18 |
and/or other materials provided with the distribution. |
and/or other materials provided with the distribution. |
19 |
|
|
20 |
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND |
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND |
21 |
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED |
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED |
22 |
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE |
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE |
23 |
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR |
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR |
24 |
ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES |
ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES |
25 |
(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; |
(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; |
26 |
LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND |
LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND |
27 |
ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT |
ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT |
28 |
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS |
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS |
29 |
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
30 |
*/ |
*/ |
31 |
|
|
32 |
#include <errno.h> |
#include <errno.h> |
33 |
|
#include <stdbool.h> |
34 |
#include <stdio.h> |
#include <stdio.h> |
35 |
#include <stdlib.h> |
#include <stdlib.h> |
36 |
#include <string.h> |
#include <string.h> |
37 |
#include <time.h> |
#include <time.h> |
38 |
#include <unistd.h> |
#include <unistd.h> |
39 |
|
|
40 |
const char * progname = NULL; |
const char *progname = NULL; |
41 |
const char * filename = NULL; |
const char *filename = NULL; |
42 |
FILE *file = NULL; |
FILE *file = NULL; |
43 |
|
bool follow_specification = false; |
44 |
|
|
45 |
int main(int argc, char **argv) |
int main(int argc, char **argv) |
46 |
{ |
{ |
47 |
void show_usage(int exitcode); |
void show_usage(int exitcode); |
48 |
void show_version(void); |
void show_version(void); |
49 |
void decode_file(void); |
void decode_file(void); |
50 |
|
|
51 |
int i; |
int i; |
52 |
|
|
53 |
progname = argv[0]; |
progname = argv[0]; |
54 |
|
|
55 |
opterr = 0; |
opterr = 0; |
56 |
while ( (i = getopt(argc, argv, "hv")) != -1) { |
while ( (i = getopt(argc, argv, "fhv")) != -1) { |
57 |
switch (i) { |
switch (i) { |
58 |
|
case 'f': |
59 |
|
follow_specification = !follow_specification; |
60 |
|
break; |
61 |
|
|
62 |
case 'h': |
case 'h': |
63 |
show_usage(EXIT_SUCCESS); |
show_usage(EXIT_SUCCESS); |
64 |
break; |
break; |
65 |
|
|
66 |
case 'v': |
case 'v': |
67 |
show_version(); |
show_version(); |
68 |
break; |
break; |
69 |
|
|
70 |
case '?': |
case '?': |
71 |
/*FALLTHROUGH*/ |
/*FALLTHROUGH*/ |
72 |
default: |
default: |
73 |
fprintf(stderr, "%s: illegal option -%c\n\n", progname, optopt); |
fprintf(stderr, "%s: illegal option -%c\n\n", progname, optopt); |
74 |
show_usage(EXIT_FAILURE); |
show_usage(EXIT_FAILURE); |
75 |
break; |
break; |
76 |
} // switch |
} // switch |
81 |
if (argv[0] == NULL) { |
if (argv[0] == NULL) { |
82 |
fprintf(stderr, "%s: missing filename\n\n", progname); |
fprintf(stderr, "%s: missing filename\n\n", progname); |
83 |
show_usage(EXIT_FAILURE); |
show_usage(EXIT_FAILURE); |
84 |
} // if |
} // if |
85 |
|
|
86 |
filename = argv[0]; |
filename = argv[0]; |
87 |
|
|
88 |
decode_file(); |
decode_file(); |
89 |
|
|
90 |
return EXIT_SUCCESS; |
return EXIT_SUCCESS; |
91 |
} // main() |
} // main() |
92 |
|
|
93 |
void show_usage(int exitcode) |
void show_usage(int exitcode) |
94 |
{ |
{ |
95 |
fprintf((exitcode == EXIT_SUCCESS) ? stdout : stderr, |
fprintf((exitcode == EXIT_SUCCESS) ? stdout : stderr, |
96 |
"Usage: %s [-h] [-v] filename\n" |
"Usage: %s [-f] [-h] [-v] filename\n" |
97 |
" E.g.: %s darkstat.db\n", |
" E.g.: %s darkstat.db\n\n" |
98 |
|
|
99 |
|
"Options:\n" |
100 |
|
"-f\tToggle follow strict specification, default is false.\n" |
101 |
|
"-h\tShow this help message and exit.\n" |
102 |
|
"-v\tShow version and copyright and exit.\n", |
103 |
progname, progname); |
progname, progname); |
104 |
|
|
105 |
exit(exitcode); |
exit(exitcode); |
106 |
} // show_usage() |
} // show_usage() |
107 |
|
|
108 |
void show_version(void) |
void show_version(void) |
109 |
{ |
{ |
110 |
puts("darkstattype 1.0"); |
