mirror of
https://github.com/samba-team/samba.git
synced 2024-12-24 21:34:56 +03:00
968f720410
If done with popt context it should be free'd. Signed-off-by: Swen Schillig <swen@linux.ibm.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Ralph Böhme <slow@samba.org>
406 lines
11 KiB
C
406 lines
11 KiB
C
/*
|
|
Unix SMB/CIFS implementation.
|
|
Utility to extract pcap files from samba (log level 10) log files
|
|
|
|
Copyright (C) Jelmer Vernooij 2003
|
|
Thanks to Tim Potter for the genial idea
|
|
|
|
Portions (from capconvert.c) (C) Andrew Tridgell 1997
|
|
Portions (from text2pcap.c) (C) Ashok Narayanan 2001
|
|
|
|
Example:
|
|
Output NBSS(SMB) packets in hex and convert to pcap adding
|
|
Eth/IP/TCP headers
|
|
|
|
log2pcap -h < samba.log | text2pcap -T 139,139 - samba.pcap
|
|
|
|
Output directly to pcap format without Eth headers or TCP
|
|
sequence numbers
|
|
|
|
log2pcap samba.log samba.pcap
|
|
|
|
TODO:
|
|
- Hex to text2pcap outputs are not properly parsed in Wireshark
|
|
the NBSS or SMB level. This is a bug.
|
|
- Writing directly to pcap format doesn't include sequence numbers
|
|
in the TCP packets
|
|
- Check if a packet is a response or request and set IP to/from
|
|
addresses accordingly. Currently all packets come from the same
|
|
dummy IP and go to the same dummy IP
|
|
- Add a message when done parsing about the number of pacekts
|
|
processed
|
|
- Parse NBSS packet header data from log file
|
|
- Have correct IP and TCP checksums.
|
|
|
|
Warning:
|
|
Samba log level 10 outputs a max of 512 bytes from the packet data
|
|
section. Packets larger than this will be truncated.
|
|
|
|
This program is free software; you can redistribute it and/or modify
|
|
it under the terms of the GNU General Public License as published by
|
|
the Free Software Foundation; either version 3 of the License, or
|
|
(at your option) any later version.
|
|
|
|
This program is distributed in the hope that it will be useful,
|
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
GNU General Public License for more details.
|
|
|
|
You should have received a copy of the GNU General Public License
|
|
along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
*/
|
|
|
|
#include "includes.h"
|
|
#include "popt_common.h"
|
|
|
|
/* We don't care about the paranoid malloc checker in this standalone
|
|
program */
|
|
#undef malloc
|
|
|
|
#include <assert.h>
|
|
|
|
int quiet = 0;
|
|
int hexformat = 0;
|
|
|
|
#define itoa(a) ((a) < 0xa?'0'+(a):'A' + (a-0xa))
|
|
|
|
#include <stdlib.h>
|
|
#include <unistd.h>
|
|
#include <sys/time.h>
|
|
#include <stdio.h>
|
|
#include <fcntl.h>
|
|
|
|
#define TCPDUMP_MAGIC 0xa1b2c3d4
|
|
|
|
/* tcpdump file format */
|
|
struct tcpdump_file_header {
|
|
uint32_t magic;
|
|
uint16_t major;
|
|
uint16_t minor;
|
|
int32_t zone;
|
|
uint32_t sigfigs;
|
|
uint32_t snaplen;
|
|
uint32_t linktype;
|
|
};
|
|
|
