2 Unix SMB/CIFS implementation.
3 Utility to extract pcap files from samba (log level 10) log files
5 Copyright (C) Jelmer Vernooij 2003
6 Thanks to Tim Potter for the genial idea
8 Portions (from capconvert.c) (C) Andrew Tridgell 1997
9 Portions (from text2pcap.c) (C) Ashok Narayanan 2001
11 Example use with -h parameter:
12 log2pcaphex < samba-log-file | text2pcap -T 139,139 - foo.pcap
14 TODO: Have correct IP and TCP checksums.
16 This program is free software; you can redistribute it and/or modify
17 it under the terms of the GNU General Public License as published by
18 the Free Software Foundation; either version 3 of the License, or
19 (at your option) any later version.
21 This program is distributed in the hope that it will be useful,
22 but WITHOUT ANY WARRANTY; without even the implied warranty of
23 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
24 GNU General Public License for more details.
26 You should have received a copy of the GNU General Public License
27 along with this program. If not, see <http://www.gnu.org/licenses/>.
32 /* We don't care about the paranoid malloc checker in this standalone
41 #define itoa(a) ((a) < 0xa?'0'+(a):'A' + (a-0xa))
49 #define TCPDUMP_MAGIC 0xa1b2c3d4
51 /* tcpdump file format */
52 struct tcpdump_file_header {
62 struct tcpdump_packet {
72 uint16 identification;
82 static hdr_ip_t HDR_IP = {0x45, 0, 0, 0x3412, 0, 0, 0xff, 6, 0, 0x01010101, 0x02020202};
96 static hdr_tcp_t HDR_TCP = {139, 139, 0, 0, 0x50, 0, 0, 0, 0};
98 static void print_pcap_header(FILE *out)
100 struct tcpdump_file_header h;
101 h.magic = TCPDUMP_MAGIC;
106 h.snaplen = 102400; /* As long packets as possible */
107 h.linktype = 101; /* Raw IP */
108 fwrite(&h, sizeof(struct tcpdump_file_header), 1, out);
111 static void print_pcap_packet(FILE *out, unsigned char *data, long length, long caplen)
114 struct tcpdump_packet p;
120 fwrite(&p, sizeof(struct tcpdump_packet), 1, out);
121 fwrite(data, sizeof(unsigned char), caplen, out);
124 static void print_hex_packet(FILE *out, unsigned char *data, long length)
127 while(cur < length) {
128 fprintf(out, "%06lX ", cur);
129 for(i = cur; i < length && i < cur + 16; i++) {
130 fprintf(out, "%02x ", data[i]);
138 static void print_netbios_packet(FILE *out, unsigned char *data, long length, long actual_length)
140 unsigned char *newdata; long offset = 0;
143 newlen = length+sizeof(HDR_IP)+sizeof(HDR_TCP);
144 newdata = (unsigned char *)malloc(newlen);
146 HDR_IP.packet_length = htons(newlen);
147 HDR_TCP.window = htons(0x2000);
148 HDR_TCP.source_port = HDR_TCP.dest_port = htons(139);
150 memcpy(newdata+offset, &HDR_IP, sizeof(HDR_IP));offset+=sizeof(HDR_IP);
151 memcpy(newdata+offset, &HDR_TCP, sizeof(HDR_TCP));offset+=sizeof(HDR_TCP);
152 memcpy(newdata+offset,data,length);
154 print_pcap_packet(out, newdata, newlen, actual_length+offset);
158 unsigned char *curpacket = NULL;
159 long curpacket_len = 0;
161 static void read_log_msg(FILE *in, unsigned char **_buffer, long *buffersize, long *data_offset, long *data_length)
163 unsigned char *buffer;
165 assert(fscanf(in, " size=%ld\n", buffersize));
166 *buffersize+=4; /* for netbios */
167 buffer = (unsigned char *)malloc(*buffersize);
