranty of
  23    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  24    GNU General Public License for more details.
  25
  26    You should have received a copy of the GNU General Public License
  27    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  28 */
  29
  30 #include "includes.h"
  31
  32 /* We don't care about the paranoid malloc checker in this standalone
  33    program */
  34 #undef malloc
  35
  36 #include <assert.h>
  37
  38 bool quiet = 0;
  39 bool hexformat = 0;
  40
  41 #define itoa(a) ((a) < 0xa?'0'+(a):'A' + (a-0xa))
  42
  43 #include <stdlib.h>
  44 #include <unistd.h>
  45 #include <sys/time.h>
  46 #include <stdio.h>
  47 #include <fcntl.h>
  48
  49 #define TCPDUMP_MAGIC 0xa1b2c3d4
  50
  51 /* tcpdump file format */
  52 struct tcpdump_file_header {
  53         uint32 magic;
  54         uint16 major;
  55         uint16 minor;
  56         int32 zone;
  57         uint32 sigfigs;
  58         uint32 snaplen;
  59         uint32 linktype;
  60 };
  61
  62 struct tcpdump_packet {
  63         struct timeval ts;
  64         uint32 caplen;
  65         uint32 len;
  66 };
  67
  68 typedef struct {
  69     uint8  ver_hdrlen;
  70     uint8  dscp;
  71     uint16 packet_length;
  72     uint16 identification;
  73     uint8  flags;
  74     uint8  fragment;
  75     uint8  ttl;
  76     uint8  protocol;
  77     uint16 hdr_checksum;
  78     uint32 src_addr;
  79     uint32 dest_addr;
  80 } hdr_ip_t;
  81
  82 static hdr_ip_t HDR_IP = {0x45, 0, 0, 0x3412, 0, 0, 0xff, 6, 0, 0x01010101, 0x02020202};
  83
  84 typedef struct {
  85     uint16 source_port;
  86     uint16 dest_port;
  87     uint32 seq_num;
  88     uint32 ack_num;
  89     uint8  hdr_length;
  90     uint8  flags;
  91     uint16 window;
  92     uint16 checksum;
  93     uint16 urg;
  94 } hdr_tcp_t;
  95
  96 static hdr_tcp_t HDR_TCP = {139, 139, 0, 0, 0x50, 0, 0, 0, 0};
  97
  98 static void print_pcap_header(FILE *out)
  99 {
 100         struct tcpdump_file_header h;
 101         h.magic = TCPDUMP_MAGIC;
 102         h.major = 2;
 103         h.minor = 4;
 104         h.zone = 0;
 105         h.sigfigs = 0;
 106         h.snaplen = 102400; /* As long packets as possible */
 107         h.linktype = 101; /* Raw IP */
 108         fwrite(&h, sizeof(struct tcpdump_file_header), 1, out);
 109 }
 110
 111 static void print_pcap_packet(FILE *out, unsigned char *data, long length, long caplen)
 112 {
 113         static int i = 0;
 114         struct tcpdump_packet p;
 115         i++;
 116         p.ts.tv_usec = 0;
 117         p.ts.tv_sec = 0;
 118         p.caplen = caplen;
 119         p.len = length;
 120         fwrite(&p, sizeof(struct tcpdump_packet), 1, out);
 121         fwrite(data, sizeof(unsigned char), caplen, out);
 122 }
 123
 124 static void print_hex_packet(FILE *out, unsigned char *data, long length)
 125 {
 126         long i,cur = 0;
 127         while(cur < length) {
 128                 fprintf(out, "%06lX ", cur);
 129                 for(i = cur; i < length && i < cur + 16; i++) {
 130                         fprintf(out, "%02x ", data[i]);
 131                 }
 132
 133                 cur = i;
 134                 fprintf(out, "\n");
 135         }
 136 }
 137
 138 static void print_netbios_packet(FILE *out, unsigned char *data, long length, long actual_length)
 139 {
 140         unsigned char *newdata; long offset = 0;
 141         long newlen;
 142
 143         newlen = length+sizeof(HDR_IP)+sizeof(HDR_TCP);
 144         newdata = (unsigned char *)malloc(newlen);