|
struct tcpdump_packet {
|
|
struct timeval ts;
|
|
uint32_t caplen;
|
|
uint32_t len;
|
|
};
|
|
|
|
typedef struct {
|
|
uint8_t ver_hdrlen;
|
|
uint8_t dscp;
|
|
uint16_t packet_length;
|
|
uint16_t identification;
|
|
uint8_t flags;
|
|
uint8_t fragment;
|
|
uint8_t ttl;
|
|
uint8_t protocol;
|
|
uint16_t hdr_checksum;
|
|
uint32_t src_addr;
|
|
uint32_t dest_addr;
|
|
} hdr_ip_t;
|
|
|
|
static hdr_ip_t HDR_IP = {0x45, 0, 0, 0x3412, 0, 0, 0xff, 6, 0, 0x01010101, 0x02020202};
|
|
|
|
typedef struct {
|
|
uint16_t source_port;
|
|
uint16_t dest_port;
|
|
uint32_t seq_num;
|
|
uint32_t ack_num;
|
|
uint8_t hdr_length;
|
|
uint8_t flags;
|
|
uint16_t window;
|
|
uint16_t checksum;
|
|
uint16_t urg;
|
|
} hdr_tcp_t;
|
|
|
|
static hdr_tcp_t HDR_TCP = {139, 139, 0, 0, 0x50, 0, 0, 0, 0};
|
|
|
|
static void print_pcap_header(FILE *out)
|
|
{
|
|
struct tcpdump_file_header h;
|
|
h.magic = TCPDUMP_MAGIC;
|
|
h.major = 2;
|
|
h.minor = 4;
|
|
h.zone = 0;
|
|
h.sigfigs = 0;
|
|
h.snaplen = 102400; /* As long packets as possible */
|
|
h.linktype = 101; /* Raw IP */
|
|
fwrite(&h, sizeof(struct tcpdump_file_header), 1, out);
|
|
}
|
|
|
|
static void print_pcap_packet(FILE *out, unsigned char *data, long length,
|
|
long caplen)
|
|
{
|
|
static int i = 0;
|
|
struct tcpdump_packet p;
|
|
i++;
|
|
p.ts.tv_usec = 0;
|
|
p.ts.tv_sec = 0;
|
|
p.caplen = caplen;
|
|
p.len = length;
|
|
fwrite(&p, sizeof(struct tcpdump_packet), 1, out);
|
|
fwrite(data, sizeof(unsigned char), caplen, out);
|
|
}
|
|
|
|
static void print_hex_packet(FILE *out, unsigned char *data, long length)
|
|
{
|
|
long i,cur = 0;
|
|
while(cur < length) {
|
|
fprintf(out, "%06lX ", cur);
|
|
for(i = cur; i < length && i < cur + 16; i++) {
|
|
fprintf(out, "%02x ", data[i]);
|
|
}
|
|
cur = i;
|
|
fprintf(out, "\n");
|
|
}
|
|
}
|
|
|
|
static void print_netbios_packet(FILE *out, unsigned char *data, long length,
|
|
long actual_length)
|
|
{
|
|
unsigned char *newdata; long offset = 0;
|
|
long newlen;
|
|
|
|
newlen = length+sizeof(HDR_IP)+sizeof(HDR_TCP);
|
|
newdata = (unsigned char *)malloc(newlen);
|
|
|
|
HDR_IP.packet_length = htons(newlen);
|
|
HDR_TCP.window = htons(0x2000);
|
|
HDR_TCP.source_port = HDR_TCP.dest_port = htons(139);
|
|
|
|
memcpy(newdata+offset, &HDR_IP, sizeof(HDR_IP));offset+=sizeof(HDR_IP);
|
|
memcpy(newdata+offset, &HDR_TCP, sizeof(HDR_TCP));offset+=sizeof(HDR_TCP);
|
|
memcpy(newdata+offset,data,length);
|
|
|
|
print_pcap_packet(out, newdata, newlen, actual_length+offset);
|
|
free(newdata);
|
|
}
|
|
|
|
unsigned char *curpacket = NULL;
|
|
unsigned short curpacket_len = 0;
|
|
long line_num = 0;
|
|
|
|
/* Read the log message produced by lib/util.c:show_msg() containing the:
|
|
* SMB_HEADER
|
|
* SMB_PARAMETERS
|
|
* SMB_DATA.ByteCount
|
|
*
|
|
* Example:
|
|
* [2007/04/08 20:41:39, 5] lib/util.c:show_msg(516)
|
|
* size=144
|
|
* smb_com=0x73