168 memset(buffer, 0, *buffersize);
172 memcpy(buffer+2, &buffersize, 2);
177 assert(fscanf(in, " smb_com=0x%x\n", &tmp)); buffer[smb_com] = tmp;
178 assert(fscanf(in, " smb_rcls=%d\n", &tmp)); buffer[smb_rcls] = tmp;
179 assert(fscanf(in, " smb_reh=%d\n", &tmp)); buffer[smb_reh] = tmp;
180 assert(fscanf(in, " smb_err=%d\n", &tmp)); memcpy(buffer+smb_err, &tmp, 2);
181 assert(fscanf(in, " smb_flg=%d\n", &tmp)); buffer[smb_flg] = tmp;
182 assert(fscanf(in, " smb_flg2=%d\n", &tmp)); memcpy(buffer+smb_flg2, &tmp, 2);
183 assert(fscanf(in, " smb_tid=%d\n", &tmp)); memcpy(buffer+smb_tid, &tmp, 2);
184 assert(fscanf(in, " smb_pid=%d\n", &tmp)); memcpy(buffer+smb_pid, &tmp, 2);
185 assert(fscanf(in, " smb_uid=%d\n", &tmp)); memcpy(buffer+smb_uid, &tmp, 2);
186 assert(fscanf(in, " smb_mid=%d\n", &tmp)); memcpy(buffer+smb_mid, &tmp, 2);
187 assert(fscanf(in, " smt_wct=%d\n", &tmp)); buffer[smb_wct] = tmp;
188 for(i = 0; i < buffer[smb_wct]; i++) {
189 assert(fscanf(in, " smb_vwv[%*2d]=%*5d (0x%X)\n", &tmp));
190 memcpy(buffer+smb_vwv+i*2, &tmp, 2);
193 *data_offset = smb_vwv+buffer[smb_wct]*2;
194 assert(fscanf(in, " smb_bcc=%ld\n", data_length)); buffer[(*data_offset)] = *data_length;
199 static long read_log_data(FILE *in, unsigned char *buffer, long data_length)
201 long i, addr; char real[2][16]; int ret;
203 for(i = 0; i < data_length; i++) {
205 if(i != 0) { /* Read data after each line */
206 assert(fscanf(in, "%8s %8s", real[0], real[1]) == 2);
208 ret = fscanf(in, " [%03lX]", &addr);
210 if(!quiet)fprintf(stderr, "Only first %ld bytes are logged, packet trace will be incomplete\nTry a higher log level\n", i);
215 if(!fscanf(in, "%02X", &tmp)) {
216 if(!quiet)fprintf(stderr, "Only first %ld bytes are logged, packet trace will be incomplete\nTry a higher log level\n", i-1);
224 int main (int argc, char **argv)
226 const char *infile, *outfile;
231 long data_offset, data_length;
232 long data_bytes_read = 0;
234 struct poptOption long_options[] = {
236 { "quiet", 'q', POPT_ARG_NONE, &quiet, 0, "Be quiet, don't output warnings" },
237 { "hex", 'h', POPT_ARG_NONE, &hexformat, 0, "Output format readable by text2pcap" },
241 pc = poptGetContext(NULL, argc, (const char **) argv, long_options,
242 POPT_CONTEXT_KEEP_FIRST);
243 poptSetOtherOptionHelp(pc, "[<infile> [<outfile>]]");
246 while((opt = poptGetNextOpt(pc)) != -1) {
251 poptGetArg(pc); /* Drop argv[0], the program name */
253 infile = poptGetArg(pc);
256 in = fopen(infile, "r");
263 outfile = poptGetArg(pc);
266 out = fopen(outfile, "w+");
269 fprintf(stderr, "Can't find %s, using stdout...\n", outfile);
273 if(!outfile) out = stdout;
275 if(!hexformat)print_pcap_header(out);
278 fgets(buffer, sizeof(buffer), in);
279 if(buffer[0] == '[') { /* Header */
280 if(strstr(buffer, "show_msg")) {
282 if(in_packet == 1)continue;
283 read_log_msg(in, &curpacket, &curpacket_len, &data_offset, &data_length);
284 } else if(in_packet && strstr(buffer, "dump_data")) {
285 data_bytes_read = read_log_data(in, curpacket+data_offset, data_length);
288 if(hexformat) print_hex_packet(out, curpacket, curpacket_len);
289 else print_netbios_packet(out, curpacket, curpacket_len, data_bytes_read+data_offset);