 145
 146         HDR_IP.packet_length = htons(newlen);
 147         HDR_TCP.window = htons(0x2000);
 148         HDR_TCP.source_port = HDR_TCP.dest_port = htons(139);
 149
 150         memcpy(newdata+offset, &HDR_IP, sizeof(HDR_IP));offset+=sizeof(HDR_IP);
 151         memcpy(newdata+offset, &HDR_TCP, sizeof(HDR_TCP));offset+=sizeof(HDR_TCP);
 152         memcpy(newdata+offset,data,length);
 153
 154         print_pcap_packet(out, newdata, newlen, actual_length+offset);
 155         free(newdata);
 156 }
 157
 158 unsigned char *curpacket = NULL;
 159 long curpacket_len = 0;
 160
 161 static void read_log_msg(FILE *in, unsigned char **_buffer, long *buffersize, long *data_offset, long *data_length)
 162 {
 163         unsigned char *buffer;
 164         int tmp; long i;
 165         assert(fscanf(in, " size=%ld\n", buffersize));
 166         *buffersize+=4; /* for netbios */
 167         buffer = (unsigned char *)malloc(*buffersize);
 168         memset(buffer, 0, *buffersize);
 169         /* NetBIOS */
 170         buffer[0] = 0x00;
 171         buffer[1] = 0x00;
 172         memcpy(buffer+2, &buffersize, 2);
 173         buffer[4] = 0xFF;
 174         buffer[5] = 'S';
 175         buffer[6] = 'M';
 176         buffer[7] = 'B';
 177         assert(fscanf(in, "  smb_com=0x%x\n", &tmp)); buffer[smb_com] = tmp;
 178         assert(fscanf(in, "  smb_rcls=%d\n", &tmp)); buffer[smb_rcls] = tmp;
 179         assert(fscanf(in, "  smb_reh=%d\n", &tmp)); buffer[smb_reh] = tmp;
 180         assert(fscanf(in, "  smb_err=%d\n", &tmp)); memcpy(buffer+smb_err, &tmp, 2);
 181         assert(fscanf(in, "  smb_flg=%d\n", &tmp)); buffer[smb_flg] = tmp;
 182         assert(fscanf(in, "  smb_flg2=%d\n", &tmp)); memcpy(buffer+smb_flg2, &tmp, 2);
 183         assert(fscanf(in, "  smb_tid=%d\n", &tmp)); memcpy(buffer+smb_tid, &tmp, 2);
 184         assert(fscanf(in, "  smb_pid=%d\n", &tmp)); memcpy(buffer+smb_pid, &tmp, 2);
 185         assert(fscanf(in, "  smb_uid=%d\n", &tmp)); memcpy(buffer+smb_uid, &tmp, 2);
 186         assert(fscanf(in, "  smb_mid=%d\n", &tmp)); memcpy(buffer+smb_mid, &tmp, 2);
 187         assert(fscanf(in, "  smt_wct=%d\n", &tmp)); buffer[smb_wct] = tmp;
 188         for(i = 0; i < buffer[smb_wct]; i++) {
 189                 assert(fscanf(in, "  smb_vwv[%*2d]=%*5d (0x%X)\n", &tmp));
 190                 memcpy(buffer+smb_vwv+i*2, &tmp, 2);
 191         }
 192
 193         *data_offset = smb_vwv+buffer[smb_wct]*2;
 194         assert(fscanf(in, "  smb_bcc=%ld\n", data_length)); buffer[(*data_offset)] = *data_length;
 195         (*data_offset)+=2;
 196         *_buffer = buffer;
 197 }
 198
 199 static long read_log_data(FILE *in, unsigned char *buffer, long data_length)
 200 {
 201         long i, addr; char real[2][16]; int ret;
 202         unsigned int tmp;
 203         for(i = 0; i < data_length; i++) {
 204                 if(i % 16 == 0){
 205                         if(i != 0) { /* Read data after each line */
 206                                 assert(fscanf(in, "%8s %8s", real[0], real[1]) == 2);
 207                         }
 208                         ret = fscanf(in, "  [%03lX]", &addr);
 209                         if(!ret) {
 210                                 if(!quiet)fprintf(stderr, "Only first %ld bytes are logged, packet trace will be incomplete\nTry a higher log level\n", i);
 211                                 return i-1;
 212                         }
 213                         assert(addr == i);
 214                 }
 215                 if(!fscanf(in, "%02X", &tmp)) {