puts("darkstattype 1.0"); |
111 |
puts("$Ximalas$"); |
puts("$Ximalas$"); |
112 |
puts(""); |
puts(""); |
113 |
|
|
114 |
puts("Copyright © 2014, Trond Endrestøl <Trond.Endrestol@ximalas.info>"); |
puts("Copyright © 2014, Trond Endrestøl <Trond.Endrestol@ximalas.info>"); |
115 |
puts("All rights reserved."); |
puts("All rights reserved."); |
116 |
puts(""); |
puts(""); |
117 |
puts("Redistribution and use in source and binary forms, with or without"); |
puts("Redistribution and use in source and binary forms, with or without"); |
163 |
void decode_file(void) |
void decode_file(void) |
164 |
{ |
{ |
165 |
void decode_host_db_v1(void); |
void decode_host_db_v1(void); |
166 |
void decode_graph_db_v1(void); |
void decode_graph_db_v1(void); |
167 |
|
|
168 |
unsigned int fileheader; |
unsigned int fileheader; |
169 |
unsigned int sectionheader; |
unsigned int sectionheader; |
170 |
|
|
171 |
unsigned int i; |
unsigned int i; |
172 |
|
|
173 |
if ( (file = fopen(filename, "rb")) == NULL) { |
if ( (file = fopen(filename, "rb")) == NULL) { |
174 |
fprintf(stderr, "%s: fopen(\"%s\") = %s (%d)\n", progname, filename, strerror(errno), errno); |
fprintf(stderr, "%s: fopen(\"%s\") = %s (%d)\n", progname, filename, strerror(errno), errno); |
175 |
exit(EXIT_FAILURE); |
exit(EXIT_FAILURE); |
176 |
} // if |
} // if |
177 |
|
|
178 |
if ( (fileheader = read32u()) != 0xDA314159U) { // not darkstat export format |
#define FILE_HEADER_V1 0xDA314159U |
179 |
fprintf(stderr, "%s:%s: file header = 0x%x, not 0x%x\n", progname, filename, fileheader, 0xDA314159U); |
|
180 |
|
if ( (fileheader = read32u()) != FILE_HEADER_V1) { // not darkstat export format |
181 |
|
fprintf(stderr, "%s:%s:%ld: file header = 0x%x, not 0x%x\n", progname, filename, ftell(file), fileheader, FILE_HEADER_V1); |
182 |
exit(EXIT_FAILURE); |
exit(EXIT_FAILURE); |
183 |
} // if |
} // if |
184 |
|
|
185 |
printf("File header 0x%x\n", fileheader); |
printf("File header 0x%x\n", fileheader); |
186 |
|
|
187 |
// Possible section header for host_db v1 and later graph_db v1. |
// Possible section header for host_db v1 and later graph_db v1. |
188 |
indent(); |
indent(); |
189 |
|
|
190 |
|
#define HOST_DB_V1 0xDA485301U |
191 |
|
#define GRAPH_DB_V1 0xDA475201U |
192 |
|
|
193 |
for (i = 0; i < 2; i++) { |
for (i = 0; i < 2; i++) { |
194 |
if ( (sectionheader = read32u()) == 0xDA485301U) { |
if ( (sectionheader = read32u()) == HOST_DB_V1) { |
195 |
print_indentation(); |
print_indentation(); |
196 |
printf("Section header 0x%x\n", sectionheader); |
printf("Section header host_db v1 0x%x\n", sectionheader); |
197 |
decode_host_db_v1(); |
decode_host_db_v1(); |
198 |
} // if |
} // if |
199 |
else if (sectionheader == 0xDA475201U) { |
else if (sectionheader == GRAPH_DB_V1) { |
200 |
print_indentation(); |
print_indentation(); |
201 |
printf("Section header 0x%x\n", sectionheader); |
printf("Section header graph_db v1 0x%x\n", sectionheader); |
202 |
decode_graph_db_v1(); |
decode_graph_db_v1(); |
203 |
} // else if |
} // else if |
204 |
else { |
else { |
205 |
fprintf(stderr, "%s:%s: unknown section header = 0x%x, neither 0x%x nor 0x%x\n", progname, filename, sectionheader, 0xDA485301U, 0xDA475201U); |
fprintf(stderr, "%s:%s:%ld: unknown section header = 0x%x, neither 0x%x nor 0x%x\n", progname, filename, ftell(file), sectionheader, HOST_DB_V1, GRAPH_DB_V1); |
206 |
exit(EXIT_FAILURE); |
exit(EXIT_FAILURE); |
207 |
} // else |
} // else |
208 |
} // for |
} // for |
209 |
|
|
210 |
exdent(); |
exdent(); |
211 |
} // decode_file() |
} // decode_file() |
212 |
|
|
213 |
void decode_host_db_v1(void) |
void decode_host_db_v1(void) |
214 |
{ |
{ |
215 |
void decode_host_header_v1(void); |
void decode_host_header_v1(void); |
216 |
void decode_host_header_v2(void); |
void decode_host_header_v2(void); |
217 |
void decode_host_header_v3(void); |
void decode_host_header_v3(void); |
218 |
|
|
219 |
unsigned int hostcount; |
unsigned int hostcount; |
220 |
unsigned int i; |
unsigned int i; |
222 |
indent(); |
indent(); |
223 |
|
|
224 |
hostcount = read32u(); |
hostcount = read32u(); |
225 |
|
|
226 |
print_indentation(); |
print_indentation(); |
227 |
printf("Host count %u\n", hostcount); |
printf("Host count %u\n", hostcount); |
228 |
|
|
229 |
for (i = 0; i < hostcount; i++) { |
for (i = 0; i < hostcount; i++) { |
230 |
unsigned int hostheader; |