|
|
* smb_rcls=0
|
|
* smb_reh=0
|
|
* smb_err=0
|
|
* smb_flg=136
|
|
* smb_flg2=49153
|
|
* smb_tid=1
|
|
* smb_pid=65279
|
|
* smb_uid=0
|
|
* smb_mid=64
|
|
* smt_wct=3
|
|
* smb_vwv[ 0]= 117 (0x75)
|
|
* smb_vwv[ 1]= 128 (0x80)
|
|
* smb_vwv[ 2]= 1 (0x1)
|
|
* smb_bcc=87
|
|
*/
|
|
static void read_log_msg(FILE *in, unsigned char **_buffer,
|
|
unsigned short *buffersize, long *data_offset,
|
|
long *data_length)
|
|
{
|
|
unsigned char *buffer;
|
|
int tmp; long i;
|
|
assert(fscanf(in, " size=%hu\n", buffersize)); line_num++;
|
|
buffer = (unsigned char *)malloc(*buffersize+4); /* +4 for NBSS Header */
|
|
memset(buffer, 0, *buffersize+4);
|
|
/* NetBIOS Session Service */
|
|
buffer[0] = 0x00;
|
|
buffer[1] = 0x00;
|
|
memcpy(buffer+2, &buffersize, 2); /* TODO: need to copy as little-endian regardless of platform */
|
|
/* SMB Packet */
|
|
buffer[4] = 0xFF;
|
|
buffer[5] = 'S';
|
|
buffer[6] = 'M';
|
|
buffer[7] = 'B';
|
|
assert(fscanf(in, " smb_com=0x%x\n", &tmp)); buffer[smb_com] = tmp; line_num++;
|
|
assert(fscanf(in, " smb_rcls=%d\n", &tmp)); buffer[smb_rcls] = tmp; line_num++;
|
|
assert(fscanf(in, " smb_reh=%d\n", &tmp)); buffer[smb_reh] = tmp; line_num++;
|
|
assert(fscanf(in, " smb_err=%d\n", &tmp)); memcpy(buffer+smb_err, &tmp, 2); line_num++;
|
|
assert(fscanf(in, " smb_flg=%d\n", &tmp)); buffer[smb_flg] = tmp; line_num++;
|
|
assert(fscanf(in, " smb_flg2=%d\n", &tmp)); memcpy(buffer+smb_flg2, &tmp, 2); line_num++;
|
|
assert(fscanf(in, " smb_tid=%d\n", &tmp)); memcpy(buffer+smb_tid, &tmp, 2); line_num++;
|
|
assert(fscanf(in, " smb_pid=%d\n", &tmp)); memcpy(buffer+smb_pid, &tmp, 2); line_num++;
|
|
assert(fscanf(in, " smb_uid=%d\n", &tmp)); memcpy(buffer+smb_uid, &tmp, 2); line_num++;
|
|
assert(fscanf(in, " smb_mid=%d\n", &tmp)); memcpy(buffer+smb_mid, &tmp, 2); line_num++;
|
|
assert(fscanf(in, " smt_wct=%d\n", &tmp)); buffer[smb_wct] = tmp; line_num++;
|
|
for(i = 0; i < buffer[smb_wct]; i++) {
|
|
assert(fscanf(in, " smb_vwv[%*3d]=%*5d (0x%X)\n", &tmp)); line_num++;
|
|
memcpy(buffer+smb_vwv+i*2, &tmp, 2);
|
|
}
|
|
|
|
*data_offset = smb_vwv+buffer[smb_wct]*2;
|
|
assert(fscanf(in, " smb_bcc=%ld\n", data_length)); buffer[(*data_offset)] = *data_length; line_num++;
|
|
(*data_offset)+=2;
|
|
*_buffer = buffer;
|
|
}
|
|
|
|
/* Read the log message produced by lib/util.c:dump_data() containing:
|
|
* SMB_DATA.Bytes
|
|
*
|
|
* Example:
|
|
* [2007/04/08 20:41:39, 10] lib/util.c:dump_data(2243)
|
|
* [000] 00 55 00 6E 00 69 00 78 00 00 00 53 00 61 00 6D .U.n.i.x ...S.a.m
|
|
* [010] 00 62 00 61 00 20 00 33 00 2E 00 30 00 2E 00 32 .b.a. .3 ...0...2
|
|
* [020] 00 34 00 2D 00 49 00 73 00 69 00 6C 00 6F 00 6E .4.-.I.s .i.l.o.n
|
|
* [030] 00 20 00 4F 00 6E 00 65 00 46 00 53 00 20 00 76 . .O.n.e .F.S. .v
|
|
* [040] 00 34 00 2E 00 30 00 00 00 49 00 53 00 49 00 4C .4...0.. .I.S.I.L
|
|
* [050] 00 4F 00 4E 00 00 00 .O.N...
