1 /*
2 Unix SMB/CIFS implementation.
3 Utility to extract pcap files from samba (log level 10) log files
4
5 Copyright (C) Jelmer Vernooij 2003
6 Thanks to Tim Potter for the genial idea
7
8 Portions (from capconvert.c) (C) Andrew Tridgell 1997
9 Portions (from text2pcap.c) (C) Ashok Narayanan 2001
10
11 Example:
12 Output NBSS(SMB) packets in hex and convert to pcap adding
13 Eth/IP/TCP headers
14
15 log2pcap -h < samba.log | text2pcap -T 139,139 - samba.pcap
16
17 Output directly to pcap format without Eth headers or TCP
18 sequence numbers
19
20 log2pcap samba.log samba.pcap
21
22 TODO:
23 - Hex to text2pcap outputs are not properly parsed in Wireshark
24 the NBSS or SMB level. This is a bug.
25 - Writing directly to pcap format doesn't include sequence numbers
26 in the TCP packets
27 - Check if a packet is a response or request and set IP to/from
28 addresses accordingly. Currently all packets come from the same
29 dummy IP and go to the same dummy IP
30 - Add a message when done parsing about the number of pacekts
31 processed
32 - Parse NBSS packet header data from log file
33 - Have correct IP and TCP checksums.
34
35 Warning:
36 Samba log level 10 outputs a max of 512 bytes from the packet data
37 section. Packets larger than this will be truncated.
38
39 This program is free software; you can redistribute it and/or modify
40 it under the terms of the GNU General Public License as published by
41 the Free Software Foundation; either version 3 of the License, or
42 (at your option) any later version.
43
44 This program is distributed in the hope that it will be useful,
45 but WITHOUT ANY WARRANTY; without even the implied warranty of
46 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
47 GNU General Public License for more details.
48
49 You should have received a copy of the GNU General Public License
50 along with this program. If not, see <http://www.gnu.org/licenses/>.
51 */
52
53 #include "includes.h"
54 #include "popt_common.h"
55
56 /* We don't care about the paranoid malloc checker in this standalone
57 program */
58 #undef malloc
59
60 #include <assert.h>
61
62 int quiet = 0;
63 int hexformat = 0;
64
65 #define itoa(a) ((a) < 0xa?'0'+(a):'A' + (a-0xa))
66
67 #include <stdlib.h>
68 #include <unistd.h>
69 #include <sys/time.h>
70 #include <stdio.h>
71 #include <fcntl.h>
72
73 #define TCPDUMP_MAGIC 0xa1b2c3d4
74
75 /* tcpdump file format */
76 struct tcpdump_file_header {
77 uint32_t magic;
78 uint16_t major;
79 uint16_t minor;
80 int32_t zone;
81 uint32_t sigfigs;
82 uint32_t snaplen;
83 uint32_t linktype;
84 };
85
86 struct tcpdump_packet {
87 struct timeval ts;
88 uint32_t caplen;
89 uint32_t len;
90 };
91
92 typedef struct {
93 uint8_t ver_hdrlen;
94 uint8_t dscp;
95 uint16_t packet_length;
96 uint16_t identification;
97 uint8_t flags;
98 uint8_t fragment;
99 uint8_t ttl;
100 uint8_t protocol;
101 uint16_t hdr_checksum;