unsigned int hostheader; |
231 |
|
|
232 |
print_indentation(); |
print_indentation(); |
233 |
printf("Host #%u of %u:\n", i + 1, hostcount); |
printf("Host #%u of %u:\n", i + 1, hostcount); |
234 |
|
|
235 |
indent(); |
indent(); |
236 |
|
|
237 |
if ( (hostheader = read32u()) == 0x48535403U) { // host header v3 |
#define HOST_HEADER_V3 0x48535403U |
238 |
|
#define HOST_HEADER_V2 0x48535402U |
239 |
|
#define HOST_HEADER_V1 0x48535401U |
240 |
|
|
241 |
|
if ( (hostheader = read32u()) == HOST_HEADER_V3) { // host header v3 |
242 |
print_indentation(); |
print_indentation(); |
243 |
printf("Host header v3 0x%x\n", hostheader); |
printf("Host header v3 0x%x\n", hostheader); |
244 |
decode_host_header_v3(); |
decode_host_header_v3(); |
245 |
} // if |
} // if |
246 |
else if (hostheader == 0x48535402U) { // host header v2 |
else if (hostheader == HOST_HEADER_V2) { // host header v2 |
247 |
print_indentation(); |
print_indentation(); |
248 |
printf("Host header v2 0x%x\n", hostheader); |
printf("Host header v2 0x%x\n", hostheader); |
249 |
decode_host_header_v2(); |
decode_host_header_v2(); |
250 |
} // else if |
} // else if |
251 |
else if (hostheader == 0x48535401U) { // host header v1 |
else if (hostheader == HOST_HEADER_V1) { // host header v1 |
252 |
print_indentation(); |
print_indentation(); |
253 |
printf("Host header v1 0x%x\n", hostheader); |
printf("Host header v1 0x%x\n", hostheader); |
254 |
decode_host_header_v1(); |
decode_host_header_v1(); |
255 |
} // else if |
} // else if |
256 |
else { // unknown host header version |
else { // unknown host header version |
257 |
fprintf(stderr, "%s:%s: unknown host header = 0x%x, neither 0x%x nor 0x%x nor 0x%x\n", progname, filename, hostheader, 0x48535403U, 0x48535402U, 0x48535401U); |
fprintf(stderr, "%s:%s:%ld: unknown host header = 0x%x, neither 0x%x nor 0x%x nor 0x%x\n", progname, filename, ftell(file), hostheader, HOST_HEADER_V3, HOST_HEADER_V2, HOST_HEADER_V1); |
258 |
exit(EXIT_FAILURE); |
exit(EXIT_FAILURE); |
259 |
} // else |
} // else |
260 |
|
|
261 |
exdent(); |
exdent(); |
262 |
} // for |
} // for |
263 |
|
|
264 |
exdent(); |
exdent(); |
265 |
} // decode_host_db_v1() |
} // decode_host_db_v1() |
266 |
|
|
267 |
void decode_protos_data(void); |
void decode_protos_data(void); |
268 |
void decode_tcp_data(void); |
void decode_tcp_data(void); |
269 |
void decode_udp_data(void); |
void decode_udp_data(void); |
270 |
|
|
271 |
void decode_host_header_v1(void) |
void decode_host_header_v1(void) |
272 |
{ |
{ |
315 |
|
|
316 |
print_indentation(); |
print_indentation(); |
317 |
printf("Hostname %s\n", hostname); |
printf("Hostname %s\n", hostname); |
318 |
|
|
319 |
bytesin = read64u(); |
bytesin = read64u(); |
320 |
|
|
321 |
print_indentation(); |
print_indentation(); |
322 |
printf("Bytes in %lu\n", bytesin); |
printf("Bytes in %lu\n", bytesin); |
323 |
|
|
324 |
bytesout = read64u(); |
bytesout = read64u(); |
325 |
|
|
326 |
print_indentation(); |
print_indentation(); |
327 |
printf("Bytes out %lu\n", bytesout); |
printf("Bytes out %lu\n", bytesout); |
328 |
|
|
329 |
if ( (protosdata = read8u()) != 'P') { // missing protos data |
if ( (protosdata = read8u()) != 'P') { // missing protos data |
330 |
fprintf(stderr, "%s: expecting character P, not %c\n", progname, protosdata); |
fprintf(stderr, "%s:%s:%ld: expecting character P, not %c\n", progname, filename, ftell(file), protosdata); |
331 |
exit(EXIT_FAILURE); |
exit(EXIT_FAILURE); |
332 |
} // if |
} // if |
333 |
|
|
334 |
decode_protos_data(); |
decode_protos_data(); |
335 |
|
|
336 |
if ( (tcpdata = read8u()) != 'T') { // missing tcp data |
if ( (tcpdata = read8u()) != 'T') { // missing tcp data |
337 |
fprintf(stderr, "%s: expecting character T, not %c\n", progname, tcpdata); |
fprintf(stderr, "%s:%s:%ld: expecting character T, not %c\n", progname, filename, ftell(file), tcpdata); |
338 |
exit(EXIT_FAILURE); |
exit(EXIT_FAILURE); |
339 |
} // if |
} // if |
340 |
|
|
341 |
decode_tcp_data(); |
decode_tcp_data(); |
342 |
|
|
343 |
if ( (udpdata = read8u()) != 'U') { // missing udp data |
if ( (udpdata = read8u()) != 'U') { // missing udp data |
344 |
fprintf(stderr, "%s: expecting character U, not %c\n", progname, udpdata); |
fprintf(stderr, "%s:%s:%ld: expecting character U, not %c\n", progname, filename, ftell(file), udpdata); |
345 |
