18 |
and/or other materials provided with the distribution. |
and/or other materials provided with the distribution. |
19 |
|
|
20 |
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND |
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND |
21 |
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED |
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED |
22 |
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE |
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE |
23 |
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR |
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR |
24 |
ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES |
ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES |
25 |
(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; |
(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; |
26 |
LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND |
LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND |
27 |
ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT |
ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT |
28 |
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS |
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS |
29 |
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
30 |
*/ |
*/ |
31 |
|
|
32 |
#include <errno.h> |
#include <errno.h> |
33 |
|
#include <stdbool.h> |
34 |
#include <stdio.h> |
#include <stdio.h> |
35 |
#include <stdlib.h> |
#include <stdlib.h> |
36 |
#include <string.h> |
#include <string.h> |
37 |
#include <time.h> |
#include <time.h> |
38 |
#include <unistd.h> |
#include <unistd.h> |
39 |
|
|
40 |
const char * progname = NULL; |
const char *progname = NULL; |
41 |
const char * filename = NULL; |
const char *filename = NULL; |
42 |
FILE *file = NULL; |
FILE *file = NULL; |
43 |
|
bool follow_specification = false; |
44 |
|
|
45 |
int main(int argc, char **argv) |
int main(int argc, char **argv) |
46 |
{ |
{ |
47 |
void show_usage(int exitcode); |
void show_usage(int exitcode); |
48 |
void show_version(void); |
void show_version(void); |
49 |
void decode_file(void); |
void decode_file(void); |
50 |
|
|
51 |
int i; |
int i; |
52 |
|
|
53 |
progname = argv[0]; |
progname = argv[0]; |
54 |
|
|
55 |
opterr = 0; |
opterr = 0; |
56 |
while ( (i = getopt(argc, argv, "hv")) != -1) { |
while ( (i = getopt(argc, argv, "fhv")) != -1) { |
57 |
switch (i) { |
switch (i) { |
58 |
|
case 'f': |
59 |
|
follow_specification = !follow_specification; |
60 |
|
break; |
61 |
|
|
62 |
case 'h': |
case 'h': |
63 |
show_usage(EXIT_SUCCESS); |
show_usage(EXIT_SUCCESS); |
64 |
break; |
break; |
65 |
|
|
66 |
case 'v': |
case 'v': |
67 |
show_version(); |
show_version(); |
68 |
break; |
break; |
69 |
|
|
70 |
case '?': |
case '?': |
71 |
/*FALLTHROUGH*/ |
/*FALLTHROUGH*/ |
72 |
default: |
default: |
73 |
fprintf(stderr, "%s: illegal option -%c\n\n", progname, optopt); |
fprintf(stderr, "%s: illegal option -%c\n\n", progname, optopt); |
74 |
show_usage(EXIT_FAILURE); |
show_usage(EXIT_FAILURE); |
75 |
break; |
break; |
76 |
} // switch |
} // switch |
81 |
if (argv[0] == NULL) { |
if (argv[0] == NULL) { |
82 |
fprintf(stderr, "%s: missing filename\n\n", progname); |
fprintf(stderr, "%s: missing filename\n\n", progname); |
83 |
show_usage(EXIT_FAILURE); |
show_usage(EXIT_FAILURE); |
84 |
} // if |
} // if |
85 |
|
|
86 |
filename = argv[0]; |
filename = argv[0]; |
87 |
|
|
88 |
decode_file(); |
decode_file(); |
89 |
|
|
90 |
return EXIT_SUCCESS; |
return EXIT_SUCCESS; |
91 |
} // main() |
} // main() |
92 |
|
|
93 |
void show_usage(int exitcode) |
void show_usage(int exitcode) |
94 |
{ |
{ |
95 |
fprintf((exitcode == EXIT_SUCCESS) ? stdout : stderr, |
fprintf((exitcode == EXIT_SUCCESS) ? stdout : stderr, |
96 |
"Usage: %s [-h] [-v] filename\n" |
"Usage: %s [-f] [-h] [-v] filename\n" |
97 |
" E.g.: %s darkstat.db\n", |
" E.g.: %s darkstat.db\n\n" |
98 |
|
|
99 |
|
"Options:\n" |
100 |
|
"-f\tToggle follow strict specification, default is false.\n" |
101 |
|
"-h\tShow this help message and exit.\n" |