102 uint32_t src_addr;
103 uint32_t dest_addr;
104 } hdr_ip_t;
105
106 static hdr_ip_t HDR_IP = {0x45, 0, 0, 0x3412, 0, 0, 0xff, 6, 0, 0x01010101, 0x02020202};
107
108 typedef struct {
109 uint16_t source_port;
110 uint16_t dest_port;
111 uint32_t seq_num;
112 uint32_t ack_num;
113 uint8_t hdr_length;
114 uint8_t flags;
115 uint16_t window;
116 uint16_t checksum;
117 uint16_t urg;
118 } hdr_tcp_t;
119
120 static hdr_tcp_t HDR_TCP = {139, 139, 0, 0, 0x50, 0, 0, 0, 0};
121
print_pcap_header(FILE * out)122 static void print_pcap_header(FILE *out)
123 {
124 struct tcpdump_file_header h;
125 h.magic = TCPDUMP_MAGIC;
126 h.major = 2;
127 h.minor = 4;
128 h.zone = 0;
129 h.sigfigs = 0;
130 h.snaplen = 102400; /* As long packets as possible */
131 h.linktype = 101; /* Raw IP */
132 fwrite(&h, sizeof(struct tcpdump_file_header), 1, out);
133 }
134
print_pcap_packet(FILE * out,unsigned char * data,long length,long caplen)135 static void print_pcap_packet(FILE *out, unsigned char *data, long length,
136 long caplen)
137 {
138 static int i = 0;
139 struct tcpdump_packet p;
140 i++;
141 p.ts.tv_usec = 0;
142 p.ts.tv_sec = 0;
143 p.caplen = caplen;
144 p.len = length;
145 fwrite(&p, sizeof(struct tcpdump_packet), 1, out);
146 fwrite(data, sizeof(unsigned char), caplen, out);
147 }
148
print_hex_packet(FILE * out,unsigned char * data,long length)149 static void print_hex_packet(FILE *out, unsigned char *data, long length)
150 {
151 long i,cur = 0;
152 while(cur < length) {
153 fprintf(out, "%06lX ", cur);
154 for(i = cur; i < length && i < cur + 16; i++) {
155 fprintf(out, "%02x ", data[i]);
156 }
157 cur = i;
158 fprintf(out, "\n");
159 }
160 }
161
print_netbios_packet(FILE * out,unsigned char * data,long length,long actual_length)162 static void print_netbios_packet(FILE *out, unsigned char *data, long length,
163 long actual_length)
164 {
165 unsigned char *newdata; long offset = 0;
166 long newlen;
167
168 newlen = length+sizeof(HDR_IP)+sizeof(HDR_TCP);
169 newdata = (unsigned char *)malloc(newlen);
170
171 HDR_IP.packet_length = htons(newlen);
172 HDR_TCP.window = htons(0x2000);
173 HDR_TCP.source_port = HDR_TCP.dest_port = htons(139);
174
175 memcpy(newdata+offset, &HDR_IP, sizeof(HDR_IP));offset+=sizeof(HDR_IP);
176 memcpy(newdata+offset, &HDR_TCP, sizeof(HDR_TCP));offset+=sizeof(HDR_TCP);
177 memcpy(newdata+offset,data,length);
178
179 print_pcap_packet(out, newdata, newlen, actual_length+offset);
180 free(newdata);
181 }
182
183 unsigned char *curpacket = NULL;
184 unsigned short curpacket_len = 0;
185 long line_num = 0;
186
187 /* Read the log message produced by lib/util.c:show_msg() containing the:
188 * SMB_HEADER
189 * SMB_PARAMETERS
190 * SMB_DATA.ByteCount
191 *
192 * Example:
193 * [2007/04/08 20:41:39, 5] lib/util.c:show_msg(516)
194 * size=144
195 * smb_com=0x73
196 * smb_rcls=0
197 * smb_reh=0
198 * smb_err=0
199 * smb_flg=136
200 * smb_flg2=49153
201 * smb_tid=1