exit(EXIT_FAILURE); |
exit(EXIT_FAILURE); |
346 |
} // if |
} // if |
347 |
|
|
348 |
decode_udp_data(); |
decode_udp_data(); |
349 |
|
|
350 |
exdent(); |
exdent(); |
351 |
} // decode_host_header_v1 |
} // decode_host_header_v1 |
352 |
|
|
353 |
void decode_host_header_v2(void) |
void decode_host_header_v2(void) |
354 |
{ |
{ |
355 |
unsigned char ipv4address[4]; |
unsigned char ipv4address[4]; |
356 |
unsigned char macaddress[6]; |
unsigned char macaddress[6]; |
357 |
signed long lastseen; |
signed long lastseen; |
358 |
unsigned char hostnamelen; |
unsigned char hostnamelen; |
359 |
unsigned char hostname[256]; |
unsigned char hostname[256]; |
364 |
unsigned char udpdata; |
unsigned char udpdata; |
365 |
|
|
366 |
unsigned char i; |
unsigned char i; |
367 |
|
|
368 |
indent(); |
indent(); |
369 |
|
|
370 |
ipv4address[0] = read8u(); |
ipv4address[0] = read8u(); |
371 |
ipv4address[1] = read8u(); |
ipv4address[1] = read8u(); |
372 |
ipv4address[2] = read8u(); |
ipv4address[2] = read8u(); |
373 |
ipv4address[3] = read8u(); |
ipv4address[3] = read8u(); |
374 |
|
|
375 |
print_indentation(); |
print_indentation(); |
376 |
printf("IPv4 address %d.%d.%d.%d\n", |
printf("IPv4 address %d.%d.%d.%d\n", |
377 |
ipv4address[0], ipv4address[1], ipv4address[2], ipv4address[3]); |
ipv4address[0], ipv4address[1], ipv4address[2], ipv4address[3]); |
378 |
|
|
379 |
macaddress[0] = read8u(); |
if (follow_specification == true) { |
380 |
macaddress[1] = read8u(); |
macaddress[0] = read8u(); |
381 |
macaddress[2] = read8u(); |
macaddress[1] = read8u(); |
382 |
macaddress[3] = read8u(); |
macaddress[2] = read8u(); |
383 |
macaddress[4] = read8u(); |
macaddress[3] = read8u(); |
384 |
macaddress[5] = read8u(); |
macaddress[4] = read8u(); |
385 |
|
macaddress[5] = read8u(); |
386 |
|
|
387 |
print_indentation(); |
print_indentation(); |
388 |
printf("MAC address %02x:%02x:%02x:%02x:%02x:%02x\n", macaddress[0], macaddress[1], macaddress[2], macaddress[3], macaddress[4], macaddress[5]); |
printf("MAC address %02x:%02x:%02x:%02x:%02x:%02x\n", macaddress[0], macaddress[1], macaddress[2], macaddress[3], macaddress[4], macaddress[5]); |
389 |
|
|
390 |
lastseen = read64s(); |
lastseen = read64s(); |
391 |
|
|
392 |
print_indentation(); |
print_indentation(); |
393 |
printf("Last seen %ld = ", lastseen); |
printf("Last seen 0x%lx = %ld = ", lastseen, lastseen); |
394 |
print_time_t(lastseen); |
print_time_t(lastseen); |
395 |
puts(""); |
puts(""); |
396 |
|
} // if |
397 |
|
else { |
398 |
|
lastseen = read64s(); |
399 |
|
|
400 |
|
print_indentation(); |
401 |
|
printf("Last seen 0x%lx = %ld = ", lastseen, lastseen); |
402 |
|
print_time_t(lastseen); |
403 |
|
puts(""); |
404 |
|
|
405 |
|
macaddress[0] = read8u(); |
406 |
|
macaddress[1] = read8u(); |
407 |
|
macaddress[2] = read8u(); |
408 |
|
macaddress[3] = read8u(); |
409 |
|
macaddress[4] = read8u(); |
410 |
|
macaddress[5] = read8u(); |
411 |
|
|
412 |
|
print_indentation(); |
413 |
|
printf("MAC address %02x:%02x:%02x:%02x:%02x:%02x\n", macaddress[0], macaddress[1], macaddress[2], macaddress[3], macaddress[4], macaddress[5]); |
414 |
|
} // else |
415 |
|
|
416 |
hostnamelen = read8u(); |
hostnamelen = read8u(); |
417 |
|
|
418 |
print_indentation(); |
print_indentation(); |
419 |
printf("Hostname length %d\n", hostnamelen); |
printf("Hostname length %d\n", hostnamelen); |
420 |
|
|
421 |
for (i = 0; i < hostnamelen; i++) { |
for (i = 0; i < hostnamelen; i++) { |
422 |
hostname[i] = read8u(); |
hostname[i] = read8u(); |
423 |
} // for |
} // for |
424 |
hostname[i] = '\0'; |
hostname[i] = '\0'; |
425 |
|
|
426 |
print_indentation(); |
print_indentation(); |
427 |
printf("Hostname %s\n", hostname); |
printf("Hostname %s\n", hostname); |
428 |
|
|
429 |
bytesin = read64u(); |
bytesin = read64u(); |
430 |
|
|
431 |
print_indentation(); |
print_indentation(); |
432 |
printf("Bytes in %lu\n", bytesin); |
printf("Bytes in %lu\n", bytesin); |
433 |
|
|
434 |
bytesout = read64u(); |
bytesout = read64u(); |
435 |
|
|
436 |
print_indentation(); |
print_indentation(); |
437 |
printf("Bytes out %lu\n", bytesout); |
printf("Bytes out %lu\n", bytesout); |
438 |
|
|
439 |
if ( (protosdata = read8u()) != 'P') { // missing protos data |
if ( (protosdata = read8u()) != 'P') { // missing protos data |
440 |
fprintf(stderr, "%s: expecting character P, not %c\n", progname, protosdata); |