102 |
|
"-v\tShow version and copyright and exit.\n", |
103 |
progname, progname); |
progname, progname); |
104 |
|
|
105 |
exit(exitcode); |
exit(exitcode); |
106 |
} // show_usage() |
} // show_usage() |
107 |
|
|
108 |
void show_version(void) |
void show_version(void) |
109 |
{ |
{ |
110 |
puts("darkstattype 1.0"); |
puts("darkstattype 1.0"); |
111 |
puts("$Ximalas$"); |
puts("$Ximalas$"); |
112 |
puts(""); |
puts(""); |
113 |
|
|
114 |
puts("Copyright © 2014, Trond Endrestøl <Trond.Endrestol@ximalas.info>"); |
puts("Copyright © 2014, Trond Endrestøl <Trond.Endrestol@ximalas.info>"); |
115 |
puts("All rights reserved."); |
puts("All rights reserved."); |
116 |
puts(""); |
puts(""); |
117 |
puts("Redistribution and use in source and binary forms, with or without"); |
puts("Redistribution and use in source and binary forms, with or without"); |
163 |
void decode_file(void) |
void decode_file(void) |
164 |
{ |
{ |
165 |
void decode_host_db_v1(void); |
void decode_host_db_v1(void); |
166 |
void decode_graph_db_v1(void); |
void decode_graph_db_v1(void); |
167 |
|
|
168 |
unsigned int fileheader; |
unsigned int fileheader; |
169 |
unsigned int sectionheader; |
unsigned int sectionheader; |
170 |
|
|
171 |
unsigned int i; |
unsigned int i; |
172 |
|
|
173 |
if ( (file = fopen(filename, "rb")) == NULL) { |
if ( (file = fopen(filename, "rb")) == NULL) { |
174 |
fprintf(stderr, "%s: fopen(\"%s\") = %s (%d)\n", progname, filename, strerror(errno), errno); |
fprintf(stderr, "%s: fopen(\"%s\") = %s (%d)\n", progname, filename, strerror(errno), errno); |
175 |
exit(EXIT_FAILURE); |
exit(EXIT_FAILURE); |
176 |
} // if |
} // if |
177 |
|
|
178 |
if ( (fileheader = read32u()) != 0xDA314159U) { // not darkstat export format |
#define FILE_HEADER_V1 0xDA314159U |
179 |
fprintf(stderr, "%s:%s: file header = 0x%x, not 0x%x\n", progname, filename, fileheader, 0xDA314159U); |
|
180 |
|
if ( (fileheader = read32u()) != FILE_HEADER_V1) { // not darkstat export format |
181 |
|
fprintf(stderr, "%s:%s:%ld: file header = 0x%x, not 0x%x\n", progname, filename, ftell(file), fileheader, FILE_HEADER_V1); |
182 |
exit(EXIT_FAILURE); |
exit(EXIT_FAILURE); |
183 |
} // if |
} // if |
184 |
|
|
185 |
printf("File header 0x%x\n", fileheader); |
printf("File header 0x%x\n", fileheader); |
186 |
|
|
187 |
// Possible section header for host_db v1 and later graph_db v1. |
// Possible section header for host_db v1 and later graph_db v1. |
188 |
indent(); |
indent(); |
189 |
|
|
190 |
|
#define HOST_DB_V1 0xDA485301U |
191 |
|
#define GRAPH_DB_V1 0xDA475201U |
192 |
|
|
193 |
for (i = 0; i < 2; i++) { |
for (i = 0; i < 2; i++) { |
194 |
if ( (sectionheader = read32u()) == 0xDA485301U) { |
if ( (sectionheader = read32u()) == HOST_DB_V1) { |
195 |
print_indentation(); |
print_indentation(); |
196 |
printf("Section header 0x%x\n", sectionheader); |
printf("Section header host_db v1 0x%x\n", sectionheader); |
197 |
decode_host_db_v1(); |
decode_host_db_v1(); |
198 |
} // if |
} // if |
199 |
else if (sectionheader == 0xDA475201U) { |
else if (sectionheader == GRAPH_DB_V1) { |
200 |
print_indentation(); |
print_indentation(); |
201 |
printf("Section header 0x%x\n", sectionheader); |
printf("Section header graph_db v1 0x%x\n", sectionheader); |
202 |
decode_graph_db_v1(); |
decode_graph_db_v1(); |
203 |
} // else if |
} // else if |
204 |
else { |
else { |
205 |
fprintf(stderr, "%s:%s: unknown section header = 0x%x, neither 0x%x nor 0x%x\n", progname, filename, sectionheader, 0xDA485301U, 0xDA475201U); |
fprintf(stderr, "%s:%s:%ld: unknown section header = 0x%x, neither 0x%x nor 0x%x\n", progname, filename, ftell(file), sectionheader, HOST_DB_V1, GRAPH_DB_V1); |
206 |
exit(EXIT_FAILURE); |
exit(EXIT_FAILURE); |
207 |
} // else |
} // else |
208 |
} // for |
} // for |
209 |
|
|
210 |
exdent(); |
exdent(); |
211 |
} // decode_file() |
} // decode_file() |
212 |
|
|
213 |
void decode_host_db_v1(void) |
void decode_host_db_v1(void) |
214 |
{ |
{ |
215 |
void decode_host_header_v1(void); |