|
|
*/
|
|
static long read_log_data(FILE *in, unsigned char *buffer, long data_length)
|
|
{
|
|
long i, addr; char real[2][16]; int ret;
|
|
unsigned int tmp;
|
|
for(i = 0; i < data_length; i++) {
|
|
if(i % 16 == 0){
|
|
if(i != 0) {
|
|
/* Read and discard the ascii data after each line. */
|
|
assert(fscanf(in, " %8c %8c\n", real[0], real[1]) == 2);
|
|
}
|
|
ret = fscanf(in, " [%03lX]", &addr); line_num++;
|
|
if(!ret) {
|
|
if(!quiet)
|
|
fprintf(stderr, "%ld: Only first %ld bytes are logged, "
|
|
"packet trace will be incomplete\n", line_num, i-1);
|
|
return i-1;
|
|
}
|
|
assert(addr == i);
|
|
}
|
|
if(!fscanf(in, "%02X", &tmp)) {
|
|
if(!quiet)
|
|
fprintf(stderr, "%ld: Log message formatted incorrectly. "
|
|
"Only first %ld bytes are logged, packet trace will "
|
|
"be incomplete\n", line_num, i-1);
|
|
while ((tmp = getc(in)) != '\n');
|
|
return i-1;
|
|
}
|
|
buffer[i] = tmp;
|
|
}
|
|
|
|
/* Consume the newline so we don't increment num_lines twice */
|
|
while ((tmp = getc(in)) != '\n');
|
|
return data_length;
|
|
}
|
|
|
|
int main(int argc, const char **argv)
|
|
{
|
|
const char *infile, *outfile;
|
|
FILE *out, *in;
|
|
int opt;
|
|
poptContext pc;
|
|
char buffer[4096];
|
|
long data_offset = 0;
|
|
long data_length = 0;
|
|
long data_bytes_read = 0;
|
|
size_t in_packet = 0;
|
|
struct poptOption long_options[] = {
|
|
POPT_AUTOHELP
|
|
{
|
|
.longName = "quiet",
|
|
.shortName = 'q',
|
|
.argInfo = POPT_ARG_NONE,
|
|
.arg = &quiet,
|
|
.val = 0,
|
|
.descrip = "Be quiet, don't output warnings",
|
|
},
|
|
{
|
|
.longName = "hex",
|
|
.shortName = 'h',
|
|
.argInfo = POPT_ARG_NONE,
|
|
.arg = &hexformat,
|
|
.val = 0,
|
|
.descrip = "Output format readable by text2pcap",
|
|
},
|
|
POPT_TABLEEND
|
|
};
|
|
|
|
pc = poptGetContext(NULL, argc, argv, long_options,
|
|
POPT_CONTEXT_KEEP_FIRST);
|
|
poptSetOtherOptionHelp(pc, "[<infile> [<outfile>]]");
|
|
|
|
|
|
while((opt = poptGetNextOpt(pc)) != -1) {
|
|
switch (opt) {
|
|
}
|
|
}
|
|
|
|
poptGetArg(pc); /* Drop argv[0], the program name */
|
|
|
|
infile = poptGetArg(pc);
|
|
|
|
if(infile) {
|
|
in = fopen(infile, "r");
|
|
if(!in) {
|
|
perror("fopen");
|
|
poptFreeContext(pc);
|
|
return 1;
|
|
}
|
|
} else in = stdin;
|
|
|
|
outfile = poptGetArg(pc);
|
|
|
|
if(outfile) {
|
|
out = fopen(outfile, "w+");
|
|
if(!out) {
|
|
perror("fopen");
|
|
fprintf(stderr, "Can't find %s, using stdout...\n", outfile);
|
|
poptFreeContext(pc);
|
|
return 1;
|
|
}
|
|
}
|
|
|
|
if(!outfile) out = stdout;
|
|
|
|
if(!hexformat)print_pcap_header(out);
|
|
|
|
while(!feof(in)) {
|
|
char *p;
|
|
p = fgets(buffer, sizeof(buffer), in);
|
|
if (p == NULL) {
|
|
fprintf(stderr, "error reading from input file\n");
|
|
break;
|
|
}
|
|
line_num++;
|
|
if(buffer[0] == '[') { /* Header */
|
|
if(strstr(buffer, "show_msg")) {
|
|
in_packet++;
|
|
if(in_packet == 1)continue;
|
|
read_log_msg(in, &curpacket, &curpacket_len, &data_offset, &data_length);
|
|
} else if(in_packet && strstr(buffer, "dump_data")) {
|
|
data_bytes_read = read_log_data(in, curpacket+data_offset, data_length);
|
|
} else {
|
|
if(in_packet){
|
|
if(hexformat) print_hex_packet(out, curpacket, curpacket_len);
|
|
else print_netbios_packet(out, curpacket, curpacket_len, data_bytes_read+data_offset);
|
|
free(curpacket);
|
|
}
|
|
in_packet = 0;
|
|
}
|
|
}
|
|
}
|
|
|
|
if (in != stdin) {
|
|
fclose(in);
|
|
}
|
|
|
|
if (out != stdout) {
|
|
fclose(out);
|
|
}
|
|
|
|
poptFreeContext(pc);
|
|
return 0;
|
|
}
|