fprintf(stderr, "%s:%s:%ld: expecting character P, not %c\n", progname, filename, ftell(file), protosdata); |
441 |
exit(EXIT_FAILURE); |
exit(EXIT_FAILURE); |
442 |
} // if |
} // if |
443 |
|
|
444 |
decode_protos_data(); |
decode_protos_data(); |
445 |
|
|
446 |
if ( (tcpdata = read8u()) != 'T') { // missing tcp data |
if ( (tcpdata = read8u()) != 'T') { // missing tcp data |
447 |
fprintf(stderr, "%s: expecting character T, not %c\n", progname, tcpdata); |
fprintf(stderr, "%s:%s:%ld: expecting character T, not %c\n", progname, filename, ftell(file), tcpdata); |
448 |
exit(EXIT_FAILURE); |
exit(EXIT_FAILURE); |
449 |
} // if |
} // if |
450 |
|
|
451 |
decode_tcp_data(); |
decode_tcp_data(); |
452 |
|
|
453 |
if ( (udpdata = read8u()) != 'U') { // missing udp data |
if ( (udpdata = read8u()) != 'U') { // missing udp data |
454 |
fprintf(stderr, "%s: expecting character U, not %c\n", progname, udpdata); |
fprintf(stderr, "%s:%s:%ld: expecting character U, not %c\n", progname, filename, ftell(file), udpdata); |
455 |
exit(EXIT_FAILURE); |
exit(EXIT_FAILURE); |
456 |
} // if |
} // if |
457 |
|
|
458 |
decode_udp_data(); |
decode_udp_data(); |
459 |
|
|
460 |
exdent(); |
exdent(); |
461 |
} // decode_host_header_v2 |
} // decode_host_header_v2 |
462 |
|
|
463 |
void decode_host_header_v3(void) |
void decode_host_header_v3(void) |
464 |
{ |
{ |
465 |
unsigned char addressfamily; |
unsigned char addressfamily; |
466 |
unsigned char ipv4address[4]; |
unsigned char ipv4address[4]; |
467 |
unsigned char ipv6address[16]; |
unsigned short ipv6address[8]; |
468 |
unsigned char macaddress[6]; |
unsigned char macaddress[6]; |
469 |
signed long lastseen; |
signed long lastseen; |
470 |
unsigned char hostnamelen; |
unsigned char hostnamelen; |
471 |
unsigned char hostname[256]; |
unsigned char hostname[256]; |
472 |
unsigned long bytesin; |
unsigned long bytesin; |
473 |
unsigned long bytesout; |
unsigned long bytesout; |
474 |
unsigned char protosdata; |
unsigned char protosdata; |
475 |
unsigned char tcpdata; |
unsigned char tcpdata; |
476 |
unsigned char udpdata; |
unsigned char udpdata; |
477 |
|
|
478 |
unsigned char i; |
unsigned char i; |
479 |
|
|
480 |
indent(); |
indent(); |
481 |
|
|
482 |
if ( (addressfamily = read8u()) == 0x04) { // IPv4 address |
if ( (addressfamily = read8u()) == 0x04) { // IPv4 address |
483 |
print_indentation(); |
print_indentation(); |
484 |
printf("IPv4 address family (0x%02x)\n", addressfamily); |
printf("IPv4 address family (0x%02x)\n", addressfamily); |
485 |
|
|
486 |
ipv4address[0] = read8u(); |
ipv4address[0] = read8u(); |
487 |
ipv4address[1] = read8u(); |
ipv4address[1] = read8u(); |
488 |
ipv4address[2] = read8u(); |
ipv4address[2] = read8u(); |
489 |
ipv4address[3] = read8u(); |
ipv4address[3] = read8u(); |
490 |
|
|
491 |
print_indentation(); |
print_indentation(); |
492 |
printf("IPv4 address %d.%d.%d.%d\n", |
printf("IPv4 address %d.%d.%d.%d\n", |
493 |
ipv4address[0], ipv4address[1], ipv4address[2], ipv4address[3]); |
ipv4address[0], ipv4address[1], ipv4address[2], ipv4address[3]); |
494 |
} // if |
} // if |
495 |
else if (addressfamily == 0x06) { // IPv6 address |
else if (addressfamily == 0x06) { // IPv6 address |
496 |
print_indentation(); |
print_indentation(); |
497 |
printf("IPv6 address family (0x%02x)\n", addressfamily); |
printf("IPv6 address family (0x%02x)\n", addressfamily); |
498 |
|
|
499 |
ipv6address[ 0] = read8u(); |
ipv6address[ 0] = read16u(); |
500 |
ipv6address[ 1] = read8u(); |
ipv6address[ 1] = read16u(); |
501 |
ipv6address[ 2] = read8u(); |
ipv6address[ 2] = read16u(); |
502 |
ipv6address[ 3] = read8u(); |
ipv6address[ 3] = read16u(); |
503 |
ipv6address[ 4] = read8u(); |
ipv6address[ 4] = read16u(); |
504 |
ipv6address[ 5] = read8u(); |
ipv6address[ 5] = read16u(); |
505 |
ipv6address[ 6] = read8u(); |
ipv6address[ 6] = read16u(); |
506 |
ipv6address[ 7] = read8u(); |
ipv6address[ 7] = read16u(); |
|
ipv6address[ 8] = read8u(); |
|
|
ipv6address[ 9] = read8u(); |
|
|
ipv6address[10] = read8u(); |
|
|
ipv6address[11] = read8u(); |
|
|
ipv6address[12] = read8u(); |
|
|
ipv6address[13] = read8u(); |
|
|
ipv6address[14] = read8u(); |
|
|
ipv6address[15] = read8u(); |
|
507 |
|
|
508 |
print_indentation(); |
print_indentation(); |
509 |
printf("IPv6 address %02x%02x:%02x%02x:%02x%02x:%02x%02x:%02x%02x:%02x%02x:%02x%02x:%02x%02x\n", |