void decode_host_header_v1(void); |
216 |
void decode_host_header_v2(void); |
void decode_host_header_v2(void); |
217 |
void decode_host_header_v3(void); |
void decode_host_header_v3(void); |
218 |
|
|
219 |
unsigned int hostcount; |
unsigned int hostcount; |
220 |
unsigned int i; |
unsigned int i; |
222 |
indent(); |
indent(); |
223 |
|
|
224 |
hostcount = read32u(); |
hostcount = read32u(); |
225 |
|
|
226 |
print_indentation(); |
print_indentation(); |
227 |
printf("Host count %u\n", hostcount); |
printf("Host count %u\n", hostcount); |
228 |
|
|
229 |
for (i = 0; i < hostcount; i++) { |
for (i = 0; i < hostcount; i++) { |
230 |
unsigned int hostheader; |
unsigned int hostheader; |
231 |
|
|
232 |
print_indentation(); |
print_indentation(); |
233 |
printf("Host #%u of %u:\n", i + 1, hostcount); |
printf("Host #%u of %u:\n", i + 1, hostcount); |
234 |
|
|
235 |
indent(); |
indent(); |
236 |
|
|
237 |
if ( (hostheader = read32u()) == 0x48535403U) { // host header v3 |
#define HOST_HEADER_V3 0x48535403U |
238 |
|
#define HOST_HEADER_V2 0x48535402U |
239 |
|
#define HOST_HEADER_V1 0x48535401U |
240 |
|
|
241 |
|
if ( (hostheader = read32u()) == HOST_HEADER_V3) { // host header v3 |
242 |
print_indentation(); |
print_indentation(); |
243 |
printf("Host header v3 0x%x\n", hostheader); |
printf("Host header v3 0x%x\n", hostheader); |
244 |
decode_host_header_v3(); |
decode_host_header_v3(); |
245 |
} // if |
} // if |
246 |
else if (hostheader == 0x48535402U) { // host header v2 |
else if (hostheader == HOST_HEADER_V2) { // host header v2 |
247 |
print_indentation(); |
print_indentation(); |
248 |
printf("Host header v2 0x%x\n", hostheader); |
printf("Host header v2 0x%x\n", hostheader); |
249 |
decode_host_header_v2(); |
decode_host_header_v2(); |
250 |
} // else if |
} // else if |
251 |
else if (hostheader == 0x48535401U) { // host header v1 |
else if (hostheader == HOST_HEADER_V1) { // host header v1 |
252 |
print_indentation(); |
print_indentation(); |
253 |
printf("Host header v1 0x%x\n", hostheader); |
printf("Host header v1 0x%x\n", hostheader); |
254 |
decode_host_header_v1(); |
decode_host_header_v1(); |
255 |
} // else if |
} // else if |
256 |
else { // unknown host header version |
else { // unknown host header version |
257 |
fprintf(stderr, "%s:%s: unknown host header = 0x%x, neither 0x%x nor 0x%x nor 0x%x\n", progname, filename, hostheader, 0x48535403U, 0x48535402U, 0x48535401U); |
fprintf(stderr, "%s:%s:%ld: unknown host header = 0x%x, neither 0x%x nor 0x%x nor 0x%x\n", progname, filename, ftell(file), hostheader, HOST_HEADER_V3, HOST_HEADER_V2, HOST_HEADER_V1); |
258 |
exit(EXIT_FAILURE); |
exit(EXIT_FAILURE); |
259 |
} // else |
} // else |
260 |
|
|
261 |
exdent(); |
exdent(); |
262 |
} // for |
} // for |
263 |
|
|
264 |
exdent(); |
exdent(); |
265 |
} // decode_host_db_v1() |
} // decode_host_db_v1() |
266 |
|
|
267 |
void decode_protos_data(void); |
void decode_protos_data(void); |
268 |
void decode_tcp_data(void); |
void decode_tcp_data(void); |
269 |
void decode_udp_data(void); |
void decode_udp_data(void); |
270 |
|
|
271 |
void decode_host_header_v1(void) |
void decode_host_header_v1(void) |
272 |
{ |
{ |
315 |
|
|
316 |
print_indentation(); |
print_indentation(); |
317 |
printf("Hostname %s\n", hostname); |
printf("Hostname %s\n", hostname); |
318 |
|
|
319 |
bytesin = read64u(); |
bytesin = read64u(); |
320 |
|
|
321 |
print_indentation(); |
print_indentation(); |
322 |
printf("Bytes in %lu\n", bytesin); |
printf("Bytes in %lu\n", bytesin); |
323 |
|
|
324 |
bytesout = read64u(); |
bytesout = read64u(); |
325 |
|
|
326 |
print_indentation(); |
print_indentation(); |
327 |
printf("Bytes out %lu\n", bytesout); |
printf("Bytes out %lu\n", bytesout); |
328 |
|
|
329 |
if ( (protosdata = read8u()) != 'P') { // missing protos data |
if ( (protosdata = read8u()) != 'P') { // missing protos data |
330 |
fprintf(stderr, "%s: expecting character P, not %c\n", progname, protosdata); |