202 * smb_pid=65279
203 * smb_uid=0
204 * smb_mid=64
205 * smt_wct=3
206 * smb_vwv[ 0]= 117 (0x75)
207 * smb_vwv[ 1]= 128 (0x80)
208 * smb_vwv[ 2]= 1 (0x1)
209 * smb_bcc=87
210 */
read_log_msg(FILE * in,unsigned char ** _buffer,unsigned short * buffersize,long * data_offset,long * data_length)211 static void read_log_msg(FILE *in, unsigned char **_buffer,
212 unsigned short *buffersize, long *data_offset,
213 long *data_length)
214 {
215 unsigned char *buffer;
216 int tmp; long i;
217 assert(fscanf(in, " size=%hu\n", buffersize)); line_num++;
218 buffer = (unsigned char *)malloc(*buffersize+4); /* +4 for NBSS Header */
219 memset(buffer, 0, *buffersize+4);
220 /* NetBIOS Session Service */
221 buffer[0] = 0x00;
222 buffer[1] = 0x00;
223 memcpy(buffer+2, &buffersize, 2); /* TODO: need to copy as little-endian regardless of platform */
224 /* SMB Packet */
225 buffer[4] = 0xFF;
226 buffer[5] = 'S';
227 buffer[6] = 'M';
228 buffer[7] = 'B';
229 assert(fscanf(in, " smb_com=0x%x\n", &tmp)); buffer[smb_com] = tmp; line_num++;
230 assert(fscanf(in, " smb_rcls=%d\n", &tmp)); buffer[smb_rcls] = tmp; line_num++;
231 assert(fscanf(in, " smb_reh=%d\n", &tmp)); buffer[smb_reh] = tmp; line_num++;
232 assert(fscanf(in, " smb_err=%d\n", &tmp)); memcpy(buffer+smb_err, &tmp, 2); line_num++;
233 assert(fscanf(in, " smb_flg=%d\n", &tmp)); buffer[smb_flg] = tmp; line_num++;
234 assert(fscanf(in, " smb_flg2=%d\n", &tmp)); memcpy(buffer+smb_flg2, &tmp, 2); line_num++;
235 assert(fscanf(in, " smb_tid=%d\n", &tmp)); memcpy(buffer+smb_tid, &tmp, 2); line_num++;
236 assert(fscanf(in, " smb_pid=%d\n", &tmp)); memcpy(buffer+smb_pid, &tmp, 2); line_num++;
237 assert(fscanf(in, " smb_uid=%d\n", &tmp)); memcpy(buffer+smb_uid, &tmp, 2); line_num++;
238 assert(fscanf(in, " smb_mid=%d\n", &tmp)); memcpy(buffer+smb_mid, &tmp, 2); line_num++;
239 assert(fscanf(in, " smt_wct=%d\n", &tmp)); buffer[smb_wct] = tmp; line_num++;
240 for(i = 0; i < buffer[smb_wct]; i++) {
241 assert(fscanf(in, " smb_vwv[%*3d]=%*5d (0x%X)\n", &tmp)); line_num++;
242 memcpy(buffer+smb_vwv+i*2, &tmp, 2);
243 }
244
245 *data_offset = smb_vwv+buffer[smb_wct]*2;
246 assert(fscanf(in, " smb_bcc=%ld\n", data_length)); buffer[(*data_offset)] = *data_length; line_num++;
247 (*data_offset)+=2;
248 *_buffer = buffer;
249 }
250
251 /* Read the log message produced by lib/util.c:dump_data() containing:
252 * SMB_DATA.Bytes
253 *
254 * Example:
255 * [2007/04/08 20:41:39, 10] lib/util.c:dump_data(2243)
256 * [000] 00 55 00 6E 00 69 00 78 00 00 00 53 00 61 00 6D .U.n.i.x ...S.a.m
257 * [010] 00 62 00 61 00 20 00 33 00 2E 00 30 00 2E 00 32 .b.a. .3 ...0...2
258 * [020] 00 34 00 2D 00 49 00 73 00 69 00 6C 00 6F 00 6E .4.-.I.s .i.l.o.n
259 * [030] 00 20 00 4F 00 6E 00 65 00 46 00 53 00 20 00 76 . .O.n.e .F.S. .v
260 * [040] 00 34 00 2E 00 30 00 00 00 49 00 53 00 49 00 4C .4...0.. .I.S.I.L
261 * [050] 00 4F 00 4E 00 00 00 .O.N...
