Copyright (C) Jelmer Vernooij 2003
Thanks to Tim Potter for the genial idea
- Example use: log2pcaphex < samba-log-file | text2pcap -T 139,139 - foo.pcap
+ Portions (from capconvert.c) (C) Andrew Tridgell 1997
+ Portions (from text2pcap.c) (C) Ashok Narayanan 2001
+
+ Example use with -h parameter:
+ log2pcaphex < samba-log-file | text2pcap -T 139,139 - foo.pcap
+
+ TODO: Have correct IP and TCP checksums.
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
#include <assert.h>
int quiet = 0;
+int hexformat = 0;
#define itoa(a) ((a) < 0xa?'0'+(a):'A' + (a-0xa))
-void print_packet(FILE *out, unsigned char *data, long length)
+#include <stdlib.h>
+#include <unistd.h>
+#include <memory.h>
+#include <sys/time.h>
+#include <stdio.h>
+#include <fcntl.h>
+
+#define TCPDUMP_MAGIC 0xa1b2c3d4
+
+/* tcpdump file format */
+struct tcpdump_file_header {
+ uint32 magic;
+ uint16 major;
+ uint16 minor;
+ int32 zone;
+ uint32 sigfigs;
+ uint32 snaplen;
+ uint32 linktype;
+};
+
+struct tcpdump_packet {
+ struct timeval ts;
+ uint32 caplen;
+ uint32 len;
+};
+
+typedef struct {
+ uint8 ver_hdrlen;
+ uint8 dscp;
+ uint16 packet_length;
+ uint16 identification;
+ uint8 flags;
+ uint8 fragment;
+ uint8 ttl;
+ uint8 protocol;
+ uint16 hdr_checksum;
+ uint32 src_addr;
+ uint32 dest_addr;
+} hdr_ip_t;
+
+static hdr_ip_t HDR_IP = {0x45, 0, 0, 0x3412, 0, 0, 0xff, 6, 0, 0x01010101, 0x02020202};
+
+typedef struct {
+ uint16 source_port;
+ uint16 dest_port;
+ uint32 seq_num;
+ uint32 ack_num;
+ uint8 hdr_length;
+ uint8 flags;
+ uint16 window;
+ uint16 checksum;
+ uint16 urg;
+} hdr_tcp_t;
+
+static hdr_tcp_t HDR_TCP = {139, 139, 0, 0, 0x50, 0, 0, 0, 0};
+
+void print_pcap_header(FILE *out)
{
-long i,cur = 0;int tmp;
-while(cur < length) {
- fprintf(out, "%06X ", cur);
- for(i = cur; i < length && i < cur + 16; i++) {
- fprintf(out, "%02x ", data[i]);
- }
+ struct tcpdump_file_header h;
+ h.magic = TCPDUMP_MAGIC;
+ h.major = 2;
+ h.minor = 4;
+ h.zone = 0;
+ h.sigfigs = 0;
+ h.snaplen = 102400; /* As long packets as possible */
+ h.linktype = 101; /* Raw IP */
+ fwrite(&h, sizeof(struct tcpdump_file_header), 1, out);
+}
+
+void print_pcap_packet(FILE *out, unsigned char *data, long length, long caplen)
+{
+ static int i = 0;
+ struct tcpdump_packet p;
+ i++;
+ p.ts.tv_usec = 0;
+ p.ts.tv_sec = 0;
+ p.caplen = caplen;
+ p.len = length;
+ fwrite(&p, sizeof(struct tcpdump_packet), 1, out);
+ fwrite(data, sizeof(unsigned char), caplen, out);
+}
+
+void print_hex_packet(FILE *out, unsigned char *data, long length)
+{
+ long i,cur = 0;int tmp;
+ while(cur < length) {
+ fprintf(out, "%06X ", cur);
+ for(i = cur; i < length && i < cur + 16; i++) {
+ fprintf(out, "%02x ", data[i]);
+ }
- cur = i;
- fprintf(out, "\n");
+ cur = i;
+ fprintf(out, "\n");
+ }
}
+
+void print_netbios_packet(FILE *out, unsigned char *data, long length, long actual_length)
+{
+ unsigned char *newdata; long offset = 0;
+ long newlen;
+
+ newlen = length+sizeof(HDR_IP)+sizeof(HDR_TCP);
+ newdata = malloc(newlen);
+
+ HDR_IP.packet_length = htons(newlen);
+ HDR_TCP.window = htons(0x2000);
+ HDR_TCP.source_port = HDR_TCP.dest_port = htons(139);
+
+ memcpy(newdata+offset, &HDR_IP, sizeof(HDR_IP));offset+=sizeof(HDR_IP);
+ memcpy(newdata+offset, &HDR_TCP, sizeof(HDR_TCP));offset+=sizeof(HDR_TCP);
+ memcpy(newdata+offset,data,length);
+
+ print_pcap_packet(out, newdata, newlen, actual_length+offset);
+ free(newdata);
}
unsigned char *curpacket = NULL;
*_buffer = buffer;
}
-void read_log_data(FILE *in, unsigned char *buffer, long data_length)
+long read_log_data(FILE *in, unsigned char *buffer, long data_length)
{
long i, addr; char real[2][16]; int ret;
unsigned char tmp;
ret = fscanf(in, " [%03X]", &addr);
if(!ret) {
if(!quiet)fprintf(stderr, "Only first %d bytes are logged, packet trace will be incomplete\nTry a higher log level\n", i);
- return;
+ return i-1;
}
assert(addr == i);
}
if(!fscanf(in, "%02X", &tmp)) {
if(!quiet)fprintf(stderr, "Only first %d bytes are logged, packet trace will be incomplete\nTry a higher log level\n", i-1);
- return;
+ return i-1;
}
buffer[i] = tmp;
}
+ return data_length;
}
int main (int argc, char **argv)
poptContext pc;
char buffer[4096];
long data_offset, data_length;
+ long data_bytes_read;
int in_packet = 0;
+ int i;
struct poptOption long_options[] = {
POPT_AUTOHELP
{ "quiet", 'q', POPT_ARG_NONE, &quiet, 0, "Be quiet, don't output warnings" },
+ { "hex", 'h', POPT_ARG_NONE, &hexformat, 0, "Output format readable by text2pcap" },
POPT_TABLEEND
};
if(!outfile) out = stdout;
+ if(!hexformat)print_pcap_header(out);
+
while(!feof(in)) {
fgets(buffer, sizeof(buffer), in);
if(buffer[0] == '[') { /* Header */
if(in_packet == 1)continue;
read_log_msg(in, &curpacket, &curpacket_len, &data_offset, &data_length);
} else if(in_packet && strstr(buffer, "dump_data")) {
- read_log_data(in, curpacket+data_offset, data_length);
+ data_bytes_read = read_log_data(in, curpacket+data_offset, data_length);
} else {
if(in_packet){
- print_packet(out, curpacket, curpacket_len);
+ if(hexformat) { print_hex_packet(out, curpacket, curpacket_len); return; }
+ else print_netbios_packet(out, curpacket, curpacket_len, data_bytes_read+data_offset);
free(curpacket);
}
in_packet = 0;
git.samba.org / ira / wip.git / commitdiff