fprintf(stderr, "%s:%s:%ld: expecting character P, not %c\n", progname, filename, ftell(file), protosdata); |
331 |
exit(EXIT_FAILURE); |
exit(EXIT_FAILURE); |
332 |
} // if |
} // if |
333 |
|
|
334 |
decode_protos_data(); |
decode_protos_data(); |
335 |
|
|
336 |
if ( (tcpdata = read8u()) != 'T') { // missing tcp data |
if ( (tcpdata = read8u()) != 'T') { // missing tcp data |
337 |
fprintf(stderr, "%s: expecting character T, not %c\n", progname, tcpdata); |
fprintf(stderr, "%s:%s:%ld: expecting character T, not %c\n", progname, filename, ftell(file), tcpdata); |
338 |
exit(EXIT_FAILURE); |
exit(EXIT_FAILURE); |
339 |
} // if |
} // if |
340 |
|
|
341 |
decode_tcp_data(); |
decode_tcp_data(); |
342 |
|
|
343 |
if ( (udpdata = read8u()) != 'U') { // missing udp data |
if ( (udpdata = read8u()) != 'U') { // missing udp data |
344 |
fprintf(stderr, "%s: expecting character U, not %c\n", progname, udpdata); |
fprintf(stderr, "%s:%s:%ld: expecting character U, not %c\n", progname, filename, ftell(file), udpdata); |
345 |
exit(EXIT_FAILURE); |
exit(EXIT_FAILURE); |
346 |
} // if |
} // if |
347 |
|
|
348 |
decode_udp_data(); |
decode_udp_data(); |
349 |
|
|
350 |
exdent(); |
exdent(); |
351 |
} // decode_host_header_v1 |
} // decode_host_header_v1 |
352 |
|
|
353 |
void decode_host_header_v2(void) |
void decode_host_header_v2(void) |
354 |
{ |
{ |
355 |
unsigned char ipv4address[4]; |
unsigned char ipv4address[4]; |
356 |
unsigned char macaddress[6]; |
unsigned char macaddress[6]; |
357 |
signed long lastseen; |
signed long lastseen; |
358 |
unsigned char hostnamelen; |
unsigned char hostnamelen; |
359 |
unsigned char hostname[256]; |
unsigned char hostname[256]; |
364 |
unsigned char udpdata; |
unsigned char udpdata; |
365 |
|
|
366 |
unsigned char i; |
unsigned char i; |
367 |
|
|
368 |
indent(); |
indent(); |
369 |
|
|
370 |
ipv4address[0] = read8u(); |
ipv4address[0] = read8u(); |
371 |
ipv4address[1] = read8u(); |
ipv4address[1] = read8u(); |
372 |
ipv4address[2] = read8u(); |
ipv4address[2] = read8u(); |
373 |
ipv4address[3] = read8u(); |
ipv4address[3] = read8u(); |
374 |
|
|
375 |
print_indentation(); |
print_indentation(); |
376 |
printf("IPv4 address %d.%d.%d.%d\n", |
printf("IPv4 address %d.%d.%d.%d\n", |
377 |
ipv4address[0], ipv4address[1], ipv4address[2], ipv4address[3]); |
ipv4address[0], ipv4address[1], ipv4address[2], ipv4address[3]); |
378 |
|
|
379 |
macaddress[0] = read8u(); |
if (follow_specification == true) { |
380 |
macaddress[1] = read8u(); |
macaddress[0] = read8u(); |
381 |
macaddress[2] = read8u(); |
macaddress[1] = read8u(); |
382 |
macaddress[3] = read8u(); |
macaddress[2] = read8u(); |
383 |
macaddress[4] = read8u(); |
macaddress[3] = read8u(); |
384 |
macaddress[5] = read8u(); |
macaddress[4] = read8u(); |
385 |
|
macaddress[5] = read8u(); |
386 |
|
|
387 |
print_indentation(); |
print_indentation(); |
388 |
printf("MAC address %02x:%02x:%02x:%02x:%02x:%02x\n", macaddress[0], macaddress[1], macaddress[2], macaddress[3], macaddress[4], macaddress[5]); |
printf("MAC address %02x:%02x:%02x:%02x:%02x:%02x\n", macaddress[0], macaddress[1], macaddress[2], macaddress[3], macaddress[4], macaddress[5]); |
389 |
|
|
390 |
lastseen = read64s(); |
lastseen = read64s(); |
391 |
|
|
392 |
print_indentation(); |
print_indentation(); |
393 |
printf("Last seen %ld = ", lastseen); |
printf("Last seen 0x%lx = %ld = ", lastseen, lastseen); |
394 |
print_time_t(lastseen); |
print_time_t(lastseen); |
395 |
puts(""); |
puts(""); |
396 |
|
} // if |
397 |
|
else { |
398 |
|
lastseen = read64s(); |
399 |
|
|
400 |
|
print_indentation(); |
401 |
|
printf("Last seen 0x%lx = %ld = ", lastseen, lastseen); |
402 |
|
print_time_t(lastseen); |
403 |
|
puts(""); |
404 |
|
|
405 |
|
macaddress[0] = read8u(); |
406 |
|
macaddress[1] = read8u(); |
407 |
|
macaddress[2] = read8u(); |
408 |
|
macaddress[3] = read8u(); |
409 |
|
macaddress[4] = read8u(); |
410 |
|
macaddress[5] = read8u(); |
411 |
|
|
412 |
|
print_indentation(); |
413 |
|