printf("IPv6 address %04x:%04x:%04x:%04x:%04x:%04x:%04x:%04x\n", |
510 |
ipv6address[ 0], |
ipv6address[ 0], |
511 |
ipv6address[ 1], |
ipv6address[ 1], |
512 |
ipv6address[ 2], |
ipv6address[ 2], |
513 |
ipv6address[ 3], |
ipv6address[ 3], |
514 |
ipv6address[ 4], |
ipv6address[ 4], |
515 |
ipv6address[ 5], |
ipv6address[ 5], |
516 |
ipv6address[ 6], |
ipv6address[ 6], |
517 |
ipv6address[ 7], |
ipv6address[ 7]); |
|
ipv6address[ 8], |
|
|
ipv6address[ 9], |
|
|
ipv6address[10], |
|
|
ipv6address[11], |
|
|
ipv6address[12], |
|
|
ipv6address[13], |
|
|
ipv6address[14], |
|
|
ipv6address[15]); |
|
518 |
} // else if |
} // else if |
519 |
else { // unknown address family |
else { // unknown address family |
520 |
fprintf(stderr, "%s:%s: unknown address family = 0x%x, neither 0x%x nor 0x%x\n", progname, filename, addressfamily, 0x04, 0x06); |
fprintf(stderr, "%s:%s:%ld: unknown address family = 0x%x, neither 0x%x nor 0x%x\n", progname, filename, ftell(file), addressfamily, 0x04, 0x06); |
521 |
exit(EXIT_FAILURE); |
exit(EXIT_FAILURE); |
522 |
} // else |
} // else |
523 |
|
|
524 |
macaddress[0] = read8u(); |
if (follow_specification == true) { |
525 |
macaddress[1] = read8u(); |
macaddress[0] = read8u(); |
526 |
macaddress[2] = read8u(); |
macaddress[1] = read8u(); |
527 |
macaddress[3] = read8u(); |
macaddress[2] = read8u(); |
528 |
macaddress[4] = read8u(); |
macaddress[3] = read8u(); |
529 |
macaddress[5] = read8u(); |
macaddress[4] = read8u(); |
530 |
|
macaddress[5] = read8u(); |
531 |
|
|
532 |
print_indentation(); |
print_indentation(); |
533 |
printf("MAC address %02x:%02x:%02x:%02x:%02x:%02x\n", macaddress[0], macaddress[1], macaddress[2], macaddress[3], macaddress[4], macaddress[5]); |
printf("MAC address %02x:%02x:%02x:%02x:%02x:%02x\n", macaddress[0], macaddress[1], macaddress[2], macaddress[3], macaddress[4], macaddress[5]); |
534 |
|
|
535 |
lastseen = read64s(); |
lastseen = read64s(); |
536 |
|
|
537 |
print_indentation(); |
print_indentation(); |
538 |
printf("Last seen %ld = ", lastseen); |
printf("Last seen 0x%lx = %ld = ", lastseen, lastseen); |
539 |
print_time_t(lastseen); |
print_time_t(lastseen); |
540 |
puts(""); |
puts(""); |
541 |
|
} // if |
542 |
|
else { |
543 |
|
lastseen = read64s(); |
544 |
|
|
545 |
|
print_indentation(); |
546 |
|
printf("Last seen 0x%lx = %ld = ", lastseen, lastseen); |
547 |
|
print_time_t(lastseen); |
548 |
|
puts(""); |
549 |
|
|
550 |
|
macaddress[0] = read8u(); |
551 |
|
macaddress[1] = read8u(); |
552 |
|
macaddress[2] = read8u(); |
553 |
|
macaddress[3] = read8u(); |
554 |
|
macaddress[4] = read8u(); |
555 |
|
macaddress[5] = read8u(); |
556 |
|
|
557 |
|
print_indentation(); |
558 |
|
printf("MAC address %02x:%02x:%02x:%02x:%02x:%02x\n", macaddress[0], macaddress[1], macaddress[2], macaddress[3], macaddress[4], macaddress[5]); |
559 |
|
} // else |
560 |
|
|
561 |
hostnamelen = read8u(); |
hostnamelen = read8u(); |
562 |
|
|
563 |
print_indentation(); |
print_indentation(); |
564 |
printf("Hostname length %d\n", hostnamelen); |
printf("Hostname length %d\n", hostnamelen); |
565 |
|
|
566 |
for (i = 0; i < hostnamelen; i++) { |
for (i = 0; i < hostnamelen; i++) { |
567 |
hostname[i] = read8u(); |
hostname[i] = read8u(); |
568 |
} // for |
} // for |
569 |
hostname[i] = '\0'; |
hostname[i] = '\0'; |
570 |
|
|
571 |
print_indentation(); |
print_indentation(); |
572 |
printf("Hostname %s\n", hostname); |
printf("Hostname %s\n", hostname); |
573 |
|
|
574 |
bytesin = read64u(); |
bytesin = read64u(); |
575 |
|
|
576 |
print_indentation(); |
print_indentation(); |
577 |
printf("Bytes in %lu\n", bytesin); |
printf("Bytes in %lu\n", bytesin); |
578 |
|
|
579 |
bytesout = read64u(); |
bytesout = read64u(); |
580 |
|
|
581 |
print_indentation(); |
print_indentation(); |
582 |
printf("Bytes out %lu\n", bytesout); |
printf("Bytes out %lu\n", bytesout); |
583 |
|
|
584 |
if ( (protosdata = read8u()) != 'P') { // missing protos data |
if ( (protosdata = read8u()) != 'P') { // missing protos data |
585 |
fprintf(stderr, "%s: expecting character P, not %c\n", progname, protosdata); |
fprintf(stderr, "%s:%s:%ld: expecting character P, not %c\n", progname, filename, ftell(file), protosdata); |
586 |
exit(EXIT_FAILURE); |
exit(EXIT_FAILURE); |
587 |
} // if |
} // if |
588 |
|
|
589 |
decode_protos_data(); |