262 */
read_log_data(FILE * in,unsigned char * buffer,long data_length)263 static long read_log_data(FILE *in, unsigned char *buffer, long data_length)
264 {
265 long i, addr; char real[2][16]; int ret;
266 unsigned int tmp;
267 for(i = 0; i < data_length; i++) {
268 if(i % 16 == 0){
269 if(i != 0) {
270 /* Read and discard the ascii data after each line. */
271 assert(fscanf(in, " %8c %8c\n", real[0], real[1]) == 2);
272 }
273 ret = fscanf(in, " [%03lX]", &addr); line_num++;
274 if(!ret) {
275 if(!quiet)
276 fprintf(stderr, "%ld: Only first %ld bytes are logged, "
277 "packet trace will be incomplete\n", line_num, i-1);
278 return i-1;
279 }
280 assert(addr == i);
281 }
282 if(!fscanf(in, "%02X", &tmp)) {
283 if(!quiet)
284 fprintf(stderr, "%ld: Log message formatted incorrectly. "
285 "Only first %ld bytes are logged, packet trace will "
286 "be incomplete\n", line_num, i-1);
287 while ((tmp = getc(in)) != '\n');
288 return i-1;
289 }
290 buffer[i] = tmp;
291 }
292
293 /* Consume the newline so we don't increment num_lines twice */
294 while ((tmp = getc(in)) != '\n');
295 return data_length;
296 }
297
main(int argc,const char ** argv)298 int main(int argc, const char **argv)
299 {
300 const char *infile, *outfile;
301 FILE *out, *in;
302 int opt;
303 poptContext pc;
304 char buffer[4096];
305 long data_offset = 0;
306 long data_length = 0;
307 long data_bytes_read = 0;
308 size_t in_packet = 0;
309 struct poptOption long_options[] = {
310 POPT_AUTOHELP
311 {
312 .longName = "quiet",
313 .shortName = 'q',
314 .argInfo = POPT_ARG_NONE,
315 .arg = &quiet,
316 .val = 0,
317 .descrip = "Be quiet, don't output warnings",
318 },
319 {
320 .longName = "hex",
321 .shortName = 'h',
322 .argInfo = POPT_ARG_NONE,
323 .arg = &hexformat,
324 .val = 0,
325 .descrip = "Output format readable by text2pcap",
326 },
327 POPT_TABLEEND
328 };
329
330 pc = poptGetContext(NULL, argc, argv, long_options,
331 POPT_CONTEXT_KEEP_FIRST);
332 poptSetOtherOptionHelp(pc, "[<infile> [<outfile>]]");
333
334
335 while((opt = poptGetNextOpt(pc)) != -1) {
336 switch (opt) {
337 }
338 }
339
340 poptGetArg(pc); /* Drop argv[0], the program name */
341
342 infile = poptGetArg(pc);
343
344 if(infile) {
345 in = fopen(infile, "r");
346 if(!in) {
347 perror("fopen");
348 poptFreeContext(pc);
349 return 1;
350 }
351 } else in = stdin;
352
353 outfile = poptGetArg(pc);
354
355 if(outfile) {
356 out = fopen(outfile, "w+");
357 if(!out) {
358 perror("fopen");
359 fprintf(stderr, "Can't find %s, using stdout...\n", outfile);
360 poptFreeContext(pc);
361 return 1;
362 }
363 }
364
365 if(!outfile) out = stdout;
366
367 if(!hexformat)print_pcap_header(out);
368
369 while(!feof(in)) {
370 char *p;
371 p = fgets(buffer, sizeof(buffer), in);
372 if (p == NULL) {
373 fprintf(stderr, "error reading from input file\n");
374 break;
375 }
376 line_num++;
377 if(buffer[0] == '[') { /* Header */
378 if(strstr(buffer, "show_msg")) {
379 in_packet++;
380 if(in_packet == 1)continue;
381 read_log_msg(in, &curpacket, &curpacket_len, &data_offset, &data_length);
382 } else if(in_packet && strstr(buffer, "dump_data")) {
383 data_bytes_read = read_log_data(in, curpacket+data_offset, data_length);
384 } else {
385 if(in_packet){
386 if(hexformat) print_hex_packet(out, curpacket, curpacket_len);
387 else print_netbios_packet(out, curpacket, curpacket_len, data_bytes_read+data_offset);
388 free(curpacket);
389 }
390 in_packet = 0;
391 }
392 }
393 }
394
395 if (in != stdin) {
396 fclose(in);
397 }
398
399 if (out != stdout) {
400 fclose(out);
401 }
402
403 poptFreeContext(pc);
404 return 0;
405 }
406