printf("MAC address %02x:%02x:%02x:%02x:%02x:%02x\n", macaddress[0], macaddress[1], macaddress[2], macaddress[3], macaddress[4], macaddress[5]); |
414 |
|
} // else |
415 |
|
|
416 |
hostnamelen = read8u(); |
hostnamelen = read8u(); |
417 |
|
|
418 |
print_indentation(); |
print_indentation(); |
419 |
printf("Hostname length %d\n", hostnamelen); |
printf("Hostname length %d\n", hostnamelen); |
420 |
|
|
421 |
for (i = 0; i < hostnamelen; i++) { |
for (i = 0; i < hostnamelen; i++) { |
422 |
hostname[i] = read8u(); |
hostname[i] = read8u(); |
423 |
} // for |
} // for |
424 |
hostname[i] = '\0'; |
hostname[i] = '\0'; |
425 |
|
|
426 |
print_indentation(); |
print_indentation(); |
427 |
printf("Hostname %s\n", hostname); |
printf("Hostname %s\n", hostname); |
428 |
|
|
429 |
bytesin = read64u(); |
bytesin = read64u(); |
430 |
|
|
431 |
print_indentation(); |
print_indentation(); |
432 |
printf("Bytes in %lu\n", bytesin); |
printf("Bytes in %lu\n", bytesin); |
433 |
|
|
434 |
bytesout = read64u(); |
bytesout = read64u(); |
435 |
|
|
436 |
print_indentation(); |
print_indentation(); |
437 |
printf("Bytes out %lu\n", bytesout); |
printf("Bytes out %lu\n", bytesout); |
438 |
|
|
439 |
if ( (protosdata = read8u()) != 'P') { // missing protos data |
if ( (protosdata = read8u()) != 'P') { // missing protos data |
440 |
fprintf(stderr, "%s: expecting character P, not %c\n", progname, protosdata); |
fprintf(stderr, "%s:%s:%ld: expecting character P, not %c\n", progname, filename, ftell(file), protosdata); |
441 |
exit(EXIT_FAILURE); |
exit(EXIT_FAILURE); |
442 |
} // if |
} // if |
443 |
|
|
444 |
decode_protos_data(); |
decode_protos_data(); |
445 |
|
|
446 |
if ( (tcpdata = read8u()) != 'T') { // missing tcp data |
if ( (tcpdata = read8u()) != 'T') { // missing tcp data |
447 |
fprintf(stderr, "%s: expecting character T, not %c\n", progname, tcpdata); |
fprintf(stderr, "%s:%s:%ld: expecting character T, not %c\n", progname, filename, ftell(file), tcpdata); |
448 |
exit(EXIT_FAILURE); |
exit(EXIT_FAILURE); |
449 |
} // if |
} // if |
450 |
|
|
451 |
decode_tcp_data(); |
decode_tcp_data(); |
452 |
|
|
453 |
if ( (udpdata = read8u()) != 'U') { // missing udp data |
if ( (udpdata = read8u()) != 'U') { // missing udp data |
454 |
fprintf(stderr, "%s: expecting character U, not %c\n", progname, udpdata); |
fprintf(stderr, "%s:%s:%ld: expecting character U, not %c\n", progname, filename, ftell(file), udpdata); |
455 |
exit(EXIT_FAILURE); |
exit(EXIT_FAILURE); |
456 |
} // if |
} // if |
457 |
|
|
458 |
decode_udp_data(); |
decode_udp_data(); |
459 |
|
|
460 |
exdent(); |
exdent(); |
461 |
} // decode_host_header_v2 |
} // decode_host_header_v2 |
462 |
|
|
463 |
void decode_host_header_v3(void) |
void decode_host_header_v3(void) |
464 |
{ |
{ |
465 |
unsigned char addressfamily; |
unsigned char addressfamily; |
466 |
unsigned char ipv4address[4]; |
unsigned char ipv4address[4]; |
467 |
unsigned char ipv6address[16]; |
unsigned char ipv6address[16]; |
468 |
unsigned char macaddress[6]; |
unsigned char macaddress[6]; |
469 |
signed long lastseen; |
signed long lastseen; |
521 |
ipv6address[ 3], |
ipv6address[ 3], |
522 |
ipv6address[ 4], |
ipv6address[ 4], |
523 |
ipv6address[ 5], |
ipv6address[ 5], |
524 |
ipv6address[ 6], |
ipv6address[ 6], |
525 |
ipv6address[ 7], |
ipv6address[ 7], |
526 |
ipv6address[ 8], |
ipv6address[ 8], |
527 |
ipv6address[ 9], |
ipv6address[ 9], |
528 |
ipv6address[10], |
ipv6address[10], |
529 |
ipv6address[11], |
ipv6address[11], |
530 |
ipv6address[12], |
ipv6address[12], |
531 |
ipv6address[13], |
ipv6address[13], |
532 |
ipv6address[14], |
ipv6address[14], |
533 |
ipv6address[15]); |
ipv6address[15]); |
534 |
} // else if |
} // else if |
535 |
else { // unknown address family |
else { // unknown address family |
536 |
fprintf(stderr, "%s:%s: unknown address family = 0x%x, neither 0x%x nor 0x%x\n", progname, filename, addressfamily, 0x04, 0x06); |
fprintf(stderr, "%s:%s:%ld: unknown address family = 0x%x, neither 0x%x nor 0x%x\n", progname, filename, ftell(file), addressfamily, 0x04, 0x06); |