decode_protos_data(); |
590 |
|
|
591 |
if ( (tcpdata = read8u()) != 'T') { // missing tcp data |
if ( (tcpdata = read8u()) != 'T') { // missing tcp data |
592 |
fprintf(stderr, "%s: expecting character T, not %c\n", progname, tcpdata); |
fprintf(stderr, "%s:%s:%ld: expecting character T, not %c\n", progname, filename, ftell(file), tcpdata); |
593 |
exit(EXIT_FAILURE); |
exit(EXIT_FAILURE); |
594 |
} // if |
} // if |
595 |
|
|
596 |
decode_tcp_data(); |
decode_tcp_data(); |
597 |
|
|
598 |
if ( (udpdata = read8u()) != 'U') { // missing udp data |
if ( (udpdata = read8u()) != 'U') { // missing udp data |
599 |
fprintf(stderr, "%s: expecting character U, not %c\n", progname, udpdata); |
fprintf(stderr, "%s:%s:%ld: expecting character U, not %c\n", progname, filename, ftell(file), udpdata); |
600 |
exit(EXIT_FAILURE); |
exit(EXIT_FAILURE); |
601 |
} // if |
} // if |
602 |
|
|
603 |
decode_udp_data(); |
decode_udp_data(); |
604 |
|
|
605 |
exdent(); |
exdent(); |
606 |
} // decode_host_header_v3 |
} // decode_host_header_v3 |
607 |
|
|
608 |
void decode_protos_data(void) |
void decode_protos_data(void) |
609 |
{ |
{ |
610 |
unsigned char ipprotocount; |
unsigned char ipprotocount; |
611 |
|
|
612 |
unsigned char u; |
unsigned char u; |
613 |
|
|
614 |
ipprotocount = read8u(); |
ipprotocount = read8u(); |
618 |
|
|
619 |
indent(); |
indent(); |
620 |
|
|
621 |
for (u = 0; u < ipprotocount; u++) { |
for (u = 0; u < ipprotocount; u++) { |
622 |
unsigned char proto; |
unsigned char proto; |
623 |
unsigned long in; |
unsigned long in; |
624 |
unsigned long out; |
unsigned long out; |
625 |
|
|
626 |
print_indentation(); |
print_indentation(); |
627 |
printf("Protocol #%u of %u:\n", u + 1, ipprotocount); |
printf("Protocol #%u of %u:\n", u + 1, ipprotocount); |
628 |
|
|
629 |
proto = read8u(); |
proto = read8u(); |
630 |
|
|
631 |
indent(); |
indent(); |
632 |
print_indentation(); |
print_indentation(); |
633 |
printf("Protocol 0x%x\n", proto); |
printf("Protocol 0x%02x\n", proto); |
634 |
|
|
635 |
in = read64u(); |
in = read64u(); |
636 |
|
|
637 |
print_indentation(); |
print_indentation(); |
638 |
printf("In %lu\n", in); |
printf("In %lu\n", in); |
639 |
|
|
640 |
out = read64u(); |
out = read64u(); |
641 |
|
|
642 |
print_indentation(); |
print_indentation(); |
643 |
printf("Out %lu\n", out); |
printf("Out %lu\n", out); |
644 |
|
|
645 |
exdent(); |
exdent(); |
646 |
} // for |
} // for |
647 |
|
|
648 |
exdent(); |
exdent(); |
732 |
} // for |
} // for |
733 |
|
|
734 |
exdent(); |
exdent(); |
735 |
} // decode_udp_data() |
} // decode_udp_data() |
736 |
|
|
737 |
void decode_graph_db_v1(void) |
void decode_graph_db_v1(void) |
738 |
{ |
{ |
739 |
signed long lasttime; |
signed long lasttime; |
740 |
|
|
741 |
unsigned int i; |
unsigned int i; |
742 |
|
|
743 |
lasttime = read64s(); |
lasttime = read64s(); |
744 |
|
|
745 |
indent(); |
indent(); |
746 |
print_indentation(); |
print_indentation(); |
747 |
printf("Last time %ld = ", lasttime); |
printf("Last time 0x%lx = %ld = ", lasttime, lasttime); |
748 |
print_time_t(lasttime); |
print_time_t(lasttime); |
749 |
puts(""); |
puts(""); |
750 |
|
|
751 |
for (i = 0; i < 4; i++) { |
for (i = 0; i < 4; i++) { |
752 |
unsigned char nbars; |
unsigned char nbars; |
753 |
unsigned char idxlastbar; |
unsigned char idxlastbar; |
754 |
|
|
755 |
unsigned int j; |
unsigned int j; |
756 |
|
|
757 |
print_indentation(); |
print_indentation(); |
758 |
printf("Graph #%d of 4:\n", i + 1); |
printf("Graph #%d of 4:\n", i + 1); |
759 |
|
|
760 |
nbars = read8u(); |
nbars = read8u(); |
761 |
|
|
762 |
indent(); |
indent(); |
895 |
if ( (r = fread((void *)&v, sizeof(v), 1, file)) != 1) { |
if ( (r = fread((void *)&v, sizeof(v), 1, file)) != 1) { |
896 |
handle_file_error(); |
handle_file_error(); |
897 |
} // if |
} // if |
898 |
|
|
899 |
#ifdef __LITTLE_ENDIAN__ |
#ifdef __LITTLE_ENDIAN__ |
900 |
v = ntohl(v); |
v = ntohl(v); |
901 |
#endif |
#endif |
902 |
|
|
903 |
return v; |
return v; |
904 |
} // read32s() |
} // read32s() |
905 |
|
|
906 |
unsigned long read64u(void) |
unsigned long read64u(void) |
907 |
{ |
{ |
908 |
size_t r; |
size_t r; |
909 |
unsigned long v; |
unsigned long v; |
|
unsigned int *p = (unsigned int *)&v; |
|
910 |
|
|
911 |
|
#ifdef __LITTLE_ENDIAN__ |
912 |
|
unsigned long tmp; |
913 |
|
unsigned int *p1 = (unsigned int *)&v; |