 216                         if(!quiet)fprintf(stderr, "Only first %ld bytes are logged, packet trace will be incomplete\nTry a higher log level\n", i-1);
 217                         return i-1;
 218                 }
 219                 buffer[i] = tmp;
 220         }
 221         return data_length;
 222 }
 223
 224 int main (int argc, char **argv)
 225 {
 226         const char *infile, *outfile;
 227         FILE *out, *in;
 228         int opt;
 229         poptContext pc;
 230         char buffer[4096];
 231         long data_offset = 0, data_length;
 232         long data_bytes_read = 0;
 233         int in_packet = 0;
 234         struct poptOption long_options[] = {
 235                 POPT_AUTOHELP
 236                 { "quiet", 'q', POPT_ARG_NONE, NULL, 'q', "Be quiet, don't output warnings" },
 237                 { "hex", 'h', POPT_ARG_NONE, NULL, 'h', "Output format readable by text2pcap" },
 238                 POPT_TABLEEND
 239         };
 240
 241         pc = poptGetContext(NULL, argc, (const char **) argv, long_options,
 242                             POPT_CONTEXT_KEEP_FIRST);
 243         poptSetOtherOptionHelp(pc, "[<infile> [<outfile>]]");
 244
 245
 246         while((opt = poptGetNextOpt(pc)) != -1) {
 247                 switch (opt) {
 248                 case 'q':
 249                         quiet = true;
 250                         break;
 251                 case 'h':
 252                         hexformat = true;
 253                         break;
 254                 }
 255         }
 256
 257         poptGetArg(pc); /* Drop argv[0], the program name */
 258
 259         infile = poptGetArg(pc);
 260
 261         if(infile) {
 262                 in  = fopen(infile, "r");
 263                 if(!in) {
 264                         perror("fopen");
 265                         return 1;
 266                 }
 267         } else in = stdin;
 268
 269         outfile = poptGetArg(pc);
 270
 271         if(outfile) {
 272                 out = fopen(outfile, "w+");
 273                 if(!out) {
 274                         perror("fopen");
 275                         fprintf(stderr, "Can't find %s, using stdout...\n", outfile);
 276                 }
 277         }
 278
 279         if(!outfile) out = stdout;
 280
 281         if(!hexformat)print_pcap_header(out);
 282
 283         while(!feof(in)) {
 284                 fgets(buffer, sizeof(buffer), in);
 285                 if(buffer[0] == '[') { /* Header */
 286                         if(strstr(buffer, "show_msg")) {
 287                                 in_packet++;
 288                                 if(in_packet == 1)continue;
 289                                 read_log_msg(in, &curpacket, &curpacket_len, &data_offset, &data_length);
 290                         } else if(in_packet && strstr(buffer, "dump_data")) {
 291                                 data_bytes_read = read_log_data(in, curpacket+data_offset, data_length);
 292                         }  else {
 293                                 if(in_packet){
 294                                         if(hexformat) print_hex_packet(out, curpacket, curpacket_len);
 295                                         else print_netbios_packet(out, curpacket, curpacket_len, data_bytes_read+data_offset);
 296                                         free(curpacket);
 297                                 }
 298                                 in_packet = 0;
 299                         }
 300                 }
 301         }
 302
 303         return 0;
 304 }