537 |
exit(EXIT_FAILURE); |
exit(EXIT_FAILURE); |
538 |
} // else |
} // else |
539 |
|
|
540 |
macaddress[0] = read8u(); |
if (follow_specification == true) { |
541 |
macaddress[1] = read8u(); |
macaddress[0] = read8u(); |
542 |
macaddress[2] = read8u(); |
macaddress[1] = read8u(); |
543 |
macaddress[3] = read8u(); |
macaddress[2] = read8u(); |
544 |
macaddress[4] = read8u(); |
macaddress[3] = read8u(); |
545 |
macaddress[5] = read8u(); |
macaddress[4] = read8u(); |
546 |
|
macaddress[5] = read8u(); |
547 |
|
|
548 |
print_indentation(); |
print_indentation(); |
549 |
printf("MAC address %02x:%02x:%02x:%02x:%02x:%02x\n", macaddress[0], macaddress[1], macaddress[2], macaddress[3], macaddress[4], macaddress[5]); |
printf("MAC address %02x:%02x:%02x:%02x:%02x:%02x\n", macaddress[0], macaddress[1], macaddress[2], macaddress[3], macaddress[4], macaddress[5]); |
550 |
|
|
551 |
lastseen = read64s(); |
lastseen = read64s(); |
552 |
|
|
553 |
print_indentation(); |
print_indentation(); |
554 |
printf("Last seen %ld = ", lastseen); |
printf("Last seen 0x%lx = %ld = ", lastseen, lastseen); |
555 |
print_time_t(lastseen); |
print_time_t(lastseen); |
556 |
puts(""); |
puts(""); |
557 |
|
} // if |
558 |
|
else { |
559 |
|
lastseen = read64s(); |
560 |
|
|
561 |
|
print_indentation(); |
562 |
|
printf("Last seen 0x%lx = %ld = ", lastseen, lastseen); |
563 |
|
print_time_t(lastseen); |
564 |
|
puts(""); |
565 |
|
|
566 |
|
macaddress[0] = read8u(); |
567 |
|
macaddress[1] = read8u(); |
568 |
|
macaddress[2] = read8u(); |
569 |
|
macaddress[3] = read8u(); |
570 |
|
macaddress[4] = read8u(); |
571 |
|
macaddress[5] = read8u(); |
572 |
|
|
573 |
|
print_indentation(); |
574 |
|
printf("MAC address %02x:%02x:%02x:%02x:%02x:%02x\n", macaddress[0], macaddress[1], macaddress[2], macaddress[3], macaddress[4], macaddress[5]); |
575 |
|
} // else |
576 |
|
|
577 |
hostnamelen = read8u(); |
hostnamelen = read8u(); |
578 |
|
|
579 |
print_indentation(); |
print_indentation(); |
580 |
printf("Hostname length %d\n", hostnamelen); |
printf("Hostname length %d\n", hostnamelen); |
581 |
|
|
582 |
for (i = 0; i < hostnamelen; i++) { |
for (i = 0; i < hostnamelen; i++) { |
583 |
hostname[i] = read8u(); |
hostname[i] = read8u(); |
584 |
} // for |
} // for |
585 |
hostname[i] = '\0'; |
hostname[i] = '\0'; |
586 |
|
|
587 |
print_indentation(); |
print_indentation(); |
588 |
printf("Hostname %s\n", hostname); |
printf("Hostname %s\n", hostname); |
589 |
|
|
590 |
bytesin = read64u(); |
bytesin = read64u(); |
591 |
|
|
592 |
print_indentation(); |
print_indentation(); |
593 |
printf("Bytes in %lu\n", bytesin); |
printf("Bytes in %lu\n", bytesin); |
594 |
|
|
595 |
bytesout = read64u(); |
bytesout = read64u(); |
596 |
|
|
597 |
print_indentation(); |
print_indentation(); |
598 |
printf("Bytes out %lu\n", bytesout); |
printf("Bytes out %lu\n", bytesout); |
599 |
|
|
600 |
if ( (protosdata = read8u()) != 'P') { // missing protos data |
if ( (protosdata = read8u()) != 'P') { // missing protos data |
601 |
fprintf(stderr, "%s: expecting character P, not %c\n", progname, protosdata); |
fprintf(stderr, "%s:%s:%ld: expecting character P, not %c\n", progname, filename, ftell(file), protosdata); |
602 |
exit(EXIT_FAILURE); |
exit(EXIT_FAILURE); |
603 |
} // if |
} // if |
604 |
|
|
605 |
decode_protos_data(); |
decode_protos_data(); |
606 |
|
|
607 |
if ( (tcpdata = read8u()) != 'T') { // missing tcp data |
if ( (tcpdata = read8u()) != 'T') { // missing tcp data |
608 |
fprintf(stderr, "%s: expecting character T, not %c\n", progname, tcpdata); |
fprintf(stderr, "%s:%s:%ld: expecting character T, not %c\n", progname, filename, ftell(file), tcpdata); |
609 |
exit(EXIT_FAILURE); |
exit(EXIT_FAILURE); |
610 |
} // if |
} // if |
611 |
|
|
612 |
decode_tcp_data(); |
decode_tcp_data(); |
613 |
|
|
614 |
if ( (udpdata = read8u()) != 'U') { // missing udp data |
if ( (udpdata = read8u()) != 'U') { // missing udp data |
615 |
fprintf(stderr, "%s: expecting character U, not %c\n", progname, udpdata); |