914 |
|
unsigned int *p2 = (unsigned int *)&tmp; |
915 |
|
#endif |
916 |
|
|
917 |
//fprintf(stderr, "%s: sizeof(unsigned long) = %ld\n", progname, sizeof(v)); |
//fprintf(stderr, "%s: sizeof(unsigned long) = %ld\n", progname, sizeof(v)); |
918 |
|
|
919 |
if ( (r = fread((void *)&v, sizeof(v), 1, file)) != 1) { |
if ( (r = fread((void *)&v, sizeof(v), 1, file)) != 1) { |
920 |
handle_file_error(); |
handle_file_error(); |
921 |
} // if |
} // if |
922 |
|
|
923 |
#ifdef __LITTLE_ENDIAN__ |
#ifdef __LITTLE_ENDIAN__ |
924 |
p[0] = ntohl((unsigned int)p[0]); |
p2[1] = ntohl(p1[0]); |
925 |
p[1] = ntohl((unsigned int)p[1]); |
p2[0] = ntohl(p1[1]); |
926 |
|
v = tmp; |
927 |
#endif |
#endif |
928 |
|
|
929 |
return v; |
return v; |
930 |
} // read64u() |
} // read64u() |
931 |
|
|
932 |
signed long read64s(void) |
signed long read64s(void) |
933 |
{ |
{ |
934 |
size_t r; |
size_t r; |
935 |
signed long v; |
signed long v; |
|
signed int *p = (signed int *)&v; |
|
936 |
|
|
937 |
|
#ifdef __LITTLE_ENDIAN__ |
938 |
|
signed long tmp; |
939 |
|
signed int *p1 = (signed int *)&v; |
940 |
|
signed int *p2 = (signed int *)&tmp; |
941 |
|
#endif |
942 |
|
|
943 |
//fprintf(stderr, "%s: sizeof(signed long) = %ld\n", progname, sizeof(v)); |
//fprintf(stderr, "%s: sizeof(signed long) = %ld\n", progname, sizeof(v)); |
944 |
|
|
945 |
if ( (r = fread((void *)&v, sizeof(v), 1, file)) != 1) { |
if ( (r = fread((void *)&v, sizeof(v), 1, file)) != 1) { |
946 |
handle_file_error(); |
handle_file_error(); |
947 |
} // if |
} // if |
948 |
|
|
949 |
#ifdef __LITTLE_ENDIAN__ |
#ifdef __LITTLE_ENDIAN__ |
950 |
p[0] = ntohl((signed int)p[0]); |
p2[1] = ntohl(p1[0]); |
951 |
p[1] = ntohl((signed int)p[1]); |
p2[0] = ntohl(p1[1]); |
952 |
|
v = tmp; |
953 |
#endif |
#endif |
954 |
|
|
955 |
return v; |
return v; |
956 |
} // read64s() |
} // read64s() |
957 |
|
|
958 |
void handle_file_error(void) |
void handle_file_error(void) |
959 |
{ |
{ |
960 |
|
int saved_errno = errno; |
961 |
|
|
962 |
if (feof(file) != 0) { |
if (feof(file) != 0) { |
963 |
fprintf(stderr, "%s:%s: premature end-of-file\n", progname, filename); |
fprintf(stderr, "%s:%s:%ld: premature end-of-file\n", progname, filename, ftell(file)); |
964 |
exit(EXIT_FAILURE); |
exit(EXIT_FAILURE); |
965 |
} // if |
} // if |
966 |
|
|
967 |
if (ferror(file) != 0) { |
if (ferror(file) != 0) { |
968 |
fprintf(stderr, "%s:%s: file error, errno = %s (%d)\n", progname, filename, strerror(errno), errno); |
fprintf(stderr, "%s:%s:%ld: file error, errno = %s (%d)\n", progname, filename, ftell(file), strerror(saved_errno), saved_errno); |
969 |
exit(EXIT_FAILURE); |
exit(EXIT_FAILURE); |
970 |
} // if |
} // if |
971 |
} // handle_file_error() |
} // handle_file_error() |
972 |
|
|
973 |
signed long long indentation = 0LL; |
signed long long indentation = 0LL; |
974 |
|
|
975 |
void indent(void) |
void indent(void) |
976 |
{ |
{ |
977 |
indentation += 2LL; |
indentation += 2LL; |
978 |
} // indent() |
} // indent() |
979 |
|
|
980 |
void exdent(void) |
void exdent(void) |
981 |
{ |
{ |
982 |
indentation -= 2LL; |
indentation -= 2LL; |
983 |
|
|
992 |
|
|
993 |
for (i = 0; i < indentation; i++) { |
for (i = 0; i < indentation; i++) { |
994 |
putchar(' '); |
putchar(' '); |
995 |
} // for |
} // for |
996 |
} // print_indentation() |
} // print_indentation() |
997 |
|
|
998 |
void print_time_t(time_t t) |
void print_time_t(time_t t) |
999 |
{ |
{ |
1000 |
struct tm *stm; |
struct tm *stm; |
1001 |
char buffer[1024]; |
char buffer[1024]; |
1002 |
|
|
1003 |
stm = gmtime(&t); |
stm = gmtime(&t); |
1004 |
|
|
1005 |
// ISO 8601 format |
// ISO 8601 format |
1006 |
if (strftime(buffer, sizeof(buffer), "%Y-%m-%dT%H:%M:%S%z", stm) == 0) { |
if (strftime(buffer, sizeof(buffer), "%Y-%m-%dT%H:%M:%S%z", stm) == 0) { |
1007 |
fprintf(stderr, "%s:%s: strftime() error, errno = %s (%d)\n", progname, filename, strerror(errno), errno); |
int saved_errno = errno; |
1008 |
|
|
1009 |
|
fprintf(stderr, "%s:%s:%ld: strftime() error, errno = %s (%d)\n", progname, filename, ftell(file), strerror(saved_errno), saved_errno); |
1010 |
exit(EXIT_FAILURE); |
exit(EXIT_FAILURE); |
1011 |
} // if |
} // if |
1012 |
|
|
1013 |
fputs(buffer, stdout); |
fputs(buffer, stdout); |
1014 |
} // print_time_t() |
} // print_time_t() |
1015 |
|
|
1016 |
// darkstattype.c |
// darkstattype.c |