fprintf(stderr, "%s:%s:%ld: expecting character U, not %c\n", progname, filename, ftell(file), udpdata); |
616 |
exit(EXIT_FAILURE); |
exit(EXIT_FAILURE); |
617 |
} // if |
} // if |
618 |
|
|
619 |
decode_udp_data(); |
decode_udp_data(); |
620 |
|
|
621 |
exdent(); |
exdent(); |
622 |
} // decode_host_header_v3 |
} // decode_host_header_v3 |
623 |
|
|
624 |
void decode_protos_data(void) |
void decode_protos_data(void) |
625 |
{ |
{ |
626 |
unsigned char ipprotocount; |
unsigned char ipprotocount; |
627 |
|
|
628 |
unsigned char u; |
unsigned char u; |
629 |
|
|
630 |
ipprotocount = read8u(); |
ipprotocount = read8u(); |
634 |
|
|
635 |
indent(); |
indent(); |
636 |
|
|
637 |
for (u = 0; u < ipprotocount; u++) { |
for (u = 0; u < ipprotocount; u++) { |
638 |
unsigned char proto; |
unsigned char proto; |
639 |
unsigned long in; |
unsigned long in; |
640 |
unsigned long out; |
unsigned long out; |
641 |
|
|
642 |
print_indentation(); |
print_indentation(); |
643 |
printf("Protocol #%u of %u:\n", u + 1, ipprotocount); |
printf("Protocol #%u of %u:\n", u + 1, ipprotocount); |
644 |
|
|
645 |
proto = read8u(); |
proto = read8u(); |
646 |
|
|
647 |
indent(); |
indent(); |
648 |
print_indentation(); |
print_indentation(); |
649 |
printf("Protocol 0x%x\n", proto); |
printf("Protocol 0x%02x\n", proto); |
650 |
|
|
651 |
in = read64u(); |
in = read64u(); |
652 |
|
|
653 |
print_indentation(); |
print_indentation(); |
654 |
printf("In %lu\n", in); |
printf("In %lu\n", in); |
655 |
|
|
656 |
out = read64u(); |
out = read64u(); |
657 |
|
|
658 |
print_indentation(); |
print_indentation(); |
659 |
printf("Out %lu\n", out); |
printf("Out %lu\n", out); |
660 |
|
|
661 |
exdent(); |
exdent(); |
662 |
} // for |
} // for |
663 |
|
|
664 |
exdent(); |
exdent(); |
748 |
} // for |
} // for |
749 |
|
|
750 |
exdent(); |
exdent(); |
751 |
} // decode_udp_data() |
} // decode_udp_data() |
752 |
|
|
753 |
void decode_graph_db_v1(void) |
void decode_graph_db_v1(void) |
754 |
{ |
{ |
755 |
signed long lasttime; |
signed long lasttime; |
756 |
|
|
757 |
unsigned int i; |
unsigned int i; |
758 |
|
|
759 |
lasttime = read64s(); |
lasttime = read64s(); |
760 |
|
|
761 |
indent(); |
indent(); |
762 |
print_indentation(); |
print_indentation(); |
763 |
printf("Last time %ld = ", lasttime); |
printf("Last time 0x%lx = %ld = ", lasttime, lasttime); |
764 |
print_time_t(lasttime); |
print_time_t(lasttime); |
765 |
puts(""); |
puts(""); |
766 |
|
|
767 |
for (i = 0; i < 4; i++) { |
for (i = 0; i < 4; i++) { |
768 |
unsigned char nbars; |
unsigned char nbars; |
769 |
unsigned char idxlastbar; |
unsigned char idxlastbar; |
770 |
|
|
771 |
unsigned int j; |
unsigned int j; |
772 |
|
|
773 |
print_indentation(); |
print_indentation(); |
774 |
printf("Graph #%d of 4:\n", i + 1); |
printf("Graph #%d of 4:\n", i + 1); |
775 |
|
|
776 |
nbars = read8u(); |
nbars = read8u(); |
777 |
|
|
778 |
indent(); |
indent(); |
911 |
if ( (r = fread((void *)&v, sizeof(v), 1, file)) != 1) { |
if ( (r = fread((void *)&v, sizeof(v), 1, file)) != 1) { |
912 |
handle_file_error(); |
handle_file_error(); |
913 |
} // if |
} // if |
914 |
|
|
915 |
#ifdef __LITTLE_ENDIAN__ |
#ifdef __LITTLE_ENDIAN__ |
916 |
v = ntohl(v); |
v = ntohl(v); |
917 |
#endif |
#endif |
918 |
|
|
919 |
return v; |
return v; |
920 |
} // read32s() |
} // read32s() |
921 |
|
|
922 |
unsigned long read64u(void) |
unsigned long read64u(void) |
923 |
{ |
{ |
924 |
size_t r; |
size_t r; |
925 |
unsigned long v; |
unsigned long v; |
|
unsigned int *p = (unsigned int *)&v; |
|
926 |
|
|
927 |
|
#ifdef __LITTLE_ENDIAN__ |
928 |
|
unsigned long tmp; |
929 |
|
unsigned int *p1 = (unsigned int *)&v; |
930 |
|
unsigned int *p2 = (unsigned int *)&tmp; |
931 |
|
#endif |
932 |
|
|
933 |
//fprintf(stderr, "%s: sizeof(unsigned long) = %ld\n", progname, sizeof(v)); |
//fprintf(stderr, "%s: sizeof(unsigned long) = %ld\n", progname, sizeof(v)); |
934 |
|
|
935 |
if ( (r = fread((void *)&v, sizeof(v), 1, file)) != 1) { |
if ( (r = fread((void *)&v, sizeof(v), 1, file)) != 1) { |
936 |
handle_file_error(); |
handle_file_error(); |
937 |
} // if |
} // if |
938 |
|
|
939 |
#ifdef __LITTLE_ENDIAN__ |
#ifdef __LITTLE_ENDIAN__ |
940 |
p[0] = ntohl((unsigned int)p[0]); |
p2[1] = ntohl(p1[0]); |
941 |
p[1] = ntohl((unsigned int)p[1]); |
p2[0] = ntohl(p1[1]); |
942 |
|
v = tmp; |
943 |
#endif |
#endif |
944 |
|
|
945 |
return v; |
return v; |
946 |
} // read64u() |
} // read64u() |
947 |
|
|
948 |
signed long read64s(void) |
signed long read64s(void) |
949 |
{ |
{ |
950 |
size_t r; |
size_t r; |
951 |
signed long v; |
signed long v; |
|
signed int *p = (signed int *)&v; |
|
952 |
|
|
953 |
|
#ifdef __LITTLE_ENDIAN__ |
954 |
|
signed long tmp; |
955 |
|
signed int *p1 = (signed int *)&v; |
956 |
|
signed int *p2 = (signed int *)&tmp; |
957 |
|
#endif |
958 |
|
|
959 |
//fprintf(stderr, "%s: sizeof(signed long) = %ld\n", progname, sizeof(v)); |
//fprintf(stderr, "%s: sizeof(signed long) = %ld\n", progname, sizeof(v)); |
960 |
|
|
961 |
if ( (r = fread((void *)&v, sizeof(v), 1, file)) != 1) { |
if ( (r = fread((void *)&v, sizeof(v), 1, file)) != 1) { |
962 |
handle_file_error(); |
handle_file_error(); |
963 |
} // if |
} // if |
964 |
|
|
965 |
#ifdef __LITTLE_ENDIAN__ |
#ifdef __LITTLE_ENDIAN__ |
966 |
p[0] = ntohl((signed int)p[0]); |
p2[1] = ntohl(p1[0]); |
967 |
p[1] = ntohl((signed int)p[1]); |
p2[0] = ntohl(p1[1]); |
968 |
|
v = tmp; |
969 |
#endif |
#endif |
970 |
|
|
971 |
return v; |
return v; |
972 |
} // read64s() |
} // read64s() |
973 |
|
|
974 |
void handle_file_error(void) |
void handle_file_error(void) |
975 |
{ |
{ |
976 |
|
int saved_errno = errno; |
977 |
|
|
978 |
if (feof(file) != 0) { |
if (feof(file) != 0) { |
979 |
fprintf(stderr, "%s:%s: premature end-of-file\n", progname, filename); |
fprintf(stderr, "%s:%s:%ld: premature end-of-file\n", progname, filename, ftell(file)); |
980 |
exit(EXIT_FAILURE); |
exit(EXIT_FAILURE); |
981 |
} // if |
} // if |
982 |
|
|
983 |
if (ferror(file) != 0) { |
if (ferror(file) != 0) { |
984 |
fprintf(stderr, "%s:%s: file error, errno = %s (%d)\n", progname, filename, strerror(errno), errno); |
fprintf(stderr, "%s:%s:%ld: file error, errno = %s (%d)\n", progname, filename, ftell(file), strerror(saved_errno), saved_errno); |
985 |
exit(EXIT_FAILURE); |
exit(EXIT_FAILURE); |
986 |
} // if |
} // if |
987 |
} // handle_file_error() |
} // handle_file_error() |
988 |
|
|
989 |
signed long long indentation = 0LL; |
signed long long indentation = 0LL; |
990 |
|
|
991 |
void indent(void) |
void indent(void) |
992 |
{ |
{ |
993 |
indentation += 2LL; |
indentation += 2LL; |
994 |
} // indent() |
} // indent() |
995 |
|
|
996 |
void exdent(void) |
void exdent(void) |
997 |
{ |
{ |
998 |
indentation -= 2LL; |
indentation -= 2LL; |
999 |
|
|
1008 |
|
|
1009 |
for (i = 0; i < indentation; i++) { |
for (i = 0; i < indentation; i++) { |
1010 |
putchar(' '); |
putchar(' '); |
1011 |
} // for |
} // for |
1012 |
} // print_indentation() |
} // print_indentation() |
1013 |
|
|
1014 |
void print_time_t(time_t t) |
void print_time_t(time_t t) |
1015 |
{ |
{ |
1016 |
struct tm *stm; |
struct tm *stm; |
1017 |
char buffer[1024]; |
char buffer[1024]; |
1018 |
|
|
1019 |
stm = gmtime(&t); |
stm = gmtime(&t); |
1020 |
|
|
1021 |
// ISO 8601 format |
// ISO 8601 format |
1022 |
if (strftime(buffer, sizeof(buffer), "%Y-%m-%dT%H:%M:%S%z", stm) == 0) { |
if (strftime(buffer, sizeof(buffer), "%Y-%m-%dT%H:%M:%S%z", stm) == 0) { |
1023 |
fprintf(stderr, "%s:%s: strftime() error, errno = %s (%d)\n", progname, filename, strerror(errno), errno); |
int saved_errno = errno; |
1024 |
|
|
1025 |
|
fprintf(stderr, "%s:%s:%ld: strftime() error, errno = %s (%d)\n", progname, filename, ftell(file), strerror(saved_errno), saved_errno); |
1026 |
exit(EXIT_FAILURE); |
exit(EXIT_FAILURE); |
1027 |
} // if |
} // if |
1028 |
|
|
1029 |
fputs(buffer, stdout); |
fputs(buffer, stdout); |
1030 |
} // print_time_t() |
} // print_time_t() |
1031 |
|
|
1032 |
// darkstattype.c |
// darkstattype.c |